The Web    Google
12/27: Worm_Santy-F Targets phpBB Applications

12/27: Worm_Santy-F Targets phpBB Applications
December 27, 2004

Trend Micro is reporting Worm_Santy.F is rapidly spreading in the wild. Initial analysis of samples of this worm indicates it spreads on Web servers running the popular phpBB application. Individual end-user systems are unaffected.

This worm uses the Web search engine Google to find other hosts. Part of the search string it uses contains viewtopic.php.

It also attempts to start an IRC bot to connect to a specified server on TCP port 6667 to give access to a remote attacker.

Technical details can be found at Trend Micro page.

  • 4/4: Mytob-C Worm Looks For Flaw
  • Too Many Lost Emails Leave us Unconnected
  • 11/5: Backdoor.Ranky-L Enables Attacker
  • Security Experts On Alert for Large-Scale Hacker Assault
  • 1/10: VBS/Mcon-G Worm Spreads Via IRC
  • 4/15: Sdbot-XC Worm Targets Passwords
  • DNSSEC: For When a Spoof Isn't a Comedy
  • 4/4: VBS.Kuullio Worm Sends Emails
  • 1/27: StartPage-FX Trojan Modifies IE Settings
  • 5/2: Oscarbot Virus Spreads a Hyperlink
  • FTC Seeks Court Order Against "Do Not Call" Web Site
  • Computer security background information