Worm Hits Windows Machines Running MySQL

UnderAttack writes "A report on the Australian whirlpool forum suggest that a worm is currently taking out MySQL servers running on Windows. We have seen this happen with MSSQL before (not just 'Slammer', but also SQLSnake that used SA accounts without password). The SANS Internet Storm Center suggests that a rise in port 3306 scans can be attributed to the new worm, and is asking for observations to help figure this out. It appears the worm creates a file called 'spoolcll.exe'."

Comments

Frist Psot

[Anonymous Coward]

Can I make it? Is dream. ^^;;

Windows

[CmdrGravy]

Who'd use MySQL on Windows though ?

Re:Windows

[TedCheshireAcad]

Don't laugh - it happens. MSSQL is 'spensive, and for an all-windows environment that needs a database - MySQL wins the prize.

/took your comment too seriously

Re:Windows

[DanUK]

lol @ MySQL on doze box

Re:Windows

[macaulay805]

Admins in an environment that denies them to use something else.

Re:Windows

[datadriven]

Mostly web developers I think. I used to run the windows version of mysql before I moved my desktops to slackware.

Re:Windows

[greechneb]

People who use windows for other things, and don't want to pay for the MSSQL license. You'd be suprised, there are several people I know who use this, just because they are lazy and cheap.

Re:Windows

[Directrix1]

Only because people don't know about Firebird.

Re:Windows

[UnderAttack]

Well, Apache, PHP and MySQL run just fine in Windows. Many people run Linux on servers, but Winows on Developer desktops (which then have Apache, php and mysql installed).

Re:Windows

[gmuslera]

I'll bet that the worm takes advantage of default installation of MySQL made by PHPTriad or another "easy" way to install under windows mysql along with i.e. php and apache for this case

In linux by default in a lot of distributions being able to connect from network is disabled in mysql, or sets root password as php password, so the risk of that kind of worm (well, for systems that don't have even a basic firewall configured) is pretty low.

Re:Windows

[edremy]

Us. I just inherited our electronic portfolio system, which runs Apache/Tomcat/MySQL on Windows2000. We're mostly a Windows shop, and it runs fine. (Well, sorta fine, but I think that's mostly some problems with the portfolio, not A/T/M.)

Re:Windows

[_xeno_]

Exactly. There are something like seven developer systems running Windows that have MySQL and a web server on them for webapp development in the section I work for. Then, later, the webapp gets uploaded to a Solaris machine where the users actually use it.

I also have MySQL on my home Windows machine, since that's what my hosting provider offers. So I do some basic testing on Apache on Windows with MySQL as the database backend.

Re:Windows

[weopenlatest]

I use mysql at the web shop I work for. The reason is that we're in the process of moving a legacy ASP application to LAMP, and running both PHP and ASP on the same box was SUPPOSED to be a timesaver by smoothing over the transition. I was against this idea from the beginning, arguing that mysql and php on windows were a underdeveloped compared to the linux/unix versions. Now I have a nice 'I told you so' that the managers can understand.

Re:Windows

[the_mad_poster]

Last time I looked at firebird I seem to recall having an issue with it not recognizing case, which wasn't a good thing.

Besides, MSSQL is fine if you have the money, and now that PostgreSQL is (finally) available as a native app on Windows, there's no reason to run MySQL anymore. I'm sure the MySQL fanboys will label that a troll, but unless all you need to do with your database is run a lot of SELECTs from your blog, MySQL is not a very good solution.

Re:Windows

[pr0c]

and now postgres

Re:Windows

[Kick the Donkey]

PHP: True cross-platform programming... ;)

Re:Windows

[nurb432]

Or the ones that dont know the native PostgreSQL for win32 is now out..

Re:Windows

[Malc]

There's always PostgreSQL.

/continuing being too serious ;)

Re:Windows

[Anonymous Coward]

What does a web browser have to do with anything?

Re:Windows

[Tony Hoyle]

90% of tasks can be handled by the free MSDE install.. there's a 2GB limit, but a lot of tasks simply don't need that kind of size.

MySql is expensive too (300 per client, unless you want to GPL all your software).

Re:Windows

[Short Circuit]

Er...have you read any of the other posts? Chances are, the worm takes advantage of a default configuration. (i.e. "password" as the password, network access enabled, etc.) Any decent admin would at least secure the installation.

And in the case it takes advantage of something like a buffer overflow, then so what? IIS has had a long, fruitful history of exploits. And it's been considered as "fully developed" for years. And you're going to use a single example as an I Told You So?!

Re:Windows

[daBass]

Who'd use MySQL at all when there is a _really_ free alternative (BSD license) called Postgresql.

Now that it runs natively on Windows too, there is no reason to use MySQL anywhere anymore.

MySQL, you are the weakest referential integrity constraint, goodbye.

Re:Windows

[ultranova]

In linux by default in a lot of distributions being able to connect from network is disabled in mysql, or sets root password as php password,

How does the installer do this, considering that root password is stored in hashed format, and thus should be theoretically unviewable ? Does the installer brute-force it, or does MySQL accept passwords in their hashed form, or does the installer simply ask the root password and then verify it ?

Re:Windows

[daeley]

Only because people don't know about Firebird.

