Anyone seen this yet??? Maybe new worm, i'm wondering... 1

[karmic]

A friendly, family website got defaced sometime thru the night... The calling card that was left is:

"NeverEverNoSanity WebWorm generation 13."

has anyone seen this???

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[MichealC4]

Not to be mean, but are you sure it is a worm? It may be a calling card from a new script kiddie group. However, going on the assumption that it is a worm, I can't see to find anything on it. So, my question is do you have access logs from your server? You might get better results in Forum83.

----------------------------
"Security is like an onion" - Unknown

 

[MichealC4]

I've made some progress on tracking this down. Were you running PHP on your site? Specifically <= 4.3.9? Or <= 5.0.2? (not including 4.3.10)

If so, it appears to be an automated attack of some sort exploiting the recent vulnerabilites found in the above PHP versions. The issue is fixed in 4.3.10 and 5.0.3, respectively.

----------------------------
"Security is like an onion" - Unknown

 

[karmic]

It's not my site, fortunately...

Not sure what the version is... It's a concern to me as i've had a few clients with defaced websites but nothing to this extreme... This hacker seems to have taken over the entire server. My concern is what's next, and who is this group...

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[MichealC4]

I found one of the tools that could have been used, but it depends on certain software running in order for the PHP exploit to work. And it doesn't appear to leave the calling card that I found. So at the moment, it is either something so new, nobody has heard of it yet (which I'm guessing is correct), or they do a very good job of hiding their tracks thus far. Access logs will be important however.

----------------------------
"Security is like an onion" - Unknown

 

[karmic]

I don't have access to the logs, it's not my site... The site is not my concern, the hacker is...

My main concern is if anyone has heard of this as of yet, it seems to be new. My concern is finding information about "NeverEverNoSanity WebWorm generation 13" and is this going to be a trend...

It may be a tool but it's definitely a direct access to the PHPBB site, don't know if it's an IIS hack or not.

I'm going to try to contact the web admin to see if he/she is willing to part with the information or not.

In the meantime, if you find information on the web about this, please post it here.


Thanks.

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[MichealC4]

Oops. Sorry. I keep reading your posts, understand what you say, and keep thinking it is your site.

Okay, the fact that it is a phpBB site does indeed help. However, for anybody reading, it is not an exploit in phpBB (as far as I can tell anyway, unless they did not update to 2.0.11), but rather PHP.

In the interest of not posting exploit code (as a) I don't like it and b) I'm a support tech for phpBB ), I'll only give the site. However, it should be pretty obvious where to go from there.

http://www.packetstormsecurity.org/0412-exploits/

That's what I found earlier. I hope the admins don't mind my posting that link.

----------------------------
"Security is like an onion" - Unknown

 

[karmic]

TechieMicheal, I don't know about the admins, but I sure don't...

Thanks alot.

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[MichealC4]

Okay, some more information for you. I was contacted by a phpBB user who was attacked with this worm.

The worm attacks phpBB, exploiting the recent highlight vulnerability (which means the site is unpatched), the worm then defaces the site, google's for more sites, and then spreads, each time increasing its generation number by one.

So, the lesson to be learned here is to keep the software you use up-to-date.

----------------------------
"Security is like an onion" - Unknown

 

[karmic]

Thanks micheal, that helps greatly.

Got an email from a friend of mine last night regarding NeverEverNoSanity. He recalls hearing about a group called this from years back...



~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[JimInKS]

Story about this worm using google to propagate itself:

http://news.zdnet.com/2100-1009_22-5499725.html?tag=nl.e589

 

[Kesser]

Useful info folks - our technician's fave forum was attacked by this last night, didn't realise what it was until I read this lot....

Thanx

Kes

 

[karmic]

Thanks jiminks... was trying to find the article.

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[eyec]

phpBB Announcement

 

[sydspirit2]

karmic:
This just in......

http://isc.sans.org/diary.php

 

[2ffat]

Cert has an alert out, too.

http://www.kb.cert.org/vuls/id/497400

James P. Cottingham
-----------------------------------------
[sup]To determine how long it will take to write and debug a program, take your best estimate, multiply that by two, add one, and convert to the next higher units.[/sup]

 

[MichealC4]

The update for phpBB has been out for over a month, so there's no excuse for not updating. ^_^

----------------------------
"Security is like an onion" - Unknown

 

[wvajenm]

Symantec has a fix out for this one also, it's on their list of most recent threats.

 

[karmic]

took a few days for any information to trickle out from the web...

~ K.I.S.S - Don't make it any more complex than it has to be ~