Santy-Wurm attacks internet forums

Winfuture reports that at the end of December 2004 the worm Santy has spread over the internet where it attacked those web-sites that use the forum software phpBB by overwriting files lokated on the webserver and displaying different contents.

In order to locate those forums Santy used Google. The administrators could take care of the worm by filtering its search requests. However, new variants have been developed that are now using AOL and Yahoo to find these forums.

Moreover, Skypi.A and Skypi.B have been derived from Santy and those worms are now using the Brasilian Google web-site to spread over the Internet. Computers of those forums' users are not affected by these worms since it attacks those sites programmed with phpBB directly on the webserver hosting them.

Further information about the vulnerability of the forums concerned can be found on the phpBB web-site.

Source: http://www.winfuture.de/news,18262.html and http://www.f-secure.com/v-descs/santy_a.shtml