Web browser, right? Wonder what ever happened to them... ;)

Re:Windows

[malcomvetter]

Cheshire's right ... I personally use it in a MS environment where I just needed a DB & perl for a small home grown app. I, however, run it without allowing connections from anywhere but localhost.

Re:Windows

[Anonymous Coward]

>Who'd use MySQL on Windows though ?

As per ISC (SANS) thousands of machines have it.

"A "bot", exploiting vulnerable MySQL installs on Windows systems, has been spotted. It infected a few thousand systems so far."

Re:Windows

[einhverfr]

Only because people don't know about Firebird.

Or PostgreSQL.

Thinking of it, it would be possible to write a virus that would spread through PostgreSQL systems that were improperly secured (set to Trust authentication on network ports). It could then create a stored procedure using an untrusted language like plpythonu or plerlu if these are installed and create something that scans the network looking for others to infect.

Unfortunately no rdbms is likely to be fully immune except maybe Oracle and only because they are such a PITA to administer that you hope your admin has a clue.

Re:Windows

[einhverfr]

Last time I looked at firebird I seem to recall having an issue with it not recognizing case, which wasn't a good thing.

As per SQL spec (relation and attribute names only, of course). Data is case sensitive by default.

Of course, most other databases default all case to lower, while Firebird/Interbase defaults all case to upper, so this does create a portability issue by different readings of the spec.

Actually, MySQL's behavior is the one which is broken.

Re:Windows

[fyrie]

It's not too bad price wise all things considered. I think a CPU license is around 4k. However, the Desktop version is free and allows 5 concurrent connections, which are enough connections for a small office. I've heard of people running web apps that support 200 simultaneous users with the free MSDE, but the app was coded with that in mind.

Re:Windows

[Anonymous Coward]

I thought they changed the name to Firefox.

Re:Windows

[the_mad_poster]

Data is case sensitive by default.

No, that's what I'm saying. I could swear that on the Windows version the data was case insensitive and that was screwing things up. Or maybe it was Linux.... I could swear the reason I dismissed it was over that... maybe I'm just crazy.

It's not just MySQL's behavior that's broken, their whole development path is.

Re:Windows

[weopenlatest]

Sure this bug alone isn't that big of an 'I told you so,' but it's an example of how products like mysql are often ported to Windows poorly. I argued for moving to a LAMP system, but I was told that mysql is mysql, so forget about it. This is an example of how mysql is not always mysql, and why your rolling the dice with mysql on windows (or anything on windows, for that matter). Oh, and by the way, I didn't really read much of the other posts, and I didn't realize that this only effects default passwords. I'm not using the default, so I guess this bug doesn't even really affect me.

Re:Windows

[cbiltcliffe]

MySql is expensive too (300 per client, unless you want to GPL all your software).

No, $300 per server, and you don't have to GPL anything unless you redistribute it with the freely downloaded MySQL.

Re:Windows

[Anonymous Coward]

Another dedicated windows head who has MySQL.

I don't develop for it myself. The issue is that there are alot of very good FOSS PHP applications that are tightly wedded to MySQL. So rather than rewrite all the db access code in them to use something more solid, I just bit the bullet and setup MySQL. Time is money after all.

In a perfect world, those php apps would abstract DB access so one could switch to a more robust platform. Some even do, but even then the MySQL option is oftentimes the only one tested as well as the only with a sql install script.

Hopefully one day the devs will see the light and realize that PHP!=MySQL.

Re:Windows

[LetterJ]

I rewrote PHPTriad, securing the default password for root and did so 3 years ago. The new product is Sokkit. However, Sourceforge won't let me take PHPTriad down, point to the new commercial version or in any way indicate the project has been shut down.

The only reason I left it alone in the old PHPTriad package was that was how MySQL themselves ship the setup. The official MYSQL binaries have (unless it's changed very recently) *no* password on the root account unless you deliberately go and change it.

Even today, I get constant complaints because I secure the root account, even though I ask them to supply the password.

Re:Windows

[outZider]

Because PostgreSQL doesn't have as large of a community, can be a pain in the ass to administer, and doesn't have the same cross platform toolset as MySQL has accumulated over the years. Technically, PostgreSQL is superior, but in practice, most won't care or know the difference.

Re:Windows

[forrestt]

Or maybe it was Linux.... I could swear the reason I dismissed it was over that... maybe I'm just crazy.

This is from MySQL 3.23.58 on Linux

mysql> select firstName from person where firstName = "Forrest";
+-----------+
| firstName |
+-----------+
| Forrest |
+-----------+
1 row in set (0.00 sec)

mysql> select firstName from person where firstName = "forrest";
+-----------+
| firstName |
+-----------+
| Forrest |
+-----------+
1 row in set (0.00 sec)

So, yes it is case INsensitive. (But I can't really do anything to prove your sanity) :)

Re:Windows

[ajs318]

Linux passwords are scrambled, but the root user can read the scrambled password file. The first part of the scrambled password ($1$, eight letters/digits, $) is the "salt". The same plaintext password and the same salt will always produce the same scrambled password. The password scrambling algorithm is a standard C library function, so almost every programme uses it, not just the login validator.

Upshot: if you copy a scrambled password from one user to another, or out of /etc/shadow into a .htpasswd {apache password file; used to password-protect directories} or something similar, it'll Just Work.

