Santy

Santy is a computer worm created in Perl to exploit a vulnerability in PhpBB software which spread through and used Google to spread across the Internet.

Within 24 hours of its release on 20 December 2004, a large number of websites (estimated by some at 30,000 to 40,000) were attacked by Santy. The worm caused writeable files (of formats such as .php and .html) on the infected server to display the message This site is defaced!!! This site is defaced!!! NeverEverNoSanity WebWorm generation X , where X is a number representing the generation of the worm.

There have been variants of the worm, some which use alternative search engines after Google blocked queries from the Santy worm, and an anti-Santy worm which attempts to patch vulnerable installations [http://www.zdnet.co.uk/news/internet/security/0,39020375,39182954-1,00.htm].

The phpBB Group had released a patch for the vulnerability a month before the attacks, in phpBB 2.0.11.

=External links=

*[http://news.bbc.co.uk/1/hi/technology/4117711.stm BBC news report] *[http://www.phpbb.com/phpBB/viewtopic.phpf=14&t=240636 The patch from phpBB] *[http://www.kaspersky.com/newsid=156681162 Kaspersky Lab page on Santy]