MySQL 'Bot' Attacks Windows Systems

The bot takes advantage of the publicly released "MySQL UDF Dynamic Library

[pendanticist]

[eweek.com...]

Malicious hackers have launched a zero-day bot attack against default Windows installations of the MySQL database engine, infecting vulnerable systems at the rate of 100 per minute, security experts warned on Thursday.

[pendanticist]

[boostmarketing.com...] has more to say on the issue:

The MySpooler worm has already infected thousands of machines with many more at risk. It infects by taking advantage of weak password controlled systems and then uses a known exploit to gain entry to install a backdoor program called a "Wootbot". Once this is done the system logs into a hackers IRC channel and hunts out other servers to infect.

Although mySQL is popular on Unix machines, only mySQL 4.0.21 for Windows is vulnerable to this attack. The SANS institute recommends blocking port 3306 and ensuring root passwords are secure enough. So "password" as a password simply won't do.

[Sanenet]

Call me an old fuddy duddy - but anybody putting "password" as the password deserves to have some 14 year old rummaging around in their system.

[Birdman]

I believe one of the probs is that when you install MySql, the "root" username is already set up with a default password of "admin". They then stress to you to change it but I'm sure many forget to.

Someone please correct me if I'm wrong :)

[pendanticist]

I can't speak to that, Birdman. But, it appears to be over.

[earthtimes.org...]

'MySQL bot' database worm is halted.