MySQL actually uses a different password hashing algorithm, unless you tweaked the source, but I think the parent is talking about PHPMyAdmin. This creates a standard .htpasswd file when it is installed, and it uses root's UNIX password. Note you still have to supply PHPMyAdmin with a MySQL username and password. By default, MySQL has a user called "root" with no password who is only allowed to login locally. This is considered secure enough for most applications.

NB: it's generally a very bad idea to use the same password for login and database. One dodgy web hosting company I have experienced actually did this. The MySQL username and password have to be in your user directory somewhere, in plaintext, and they have to be world-readable so the Apache daemon can see them. Upshot: any user can see any other user's database username and password. {This is why the root/no password combination isn't so insecure as it looks.} Ordinarily, the PHP {or Perl or Python} interpreter gets them first, and the user only ever sees the output from the interpreter; but you can pay for an account with the same company, determine the directory structure reasonably easily, and use a simple PHP, Perl, Python or Bash script to traverse other users' directories looking for passwords. If the database username and password is the same as the UNIX password then you can have much fun, since these passwords are also good for FTP, POP3 and SSH.

Re:Windows

[MrNonchalant]

Well, even if you used an installer program (as I did) that is no excuse for not securing it. I'll be darned if I leave the root password as a default to anything. Not to mention not rename it to something besides root. Not to mention let anyone access it besides localhost. Not to mention not have all ports but those necessary firewalled.

Still, maybe a good idea for those install apps would be an easy GUI window prompting you to change those values and providing input fields to do so. I mean, it isn't easy to correctly edit the user table of the mysql database through PHPMyAdmin without consulting documentation. I trashed a few installs before I learned how. Maybe that could be another thing to work on, a better user interface for editing those values under PHPMyAdmin. It currently warns you about a blank root password, but it is slightly above the level of a novice to figure out how to fix that.

Re:Windows

[randallpowell]

Someone that has a PC with a Windows license and nees an inexpensive SQL database.

Re:Windows

[Anonymous Coward]

You run Apache on a Windows box? I guess that would be okay in a trusted environment. But it is not recommended to run Apache on Win32 systems in a hostile environment.

Re:Windows

[Anonymous Coward]

Sure.

Until you use a library that your host doesn't have loaded.

Re:Windows

[sootman]

Another fiendly package that should probably be checked out is XAMPP.

And I love the way these threads always have a bunch of comments that say "Ooh, you should close that port on your firewall!" Usually, all ports should be closed, and you open the ones you need--not open by default and closed as vulns are announced. Remember kids: a firewall with all ports open IS NOT A FIREWALL.

Re:Windows

[Neil Blender]

you have to use 'binary' for case sensitive searches.

mysql> create table name ( name char(10) );
Query OK, 0 rows affected (0.05 sec)

mysql> insert into name ( name ) values ('Forrest');
Query OK, 1 row affected (0.00 sec)

mysql> select * from name where binary name = 'forrest';
Empty set (0.01 sec)

mysql> select * from name where binary name = 'Forrest';
+---------+
| name |
+---------+
| Forrest |
+---------+

Re:Windows

[m50d]

The hash used for login passwords is a standard library function, so I'd imagine MySQL simply uses the same hashing mechanism.

Re:Windows

[Anonymous Coward]

Thanks for the tip.

Forrest

Re:Windows

[daBass]

How do you mean that it is hard to administer? Install, run, done. Scaling up to large databases is easy too. Granted, the default parameters are a bit conservative, but they are easy to change.

The comunity is large too and there are many books on the subject.

And as for tools, pgAdmin is all I need, and runs on various Unixes and Windows. Probably OS X as well.

If people don't care, then why should they use MySQL and not Postgres? By the time they start to care, they might apreciate, say, online backups without having to pay for 3rd party tools...

Re:Windows

[Anonymous Coward]

Define "redistribute" please.

Re:Windows

[PepeGSay]

If you use this as an 'I told you so', and you administer the box, then they should fire you. This problem only affects poorly administered mySQL installations.

Re:Windows

[Anonymous Coward]

Electronic portfolio system that uses MySQL? I hope you don't do a lot of concurrent updates. :)

Re:Windows

[hughperkins]

Actually, if your program requires the user to install MySQL, that counts as "redistributing" MySQL, according to their FAQ.

Re:Windows

[Directrix1]

Firebird is case sensitive on any platform.

Re:Windows

[Anonymous Coward]

in plaintext, and they have to be world-readable so the Apache daemon can see them

Can't you just configure to only allow the user that running Apache (or the group) to be able to read the file?

Re:Windows

[Zontar The Mindless]

Well, Apache, PHP and MySQL run just fine in Windows.

Not to mention Perl, Java, Python, and Ruby.

Re:Windows

[ajs318]

Yes, you can; but that won't make any difference. Apache runs as its own non-privileged user {often "nobody", sometimes "www-data" or "apache"} and has a group to itself. Any processes it spawns {to execute scripts, for instance} also run as the Apache user {not the owner of the script} -- unless SUID is in operation, and that's a huge security risk. You don't know who the hell is connecting to your box via HTTP -- anyone potentially could set a script running with root privileges {therefore able to tamper with any logfiles}, without entering any kind of username or password.

