Santy worm defaces thousands of sites

Grok Headline matches for Santy worm defaces thousands of sites

Santy Worm Defaces Web Forums

Santy Worm Defaces Web Forums 12/22/2004 01:35 AM
The Internet worm is squirming through Web servers that are running unpatched versions of the popular phpBB Web forum software. Santy uses Google search to randomly find sites running phpBB and then overwrites files.

New Santy Worm Threatens More Sites

New Santy Worm Threatens More Sites 12/27/2004 03:53 PM
Techzonez Dec 27 2004 7:52PM GMT

Santy.E worm poses threat to sites badly
coded in PHP

Santy.E worm poses threat to sites badly
coded in PHP 12/27/2004 11:15 AM
The latest version of the Santy worm poses an elevated risk to many Web sites built using the PHP scripting language, and protection of those sites may involve individually recoding them, security experts warned over the weekend.

Re: New Santy-Worm attacks *all*
PHP-skripts ( Santy.c ? )

Re: New Santy-Worm attacks *all*
PHP-skripts ( Santy.c ? ) 12/25/2004 05:08 PM
K-OTiK Security (Dec 25 2004)

The Santy worm mutates

The Santy worm mutates 12/28/2004 05:37 PM
TechSpot Dec 28 2004 9:42PM GMT

New Santy-Worm attacks *all* PHP-skripts

New Santy-Worm attacks *all* PHP-skripts 12/25/2004 05:09 PM
Juergen Schmidt (Dec 25 2004)

Santy Worm Hits AOL, Yahoo

Santy Worm Hits AOL, Yahoo 12/28/2004 12:49 PM
Enterprise Security Today Dec 28 2004 4:49PM GMT

Anti-Santy worm on the prowl

Anti-Santy worm on the prowl 12/31/2004 12:32 PM
ZDNet Dec 31 2004 5:10PM GMT

Santy Worm Varients Spreading

Santy Worm Varients Spreading 12/28/2004 07:14 PM
As we reported last week, Google had been used by the "Santy.A" worm to infect websites using vulnerable versions of phpBB. Google has since disallowed such search attempts by the worm, by simply not listing vulnerable sites in their search results.

Variants are now attempting to exploit search engines offered by Yahoo and AOL, targeting sites running versions of phpBB prior to version 2.0.11. Some variants of the worm damage sites using poorly coded php instances of include() and require(). AOL claims that they are now unaffected, but Yahoo has yet to comment on their security status.

Santy deletes content from effected php-based sites, and replaces it with information found within the worm itself. Luckily this worm is not communicable to computers who visit effected sites. Sites using older versions of phpBB should update immediately, and some sites utilizing php may have to be rewritten all together.

View: Google's Response @ F-Secure Virus Lab Blog

Read full story...

Santy worm now targets Yahoo and AOL

Santy worm now targets Yahoo and AOL 12/28/2004 09:28 PM
Pravda Dec 29 2004 1:50AM GMT

Santy worm Targets AOL Yahoo

Santy worm Targets AOL Yahoo 12/28/2004 11:11 PM
WebProNews Dec 29 2004 3:43AM GMT

Anti-Santy worm spreads

Anti-Santy worm spreads 12/31/2004 09:02 AM
ZDNet UK Dec 31 2004 1:20PM GMT

Google smacks down Santy worm

Google smacks down Santy worm 12/24/2004 12:27 PM
Google said it was blocking searches generated by a new worm, Santy.A, which were being used to find and infect vulnerable computers on the Internet.

New worm, Santy.A, using Google to
spread

New worm, Santy.A, using Google to
spread 12/22/2004 12:58 AM
Antivirus companies are warning Internet users of a new, fast-spreading worm that uses the Google search engine to infect Web servers running a popular package of online bulletin board software.

Google blocks Web worm Santy.A

Google blocks Web worm Santy.A 12/29/2004 08:44 PM
The Hindu Business Line Dec 30 2004 12:40AM GMT

Google squashes Santy worm

Google squashes Santy worm 12/22/2004 01:41 AM
Search firm shuts off ability of worm--which searched for victims via Google--to replicate.

New worm, Santy, using Google to spread

New worm, Santy, using Google to spread 12/22/2004 01:52 AM
Antivirus companies are warning Internet users about a fast-spreading new worm that infects Web servers running a popular package of online bulletin board software, and uses the Google search engine to find vulnerable servers to infect.

Google Becomes Unwitting Abettor for
Santy Worm

Google Becomes Unwitting Abettor for
Santy Worm 12/22/2004 01:44 AM

The new Santy worm uses the Google search engine to find vulnerable websites and then defaces the sites' bulletin boards. The worm, formally named Net-Worm.Perl.Santy, attacks website bulletin boards (Internet forums or message centers) running versions of the popular phpBB bulletin board application. The worm exploits a known security vulnerability in early releases of the phpBB application, defacing the contents of the bulletin board.

