Malicious hackers have launched a zero-day bot attack against default Windows installations of the MySQL database engine, infecting vulnerable systems at the rate of 100 per minute, security experts warned on Thursday.
The MySpooler worm has already infected thousands of machines with many more at risk. It infects by taking advantage of weak password controlled systems and then uses a known exploit to gain entry to install a backdoor program called a "Wootbot". Once this is done the system logs into a hackers IRC channel and hunts out other servers to infect.
Although mySQL is popular on Unix machines, only mySQL 4.0.21 for Windows is vulnerable to this attack. The SANS institute recommends blocking port 3306 and ensuring root passwords are secure enough. So "password" as a password simply won't do.
6:22 pm on Jan 28, 2005 (gmt 0)
Call me an old fuddy duddy - but anybody putting "password" as the password deserves to have some 14 year old rummaging around in their system.
6:41 pm on Jan 28, 2005 (gmt 0)
I believe one of the probs is that when you install MySql, the "root" username is already set up with a default password of "admin". They then stress to you to change it but I'm sure many forget to.
Someone please correct me if I'm wrong :)
8:21 pm on Jan 30, 2005 (gmt 0)
I can't speak to that, Birdman. But, it appears to be over.