On most Unixes, only root can chown files. You ought to be able to chown your own files, but it's strictly a one-way ticket. {Why?} And let's not forget the opportunity to frame a colleague {chown unluckyeddy:itdept 10yr_old_amy.jpg win_xp_src.tar.gz star_wars_episode_3.dvd.iso && shred -n1 ~/.bash_history}. Best not to let every Caz, Shaz and Daz use it.

So even if only the Apache user was allowed to read your scripts, you would be no more secure than if they were world-readable. Password-hunting scripts would still be running in the name of Apache, therefore allowed to access others' passwords.

Try it if you don't believe me; but if you do it on a real ISP's server, watch you don't get caught, because it is almost certain to be a breach of AUP. Open a sacrificial hosting account and consider it money spent in the name of research.

Re:Windows

[lphuberdeau]

Actually, using the MySQL server is free unless you make an installer which installs your application and the database server. If you just tell you client to install a MySQL server, there is no problem.

It becomes more complicated if you use the MySQL libraries. If your application is compiled with them, it either has to be liscenced or GPL. If you can manage not to package and distribute the GPL applications and libraries, there is no problem.

Re:Windows

[cbiltcliffe]

Not according to the GPL, which is what they release their software under. Hence, I don't really give a damn what their FAQ says.

I as an individual or an organization is allowed to use personally or internally, any GPL code, in combination with any proprietary code, as long as said proprietary code is not distributed beyond myself or the organization with the GPL code attached.
That's why nVidia can get away with binary drivers that link into the fully GPL Linux kernel. If I wanted to sell a computer with Linux on it, I couldn't preinstall the nVidia drivers for the customer, as that would be a violation of the GPL. There's nothing wrong with installing it for myself, or the customer installing it for themselves, because neither of those cases involve redistribution of GPL code.

How Appropriate

[Anonymous Coward]

It's appropriate that the talk page for this was 404'ing for a while.

That's why...

[Anonymous Coward]

Most serious people deploy PostgreSQL on Windows, if they're deploying anything on it at all.

Solid reliability, transaction support, and a good security track record. Probably the best thing short of switching to an AS/400.

Re:That's why...

[greechneb]

Any stats to back that up?

Re:That's why...

[Anonymous Coward]

Every app that I've tested or checked out that used a non-MS sql database has used MySQL and I've checked out a lot of them. I have yet to see a windows app use postgre.

Re:That's why...

[Squeebee]

And if they have a blank password and no firewall are they any more secure than a MySQL user?

Re:That's why...

[jaseuk]

I've used postgresql on windows.

If you've been given a MSSQL based ASP app, its usually straightforward to port to postgres, as they have a similar feature set for most typical web bsaed apps.

Jason.

Re:That's why...

[jskline]

Why on God's green earth are you using such an unsecurable platform as Windows? You sould be at least on a Linux box, or BSD, Solaris... something other than Microsoft.

Re:That's why...

[WoodstockJeff]

And if they have a blank password and no firewall are they any more secure than a MySQL user?

Vastly. By default, Postgres won't do anything. You need to actively administer it to accept even local connections, let alone activate TCP/IP.

Re:That's why...

[Flashpot]

with Windows as its underpinning, it's still FAR SHORT of going to AS/400.

Re:That's why...

[Anonymous Coward]

Read the article. It's not exploting a security hole in MySQL. It's exploiting MySQL installations that:

a) Are not firewalled to the world (who'd make a DB accessible directly to the Internet?)

b) Allow root/admin connections from the outside.

c) Have weak root/admin passwords.

You can chalk this one up to careless admins - something I'm sure PostgreSQL is not immune to either.

Re:That's why...

[EsbenMoseHansen]

If I recall correctly, this is the same as MySQL, at least for TCP/IP connections --- you have to explicitly grant access for anything to connect.

Locally, I can't remember how the root user is created. But I remember the repeated "Please set your MySQL root password now" after emerging :)

Re:That's why...

[Motormouz]

How about applications that wil run only on MS SQL?

I've seen many times that some department has purchased some superduper application that requires MS SQL and the IS department will just have to install/support it.

Re:That's why...

[Anonymous Coward]

Postgres, not Postgre.

Re:That's why...

[neilb78]

The parent is obviously flamebait. Why would you make such a genernal statement without taking anything other than the OS into consideration?

"Most serious people" don't hire idiots like you.

Re:That's why...

[Phillup]

But... But... If you don't use a Windows box you won't get frequent security updates!

;-)

Re:That's why...

[iBod]

>>Probably the best thing short of switching to an AS/400.

Oh! Why stop there.

If you're a really 'serious person' then I suggest you'll need a z/Series mainframe (running z/OS) at least (but then you'd probably want to run DB2 intead of Postgre).

Talk about comparing apples with oranges!

Re:That's why...

[Dysan2k]

You can chalk this one up to careless admins - something I'm sure PostgreSQL is not immune to either.

Nothing is. Postgres folk can cry all they want, and so can MySQL, mSQL, Oracle, Informix, Sybase, Firebird, etc. It makes no difference. If you have no password, you can get into it.

Amazes me sometimes the rabidness of the db crowd. It's a database, folks. It stores data. It's not an AI.

Re:That's why...

