Santy is a
computer worm
A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it. It wil ...
created in
Perl
Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages. "Perl" refers to Perl 5, but from 2000 to 2019 it also referred to its redesigned "sister language", Perl 6, before the latter's name was offici ...
to exploit a vulnerability in
phpBB
phpBB is an Internet forum package written in the PHP scripting language. The name "phpBB" is an abbreviation of ''PHP Bulletin Board''. Available under the GNU General Public License, phpBB is free and open-source.
Features of phpBB include s ...
software which used
Google
Google LLC () is an American multinational technology company focusing on search engine technology, online advertising, cloud computing, computer software, quantum computing, e-commerce, artificial intelligence, and consumer electronics. ...
to spread across the
Internet
The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...
.
Overview
Within 24 hours of its release on 20 December 2004, about 30,000 to 40,000
website
A website (also written as a web site) is a collection of web pages and related content that is identified by a common domain name and published on at least one web server. Examples of notable websites are Google Search, Google, Facebook, Amaz ...
s were attacked by Santy. The worm holds a record of spreading worldwide within three hours of its release. It caused writable files (of formats such as .php and .html) on the infected servers to display the message "This site is defaced!!! This site is defaced!!! NeverEverNoSanity WebWorm generation X", where X is a number representing the generation of the worm.
There have been variants of the worm, some that use alternative search engines after Google blocked queries from the Santy worm, and an anti-Santy
anti-worm
A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it. It wil ...
that attempts to patch vulnerable installations.
The phpBB Group had released a patch for the vulnerability a month before the attacks, in phpBB 2.0.11.
References
{{Reflist
External links
BBC news reportThe patch from phpBBKaspersky Lab page on SantyGoogle search for Santy infected sites
Computer worms
Hacking in the 2000s