santy worm and the word rush

magnum · Client Joined: Jun 23, 2006 Posts: 83

i had a person trying to register on my page and sentinel kept saying it was a santy worm attack now after reading further i found the the word rush in his name was setting it off. now i turned santy worm off in sentinel and he was able to register now . now my question is if i turn the santy worm back on in sentinel will he be blocked from loging on ? or should i leave it off? is the page at risk if its left off? thank you

montego · Posted: Thu Sep 28, 2006 5:55 am

When those attacks were being made, people were trying to stop it with .htaccess directives. Several folks posted these for stop Santy and possibly other attacks:

Code:

RewriteCond %{HTTP_USER_AGENT} ^LWP [NC,OR]
RewriteCond %{REQUEST_URI} ^visualcoders [NC,OR]
RewriteCond %{QUERY_STRING} rush=([^&]+) [NC,OR]
RewriteCond %{REQUEST_URI} ^envidiosos [NC,OR]
RewriteCond %{REQUEST_URI} ^civa [NC,OR]
#variant-6 redirect all inner http:// request
RewriteCond %{QUERY_STRING} ^(.*)http://(.*)$ [NC,OR]
#variant-7 redirect all inner http request regardless if encoded
RewriteCond %{QUERY_STRING} ^(.*)http%3A%2F%2F(.*)$ [NC,OR]
#Variant-X
RewriteCond %{REQUEST_URI} ^(.*)cgi-bin(.*) [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)wget(.*)$ [NC,OR]
RewriteRule ^.*$ http://127.0.0.1 [R,L]

This is probably overkill. It is also possible that the whole issue has been resolved already with phpBB, but not sure. You can see the "rush=" line?

technocrat · Posted: Thu Sep 28, 2006 9:14 am

The sanity attack is pretty much old news. There really isnt a reason to continue to block against. Even more so if you have been keeping up on your forum patches.

magnum · Client Joined: Jun 23, 2006 Posts: 83

thanks very much Smile

montego · Posted: Thu Sep 28, 2006 8:05 pm

technocrat, thanks!

Doulos · Involved Joined: Jun 06, 2005 Posts: 454

I am getting the same issue with the name Soul_Crusher.

This user keeps getting this message when he tries to log in:

Quote:

Possible Santy Worm Attack!

The weird thing is if after getting the above warning, he just types in our URL, it goes to our home page and he is logged in.

Soul_Crusher is not in my htaccess file, the only instance that is remotely similar is one of "Conecrusher"

Turned off Santy Worm protection.

jakec · Posted: Sun Apr 13, 2008 4:42 am

What settings did you have for the blocker? It may not have been set to permanently block.

Anyway by the sounds of it you should not be at risk anymore if you disable the blocker, if you are running the latest patches etc.

Doulos · Involved Joined: Jun 06, 2005 Posts: 454

I don't even know if there are settings I can change. I just had the Santy Worm Protection set to ON, in the NS admin main page.