[djwavelength]

Maybe the better question would be "Why would you call yourself a system administrator and not follow basic security practices, like setting up a firewall or changing default passwords?"

Doesnt matter what platform you're on: if you allow root to connect over ssh and make the password "root", you're in trouble.

Re:That's why...

[soulhuntre]

Why on God's green earth are you using such an unsecurable platform as Windows?

That there is nothing specific to windows about this attack means nothing of course.

Re:That's why...

[LurkerXXX]

You find that strange? There are tons of apps out there written only for MySQL as well. If you want to use somthing that keeps your data more intact (like Postrgres) you are screwed because you will just have to install/support MySQL if you need that app.

It would be nice if application developers made their apps database agnostic, but it rarely seems to happen.

Re:That's why...

[Kn0xy]

"Most serious people deploy PostgreSQL on Windows, if they're deploying anything on it at all."

You forgot to add in a field for 'snob' and 'over_opinionated' to that judgement... I mean statement. Most 'Serious' people do not just go with 'PostgreSQL', there are 'Serious' people who run msSQL, Oracle, MySQL, and etc. And each are most likely also say:

"Solid reliability, transaction support, and a good security track record."

Re:That's why...

[jadavis]

Although I am a postgresql advocate, I want to caution users that win32 is very different from UNIX. PostgreSQL doesn't have a long track record on win32, merely a lengthy beta test. So, it's a great database, but stop short of assuming that PostgreSQL's legendary reliability was translated perfectly to win32. After a few more months of real-world testing, you can be much more sure.

Re:That's why...

[CmdrGravy]

It's tough to think of something insightful to say on a topic AND get first post, under the circumstances a 50% success rate isn't bad.

My point, such as it was, is why run MySQL on Windows when you can equally well run it on Linux ?

Re:That's why...

[soulhuntre]

You can chalk this one up to careless admins

Absolutely. And that is where the blame belongs - with a small nod that MySQL should not have remote admin on by default.

Of course, if this had been a MS product then it would be all MS's fault and the admins would not be to blame... :)

Re:That's why...

[jadavis]

It would be nice if application developers made their apps database agnostic, but it rarely seems to happen.

That might be fine if your application uses only the features supported by all databases.

If you want more, you end up with a huge mess of bug-prone client side database operations. To ensure consistency of the data you have to do a HUGE amount of client side work because some databases don't support check constraints or constraint triggers. And all the other features it's the same deal: a huge amount of client-side code to accomplish something already available in most databases.

So why would the application programmer spend all of their time maintaining all those database layers?

It works for some applications, but for others it can be an exercise in futility.

Re:That's why...

[notque]

Most serious people deploy PostgreSQL on Windows, if they're deploying anything on it at all.

Solid reliability, transaction support, and a good security track record. Probably the best thing short of switching to an AS/400.

You are a chewley's gum representitive? and you're here stiring up all this commontion for what? To sell more gum?

Get outta here.

Re:That's why...

[uberdave]

Gee, Spoolcll.exe and app_result.dll look awfully windows specific to me. Of course, I Read The Fancy Article.

Re:That's why...

[Anonymous Coward]

Also, MySQL doesn't have the same concept of OS user equivalence that PostgreSQL does. So its actually a lot easier to make PostgreSQL less secure.

Re:That's why...

[conteXXt]

Do what I did.

Quit. (no seriously)

SQL server and Access are evil

(and to a lesser degree, Sybase but only by prior association)

Re:That's why...

[boneshintai]

So you'd want to replace the line that reads

local all all ident sameuser

in pg_hba.conf with something like

local all all md5

The concept you complain about is a default, not a permanent and necessary feature. Change it as suits you.

Re:That's why...

[Anonymous Coward]

For a start, PostgreSQL won't run under the root account...

Re:That's why...

[Anonymous Coward]

PostgreSQL won't run under the root account, specifically to avoid being exploited in this way.

PostgreSQL 1, MySQL 0.

Re:That's why...

[dadragon]

You can chalk this one up to careless admins - something I'm sure PostgreSQL is not immune to either.

You're right, nothing's immune. However, some things are better than others. PostgreSQL won't run as root by default, or an account with admin privs on a windows box. It also doesn't accept network connections by default.

On the other hand, its default local authentication method is "trust", which means it believes you are who you say you are, regardless of password. I believe the rationale behind this is that development boxes will be single user, on a trusted setup. You can easily change it to "md5" which is the same one it uses by default over the wire.

Re:That's why...

[Anonymous Coward]

BUt it does not by default. It never was under linux, and my guess is that it was not on windows either.

The root account is created by default for localhost only.

I guess some fellow though it was smart to enable it for % thus they could manage it from every computer of the world. Or maybe they found a trick on a forum and applied it blindly.

It is a matter of culture. Mine is enable only what you know is secure. Maybe thouse thousands had bad teachers, maybe they feel using OSS made them out of reach of any need to think ...

Alban

well :)

[rd4tech]

We have seen this happen with MSSQL before.

it was a news with a slamming facts in it

Re:well :)

[Anonymous Coward]

it was a news with a slamming facts in it

Can someone please explain to me why this was funny? I see the humor of someone now being literate, and unable to use grammar or punctuation, but beyond that I'm lost. Please help me get back on track with understanding this apparently funny remark.

