PHPInclude (Santy.C) Worm Attack

[MarkG]

The site was unreachable for more than an hours, as we got hit by a worm attacking sites with php, an evolution of the Santy.A worm that hit thousands of phpBB sites the last few days

Luckily for Apolyton, Top40-Charts was being hit from the same worm the last two days and Apolyton was hit after me finding out a way to stop it

A quick fix has been applied to most pages and I'm now looking at a more thorough solution


Interested webmasters can mail me about it at my markg at apolyton.net address

[MarkG]

I'm providing a free service and i'm not a socialist?

[Apocalypse]

Maybe he's talking about how none of the Forum Styles are Red....they are all white/black/green/blue/yellowish. No red

[MarkG]

it's only to make the admin/staff icons and the santa caps look better

[Dis]

I'm glad we came out relatively unscathed.

Good work Markos!

[Urban Ranger]

Do they say anything about this on PHP.net? A patch perhaps?

[Atahualpa]

How does this attack work and how can one protect?

I don't think that I can get affected since I don't include on variables that I have not checked or set before.

But I have lots of

require(dirname(__FILE__)."/inc.php"); 

is this a problem?

[Method]

/me nods *

This worm hit another forum i frequent. Nasty little bugger.

[Urban Ranger]

Originally posted by Atahualpa
How does this attack work and how can one protect?

More info

Note that Google has already blocked the specific request that the original Santy.a worm uses, so perhaps Santy.c uses a different one.

[Skanky Burns]

Originally posted by MarkG
I'm providing a free service and i'm not a socialist?

Of course not. You aren't taking resources from others for "the good of the state"...

[St Leo]

Originally posted by MarkG
it's only to make the admin/staff icons and the santa caps look better

Mixing primary colours is a big artistic no-no.

[MarkG]

Originally posted by Comrade Tassadar
The Communist Party of Eventis decries Apolytonian exploitation of its people in the form of "Apolyton PLUS!".

what! we are exploiting the rich in order to provide a better free service to the masses!!

[MarkG]

Originally posted by Urban Ranger
Note that Google has already blocked the specific request that the original Santy.a worm uses, so perhaps Santy.c uses a different one.

google has taken action against santy.a since the 22nd. still top40 was hit from santy.c (which actually doesnt have anything to do with phpbb) since friday evening and apolyton only got hit last night

it seems that there are thousands of servers still hit and trying to infect others

http://www.google.com/search?q=This+site+is+defaced

[Sprayber]

Originally posted by MarkG
what! we are exploiting the rich in order to provide a better free service to the masses!!

You may be exploiting me but I sure as heck fire ain't rich

[MarkG]

ssssh! dont destroy the plot!