Google squashes Santy worm

TalkBack 2 of 3:

Next »

« Previous

• Thread View
• Flat View

Not exactly squashed

If you're a tech-head read this.

There is a very serious flaw in PHP 5.2 and lower especially when used with PHPBB prior to version 2.0.11(used for this message board).

Through some fancy reverse-engineering we were able to rebuild the neverevernosanity worm by parsing our own log files. We forwarded this reverse-engineered code to the Google security team on 12/20/2004 at 1:03AM Eastern Standard Time.

Basically, code could be injected into a vulnerable computer. I believe this is just as serious as the code red worm from September of 2001, but not as widespread because less machines have PHPBB installed. If you recall, the code red worm infected any machine with IIS and WSH.

While Google has taken steps to stop this particular worm from spreading there is nothing preventing future attacks from using other search engines to spread. It would be easy to simply replace a few lines of code in the worm to use MSN instead of Google and it would keep on going.

Google has taken measures to prevent the worm from spreading but they can't fix vulnerable servers so upgrade your PHPs to 5.3 and upgrade your PHPBBs!

Gui W.
www.alphabetware.com

Posted by: guillermo6   Posted on: 12/22/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• The True Costs of Virtual Server Solutions VMware In an economic environment that is repeatedly heralding the message "do ... Download Now
• Reducing Server Total Cost of Ownership with VMware Virtualization Software VMware VMware virtualization enables customers to reduce their server TCO and ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now