Re:well :)

[Keeper]

The referenced "exploit" in SQL Server was nicknamed slammer.

Re:well :)

[SenFo]

I'm with you. I haven't a clue where the humor is.

Acronym madness clarification.

[sanityspeech]

What is the SANS institute?

The SANS (SysAdmin, Audit, Network, Security) Institute provides information security training and certification. For more information, visit www.sans.org

What's an SA account?

The system administrator (SA) account is similar to the DBO except it is of the entire server. It has the same access and permissions as the DBO on all the databases in the server.

DBO account???

The DBO User Account The database owner (DBO) is the administrator for the database. It has full access to all operations and rights.

SQL Snake is an Internet worm, that scans for open Microsoft SQL 7 (MSSQL) and 2000 servers - which run on TCP Port 1433 by default. The worm attempts to log into the System Administrator (SA) account with no password. If successful, the worm downloads and hides some files and grabs system configuration and account names.

Before the MySQL bashers start, it should be noted that this is not a problem with MySQL.

From the article:

This bot does not use any vulnerability in mysql. The fundamental weakness it uses is a week 'root' account. The following mitigation methods will prevent exploitation:

Strong Password: Select a strong password, in particular for the 'root' account.
Restricted root account: Connections for any account can be limited to certain hosts in MySQL. This is in particular important for 'root'. If possible, 'root' should only be allowed to connect from the local host. MySQL will also allow you to force connections to use mysql's own SSL connection option.
Apply firewall rules: MySQL servers should not be exposed to the "wild outside". Block port 3306 and only allow access from selected hosts that require such access. Again, the use of ssh forwarding or SSL is highly recommended.

Re:Acronym madness clarification.

[Anonymous Coward]

Before the MySQL bashers start, it should be noted that this is not a problem with MySQL.

That's never stopped the Microsoft fanboys from complaining before...

Re:Acronym madness clarification.

[Deviate_X]

Before the MySQL bashers start, it should be noted that this is not a problem with MySQL

This is not a bash but... A server should not (by default at least) allow remote access to administrative or root accounts where no password has been specified.

Re:Acronym madness clarification.

[caino59]

you're not familiar with the default settings, eh?

windows is not an OS for dumb people - it takes a lot of work and effort to secure it...
other OS's are a lot more secure out of the box

unfortunately, it's the morons (glaring generality, yes.) that use windows, and the more informed using the other OS's....

Re:Acronym madness clarification.

[TheSolomon]

;) You might as well go all the way:

What's SQL? 'SQL' stands for "Structured Query Language," which is a database query labguage.

What's TCP? 'TCP' stands for "Transmission Control Protocol," a connection-oriented, reliable delivery byte-stream transport layer communication protocol. TCP is the intermediate layer between the Internet Protocol (IP) below it, and an application above it.

Re:Acronym madness clarification.

[Naikrovek]

It doesn't. You have to configure it to allow non-localhost connections.

Re:Acronym madness clarification.

[DrSkwid]

almost there, try this :

A server should not have root accounts.

there, that's more like it

Re:Acronym madness clarification.

[Anonymous Coward]

Extremely easy to do using ipsec (on Windows XP & 2000), allow me to demonstrate:

ipsec -w REG -p "filter" -r "MySQL" -f *+0:3306:TCP -n BLOCK
ipsec -w REG -p "filter" -x

Bam; all outside connections are now dropped.

Enjoy.

(Note: You might have to use ipseccmd or some other quirky name.)

Re:Acronym madness clarification.

[dreamer-of-rules]

The pretty Windows installer seems to have problems setting the mysql sa password. I've installed it three times on Windows machines; once it left the db with a blank password, once with an unknown password (I had to reset it), and once it worked. I had no problems with my Mac installation.

I'm guessing that the Windows installer has problems with ' and <space> characters, and who knows what else.

Re:Acronym madness clarification.

[Anonymous Coward]

A server should not have root accounts.

there, that's more like it

Um... yeah. That's right. No accont should be able to install software, updates or manage user accounts. The server should come in the door with everything pre-installed and be immutable. If any software needs to be updated/upgraded you just buy a new server or re-image the hard drives from a special boot CD, right?

Dork.

Re:Acronym madness clarification.

[DrSkwid]

I wouldn't flout your ignorance like that, it's not becoming

Re:Acronym madness clarification.

[Deviate_X]

Clearly you have no idea that this flaw has nothing to do with Windows Security. That is another debate.

This is a flaw in Windows version of MySQL. Your comment is entirely beside the point.

Re:Acronym madness clarification.

[Anonymous Coward]

Count me as ignorant too, but can you explain what exactly do you mean by no root account?

I thought the grandparent posed a valid question.

Re:Acronym madness clarification.

[DrSkwid]

super user

all powerfull login account

it's a design fault

Re:Acronym madness clarification.

[Anonymous Coward]

The word you meant was 'flaunt.'

'Flout' means "to show contempt for". 'Flaunt' means "to show off ostentateously". As in you were flaunting your ignorance of the English language as you flouted its rules.

If you're going to be a Grammar Nazi, you should practice more.

Re:Acronym madness clarification.

[strider44]

It means that on most (meaning 'secure') systems it is impossible to log in as root from remote locations. On linux this is default. The point the great*-grandparent made has absolutely nothing to do with installing software on the server.