Google stops spread of Santy worm

Google stops spread of Santy worm 12/24/2004 12:36 PM

Santy PHP Worm Variant With 50 Exploits
Discovered

Santy PHP Worm Variant With 50 Exploits
Discovered 01/02/2005 02:05 PM

Other News: Santy worm takes new tack

Other News: Santy worm takes new tack 12/28/2004 03:33 AM
The Santy worm, which originally used Google searches to locate vulnerable phpBB installations, has now mutated to use AOL and Yahoo instead.

BBC: Santy Worm Makes Unwelcome Visit

BBC: Santy Worm Makes Unwelcome Visit 12/24/2004 01:04 PM
"Thousands of website bulletin boards have been defaced by a virus that used Google to spread across the net..."

Anti-Santy Worm Patches phpBB Flaw

Anti-Santy Worm Patches phpBB Flaw 12/31/2004 12:08 PM

Google Nukes Santy Worm, But Threat
Remains

Google Nukes Santy Worm, But Threat
Remains 12/24/2004 12:17 PM
Extreme Tech Dec 24 2004 3:33PM GMT

Net-Worm.Perl.Santy.a threatens Internet
forums

Net-Worm.Perl.Santy.a threatens Internet
forums 12/22/2004 01:17 AM

Google Nukes Santy Worm, But Search
Threat Remains

Google Nukes Santy Worm, But Search
Threat Remains 12/26/2004 10:35 PM
eWeek Dec 27 2004 1:21AM GMT

Santy variants target AOL and Yahoo
Computer worm uses searches to spread

Santy variants target AOL and Yahoo
Computer worm uses searches to spread 12/28/2004 07:25 AM
San Francisco Chronicle Dec 28 2004 11:41AM GMT

Thousands of Web sites attacked

Thousands of Web sites attacked 06/25/2004 06:54 AM

Net worm snarls thousands of computers

Net worm snarls thousands of computers 05/03/2004 01:54 PM
AP via Seattle Post Intelligencer May 3 2004 6:43PM GMT

Net Worm Snarls Thousands of Computers
(AP)

Net Worm Snarls Thousands of Computers
(AP) 05/03/2004 01:47 PM
AP - An Internet worm that takes advantage of a known flaw with the Windows operating system raced around the world Monday, snarling tens of thousands of computers and causing Internet traffic to slow.

Thousands of sites hit by mystery virus

Thousands of sites hit by mystery virus 06/25/2004 05:21 AM
iafrica.com Jun 25 2004 9:10AM GMT

'Sasser' Worm Strikes Hundreds of
Thousands of PCs

'Sasser' Worm Strikes Hundreds of
Thousands of PCs 05/05/2004 01:09 AM

washingtonpost.com/wp-dyn/articles/A63002-2004May3.html
track this site | 4 links

Sasser worm strikes hundreds of
thousands of PCs

Sasser worm strikes hundreds of
thousands of PCs 05/03/2004 06:33 AM
Forbes May 3 2004 11:12AM GMT

Internet attack affects thousands of
sites

Internet attack affects thousands of
sites 06/25/2004 05:47 AM
Indystar.com - Fri Jun 25, 08:22 am GMT

'Sasser' Worm Strikes Hundreds of
Thousands of PCs (washingtonpost.com)

'Sasser' Worm Strikes Hundreds of
Thousands of PCs (washingtonpost.com) 05/03/2004 03:17 PM
washingtonpost.com - A new Internet worm that infected hundreds of thousands of computers over the weekend picked up speed as people returned to work on Monday and turned on their infected PCs, security experts said.

Experts studying Internet attack;
thousands of sites affected

Experts studying Internet attack;
thousands of sites affected 06/24/2004 09:25 PM
San Francisco Chronicle Jun 25 2004 1:28AM GMT

Experts Studying Developing Internet
Attack; Thousands of Sites Affected

Experts Studying Developing Internet
Attack; Thousands of Sites Affected 06/25/2004 02:04 AM
Xposed Jun 25 2004 5:38AM GMT

Some Candidates Turn To Blogs to Place
Ads: Sites are Low-Cost, Reach Thousands

Some Candidates Turn To Blogs to Place
Ads: Sites are Low-Cost, Reach Thousands 04/20/2004 07:17 AM
placing ads on weblogs .. blogs for advertising .. Blogs and blogadds

washingtonpost.com/wp-dyn/articles/A20561-2004Apr17.html
track this site | 7 links

German Teen Confesses to Creating
'Sasser' Worm That Infected Thousands of
Computers Worldwide

German Teen Confesses to Creating
'Sasser' Worm That Infected Thousands of
Computers Worldwide 05/09/2004 08:57 AM
Xposed May 9 2004 12:15PM GMT
Grok Description matches for Santy worm defaces thousands of sites
GrokA matches for Santy worm defaces thousands of sites

Santy worm defaces thousands of sites

The following phrases have been identified by the grok system as matching this entry: