Security threats Toolkit

Anti-Santy worm spreads

Published: 31 Dec 2004 13:00 GMT

An anti-Santy worm that uses search engines to spread among online bulletin boards has been spotted, F-Secure confirmed on Friday.

F-Secure said it was aware of seven sites that had been defaced by the worm. The anti-Santy worm searches Google for sites that use phpBB bulletin board software, infects the sites and attempts to make the sites more secure by installing a patch.

Mikko Hyppönen, director of antivirus research at F-Secure, said that although the worm may seem beneficial, in fact it is likely to cause problems for administrators who will have to handle the increase in traffic.

"I can't comment how effective it is in fixing the sites," said Hyppönen. "If a site is infected, the worm causes a huge amount of traffic and slows down the site. I don't think it's possible to write a beneficial worm."

Sites that have been attacked by the anti-Santy worm are defaced with the words: "viewtopic.php secured by Anti-Santy-Worm V4. Your site is a bit safer, but upgrade to >= 2.0.11."

Hyppönen said he has seen two versions of the defacement page, which lead to two different IP addresses. Both IP addresses resolve to Argentina, which suggest that that is where the anti-Santy worm originated.

The Santy worm wreaked havoc in the weeks before Christmas, spreading to over 40,000 Web sites by 21 December. On 22 December Google started blocking queries that were generated by the worm, to stop the worm from replicating. But a few days later it was discovered that it was using AOL's and Yahoo's search engines and was still targeting Google.