Re:Acronym madness clarification.

[styxlord]

This may not be the case with the current versions of MySQL but previously the Windows version of MySQL at least did have wide open root with no password by default.

Re:Acronym madness clarification.

[tehdaemon]

It may not be the installer. Windows ME did not like ~ in filenames. You couldn't transfer any file with that in the name over a windows share. You would get a 'file not found' error. Stupid.

Re:Acronym madness clarification.

[DrSkwid]

no it doesn't mean that at all

not just "you can't log in remotely"

but "there is no root account for anyone to log in to, ever!"

Re:Acronym madness clarification.

[DrSkwid]

You are, of course, correct.

Still doesn't negate the argument, I was being an IT nazi though, not grammar.

Re:Acronym madness clarification.

[ArtStone]

or since we're talking about Windows and not 1970's era command line based operating systems, you can find the packet filter options under Settings / Network Settings / [select connnection] / Advanced / Windows Firewall Settings.

People running Windows XP SP 2 have port 3306 blocked by default.

If for some reason you want to expose mySQL to the outside world, click on Add Port and add port 3306. You can then click "change scope" to limit the IP addresses that can access the port.

In addition, you should limit the IP addresses further within the user table in the mysql database so that accounts with update and stronger authority cannot access mySQL unless they are known hosts by IP address (don't relay on domain names which can easily be spoofed in reverse dns).

And put a password on the root account - that's really clearly stated in the installation instructions, but then again who RTFII?

Another precaution - if the only remote access is from known entities (which seems prudent), run mySQL on a non-standard port (not 3306) and configure clients to connect on that port. Not a bad idea for ssh either - or any port that might be the subject of an automated worm attack that is port specific.

Re:Acronym madness clarification.

[Anonymous Coward]

True, however ipsec also has a MMC snap-in. It's just easier for me to use the command line for some reason (I guess it's because I know all the ins and outs of the command line and never bothered to learn the GUI front-end). Regardless, you bring up some good points.

Re:Acronym madness clarification.

[Anonymous Coward]

Bullshit. The post said:

A server should not have root accounts.

It did not say anywhere "with remote access" or "accessible over the network, etc." It said that a server shouldn't have root accounts. I still think the poster who replied has a good point/question. What good is a server without enough rights for SOMEONE to administer it?

Oh.. maybe he meant it should be like Windows95 where EVERYEONE has full access and there is no one account with admin rights? lol

MySQL on Windows (?)

[Anonymous Coward]

According to some of the text, the bot is specific to MySQL running on Windows, and has infected around 8500 systems.

It should be about done. I mean, isn't that about all of them?

Clarity

[pete-classic]

To be clear, this is a Windows MySQL worm.

-Peter

Re:Clarity

[Anonymous Coward]

That doesn't change the fact that there are flaws in MySQL that need to be fixed.

Re:Clarity

[Anonymous Coward]

Regardless of your true intent, your posting is appears to be an attempt to sell the idea that there are inherent flaws in windows. But unfortunately, the reality is that the worm didnt take advantage of a windows specific flaw! Basically the worm author CHOSE to target windows .. not Linux.

But yeah of course you'll get modded up by all the default anti microsoft moderators. Any bashing microsoft is praised here no matter how devious .. forget being logical and truthful.

Re:Clarity

[Fred_A]

Flaws such as letting people install it that are clueless enough to put it on Internet connected machines without setting passwords for administrative accounts ?

That'll be a tough one to patch...

Re:Clarity

[pete-classic]

'Fraid the facts are against you on this one, AC. From the fine article:

This bot does not use any vulnerability in mysql. The fundamental weakness it uses is a week 'root' account.

On the other hand, it does belie the theory that windows just gets attacked because it's popular. (Assuming there are more non-windows deployments of MySQL. I think that's a safe assumption.)

-Peter

Re:Clarity

[Anonymous Coward]

It's a MySQL worm that only targets the windows platform, calling it a "windows" mysql is silly .. if the flaw gets exploited on linux and then it'll be your fault that linux users didnt take precautions to protect their system.

Re:Clarity

[Anonymous Coward]

STFU, bonch.

Re:Clarity

[pete-classic]

Dear fuckhole moderators,

This was like the fourth post in the thread. How is it redundant?

With Lots of Love,
Peter "I wish Technocrat Didn't Suck" Hutnick

Re:Clarity

[picklepuss]

Nice try, but I you only took in a minor part of the equation, and so you fail

While it's true, the worm could probably intrude a *nix mySQL server that was open to the internet with a default password of ''... intrusion is only part of the game plan. The payload is the important part

In this case, I doubt that installing the exe on a *nix box is going to do much good. Even if the writer were to create a *nix specific script for the payload, I'm pretty sure it would be given the mysql uid/gid, and probably wouldn't be able to wreak havoc on a *nix-based system.

Re:Clarity

[Jedi Alec]

is it? if (networking_enabled) { harass_person_installing_until_said_person_sets_a_ bloody_password(); }

Re:Clarity

[Short Circuit]

Not flaws in MySQL, flaws in the administrators. The worm attempts to get into systems by entering the default password.

