Santy is a computer worm created in Perl. It uses a vulnerability in the popular phpBB discussion forum software to spread and uses Google Search to find vulnerable servers.
When executed, the worm uses the Google search engine to look for hosts that have phpBB software in use by requesting searches of URLs that contain "viewtopic.php". In order to get different results with different searches, the worm uses a random string in the search as well.
After finding what it wants, the worm parses the resulting page and attempts to exploit a vulnerability in the software. This vulnerability, known as Highlight Vulnerability, can be used to execute arbitary code on the server running vulnerable version of phpBB. After exploiting the vulnerability, the worm then transfer itself to the host in several 20-bytes chunks. After the transfer is completed, the worm will repeat the process.
Santy contains also a generation counter that is increased every time the worm is executed,. If the number is higher than 3, it will execute its payload that attempts to replace all files with the .htm, .php, .asp, .shtm, .jsp and .phtm extensions, with an HTML page that reads:
This site is defaced!!!
NeverEverNoSanity WebWorm generation X
Within 24 hours of its release, Santy attacked about 30,000 to 40,000 websites, holding a record of spreading worldwide within three hours. Google has started filtering requests made by the worm at December 22nd, 2004, in order to stop the worm.
