PHP Worm, Mobile Phone Worm

Two new stories to report (Wormblog has been running on auto pilot while I was away for a bit). These are based on external news reports and mailing list posts.

The first is a PHP worm dubbed "Santy". The worm attacks poorly constructed sites which are built using the PHP language, the worm itself appears to be written in Perl. Originally started as a worm to attack phpBB (a PHP based bulletin board) sites, it now appears that new variants attack various PHP scripts that do lazy includes and trust user-supplied input. These "PHP includes" are basically user-input driven PHP mockups of files. Before people would use them to read arbitrary files from a system, but they have developed a worm that uploads itself using this mechanism. The phpBB website has a vulnerability desription from November 18, 2004, which gives additional details. Because the worm doesn't attack anything specific to the architecture of the server, any platform running poorly constructed PHP code is at risk. The worm uses Google to search for infectable sites to attack, making it more efficient that brute force scanning. A decent analysis (in French) is from the K-otik website. Multiple variants have been found, all based on the same theme: Santy.A,  Santy.D, Santy.F (all from Trend Micro), Perl.Santy.B and Perl.Santy.C (both from Symantec). Additional comment from the F-Secure blog. A set of Bleeding Snort sigs for Santy have been made, as well. If you write PHP code, you should look at these resources for writing secure PHP code: Secure Programming in PHP, by Thomas Oertli, Robert Mandel's quick note on a web developer list, Ten Security Checks for PHP by Clancy Malcolm, and Writing Secure PHP Code from solidox. Again, while this isn't terribly sophisticated, it shows how a seemingly benign and "unwormable" vulnerability can be leveraged with the right mindset.
A site that is defaced by one of the later variants of Santy looks like the following:

Secondly, it appears that the Cabir worm's source code is making the rounds. This is based on the number of variants that have recently appeared and the improvements made to the code. Cabir is a worm that attacks cell phones (see this quick set of links from the F-Secure AV blog). See the following stories for more information: Mobile Phone Virus Augurs Growing Threat, by Jay Lyman, TechNewsWorld and Phone Worm Source Code Out, More Threats Expected, by Gregg Keizer, CRN. A worm like Cabir is interesting not only for the target platform and the method by which it spreads, but more specifically for the different mathematics involved in it's spread. Because the worm operates over Bluetooth, which is a short range ad-hoc networking technology, you have to be in close physical proximity to someone to get the worm. This looks more like epidemic spreading in physical, complex networks. Interesting stuff indeed, I hope to write more about this soon (the modeling and mathematics of worm outbreaks).

Update
There are some tips on getting rid of Santy on WordPress blogs on Careless Thought. Useful info to have.