!!! Santy worm defaces websites using php bug !!!

[bartdotla]

Santy worm defaces websites using php bug

A worm taking advantage of a phpBB vulnerability has been defacing websites and explains a number of reports we received today regarding deface web servers. The worm is written in Perl and seems to overwrite all writeable asp/php/htm/shtm files on the server.

Note: we earlier reported that it takes advantage of a php vulnerability. This does not seem to be the case. The worm exploits the 'highlight' bug in phpBB 2.0.10 and earlier. The current version of phpBB (2.0.11, released Nov. 18th) fixes this problem. Nevertheless, its still a good idea to update php.

more on http://isc.sans.org/

PS: Thanks Andrew to force me to update my phpBB last week! ;-)

[bartdotla]

too quick again, sorry!

see also http://forums.dathorn.com/showthread.php?t=1250

[Frank Hagan]

I have already upgraded all my sites using phpBB to 2.0.11, but even before that I had read that you should always remove the notice of what version of the script is running that the authors insist on putting at the bottom of the pages.

Hackers simply Google for the version of the software to find their victims. Now, it seems they have written that function into the worm, so it does it automatically:

Santy.a is something of a novelty - it creates a specially formulated Google search request, which results in a list of sites running vulnerable versions of phpBB.

So update your scripts, of course, but go one step further. In phpBB, edit the "overall_footer.tpl" file so that the version of the software no longer prints out at the bottom of each page. Or, put an exclude for your forums in the robots.txt file. And then do the same for the rest of your scripts.

[ChrisTech]

Any idea where the version feild is located in IPB forums ?

[-Oz-]

I was running 2.0.11 and got hacked.

[oarenj]

Same Here.

[Jonathan]

Any idea where the version feild is located in IPB forums ?

Off the top of my head, I'd say check the Boards.php file;
That has the title part, and I think also the vers. field. Not 100% sure though.

[Klaassh]

Any idea where the version feild is located in IPB forums ?

On 1.3.1
Check in sources\functions.php (line2015) for {$ibforums->version}
It is also in sources\dynamiclite\csite.php (line285) if your using dynamic lite

on 2.0.3
index.php(112): var $version = "v2.0.3 ";
it is also in
admin.php(129): var $version = 'v2.0.3 ';
but I believe this is there version checking for upgrades

Should be similar for earlier versions of both

Removing the entire copyright will get you in trouble with IPB(unless you've paid for the right) but just the version info might be OK

[ChrisTech]

On 1.3.1
Check in sources\functions.php (line2015) for {$ibforums->version}
It is also in sources\dynamiclite\csite.php (line285) if your using dynamic lite

on 2.0.3
index.php(112): var $version = "v2.0.3 ";
it is also in
admin.php(129): var $version = 'v2.0.3 ';
but I believe this is there version checking for upgrades

Should be similar for earlier versions of both

Removing the entire copyright will get you in trouble with IPB(unless you've paid for the right) but just the version info might be OK

Hmm, Im lower than 1.3.1 =) Will look at it later on tonite.

[Frank Hagan]

One of my sites was hacked. I thought I had updated all the forums, but I had one old one I forgot about,and the worm found it. So I'm restoring it in the background. Luckily, it was one of my slowest sites out there, and not an income generating one. Gotta' be more careful next time.