Welcome to WebmasterWorld Guest from 54.227.101.214

Forum Moderators: bill

Message Too Old, No Replies

MySQL 'Bot' Attacks Windows Systems

The bot takes advantage of the publicly released "MySQL UDF Dynamic Library

     

pendanticist

11:13 pm on Jan 27, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



[eweek.com...]

Malicious hackers have launched a zero-day bot attack against default Windows installations of the MySQL database engine, infecting vulnerable systems at the rate of 100 per minute, security experts warned on Thursday.

pendanticist

6:17 pm on Jan 28, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



[boostmarketing.com...] has more to say on the issue:

The MySpooler worm has already infected thousands of machines with many more at risk. It infects by taking advantage of weak password controlled systems and then uses a known exploit to gain entry to install a backdoor program called a "Wootbot". Once this is done the system logs into a hackers IRC channel and hunts out other servers to infect.

Although mySQL is popular on Unix machines, only mySQL 4.0.21 for Windows is vulnerable to this attack. The SANS institute recommends blocking port 3306 and ensuring root passwords are secure enough. So "password" as a password simply won't do.

Sanenet

6:22 pm on Jan 28, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Call me an old fuddy duddy - but anybody putting "password" as the password deserves to have some 14 year old rummaging around in their system.

Birdman

6:41 pm on Jan 28, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I believe one of the probs is that when you install MySql, the "root" username is already set up with a default password of "admin". They then stress to you to change it but I'm sure many forget to.

Someone please correct me if I'm wrong :)

pendanticist

8:21 pm on Jan 30, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I can't speak to that, Birdman. But, it appears to be over.

[earthtimes.org...]

'MySQL bot' database worm is halted.

 

Featured Threads

Hot Threads This Week

Hot Threads This Month