Re:Clarity

[Anonymous Coward]

I consider it a flaw in mysql. They basically turned a database server into a shell account by allowing:
1. Blobs to be inserted into a table. (No checking)
2. Contents of tables to be written to disk (No checking)
3. Starting (just written from the DB) files to be executed at will.

Now tell me, why is that a needed (and enable by default!) feature of database server?!

Re:Clarity

[Anonymous Coward]

> I consider it a flaw in mysql. They basically
> turned a database server into a shell account by
> allowing:
> 1. Blobs to be inserted into a table. (No checking)

* Assuming you connect with a username, password and hostmask matching what you've allowed to log in.
* Have access to CREATE a table
* Have access to INSERT into said table

> 2. Contents of tables to be written to disk (No checking)

You need the FILE privilege GRANTed to be able to write *anything* to disk, and there are checks so that you cannot overwrite or append to existing files.
It also requires the mysqld process to have write access to the file system (running as root or a a service account of some kind)

> 3. Starting (just written from the DB) files to be executed at will.

For this to work you need to have access to create UDFs and also to execute said UDFs.

Re:Clarity

[Anonymous Coward]

All MySQL's releases are actually compiled statically for *nix systems, if you want a dynamically compiled version you have to do it yourself.

You do need a dynamically compiled MySQL for User Defined Functions to work the way it's used in this worm.

Re:Clarity

[ookaze]

An insightful troll ?

What are you refering to ?
At least there is no flaw in this case.
Worst thing is that by default, MySQL comes with only connections allowed from localhost.
So, MySQL folks took all available steps to secure a first install.
Now, if your MySQL package provider ships with insecure settings, that is not MySQL fault.

slashdot rulez

[Anonymous Coward]

... its always first with 3 week old news. The virus was reported on January 5th.

Re:slashdot rulez

[Anonymous Coward]

So why didn't you propose it as an article then?

Re:slashdot rulez

[Anonymous Coward]

I'm not the OP, but maybe he *did* submit something and the editors didn't post it then. They do have a reputation of rejecting a story, then accepting the same story three weeks later, after all...

Doesn't seem that vital of a worm

[Steepe]

MySQL does not come with windows, you have to download it and install it, and if you are downloading it and installing it then you obviously have a reson to use it, and are more likely to set an actual password.

Re:Doesn't seem that vital of a worm

[I confirm I'm not a]

if you are downloading it and installing it then you obviously have a reson to use it, and are more likely to set an actual password.

I'd like to agree with you - I've installed MySQL (plus Apache and mod_php) on Windows boxes before now, for development (production server is a Solaris box, but my boss - for some bizarre reason - won't fork out for a Sparcstation for me ;) However - many developers I know believe that dev machines don't merit the same kind of hardening as production machines. "Hey! We're behind the firewall, we're safe!" Maybe this'll serve as a wake-up call.

Re:Doesn't seem that vital of a worm

[david duncan scott]

Well, on those grounds MSSQL worms aren't an issue either, because believe me, SQLServer does not come with Windows either. Apparently shelling out good money hasn't stopped people from leaving the SA p/w blank.

Re:Doesn't seem that vital of a worm

[Anonymous Coward]

If you're developing for slowaris, install a linux/BSD distro - duh!

Re:Doesn't seem that vital of a worm

[Zaiff Urgulbunger]

However - many developers I know believe that dev machines don't merit the same kind of hardening as production machines. "Hey! We're behind the firewall, we're safe!"
I'm not justifying what they're doing, but if they're behind a firewall then shouldn't they be safe from this worm? Surely the people getting infected are the people with MySQL ports open directly on the int0rweb *and* no hardening.

Maybe this'll serve as a wake-up call.
True!

Shouldn't be a big deal

[Mad Merlin]

How often does your database have to talk directly to the outside world? The port should be closed to the outside world most of the time.

A hole in a program that communicates to the database and is accessable from the outside world would be a much more serious flaw I would imagine.

Re:Shouldn't be a big deal

[Anonymous Coward]

What good is a database that you can't access from the outside world? At least for me, a database on an isolated system is next to useless. Granted, you can't get into my DB with root from the outside.

Re:Shouldn't be a big deal

[Undertaker43017]

From a security perspective, allowing databases to be directly accessed from the Internet is a very bad idea, root or not. There should always be at least one layer of security (DMZ) between the Internet and database servers.

I hope you don't store CC #'s or any other senstive information in any of your DB's...

Re:Shouldn't be a big deal

[EvilAlien]

Right... and many worms shouldn't be a big deal (eg Slammer) because admins should be patching diligently. Meanwhile, in the real world, humans are lazy and irresponsible.

Re:Shouldn't be a big deal

[Just Some Guy]

The port should be closed to the outside world most of the time.

Yes, but that's only the first line of defense. The application should still be able to protect itself if all other defenses fail.

Re:Shouldn't be a big deal

[jmulvey]

Any hole in a program is a big deal. Consultants come in and out of companies all the time, some running MySQL on Windows. If one of them is infected, your internal network is infected.

Re:Shouldn't be a big deal

[Mad Merlin]

Yes, but that's only the first line of defense. The application should still be able to protect itself if all other defenses fail.

I agree, of course you should always have multiple layers of security, but in this case it would seem that the first line of defense would be the only necessary one, hence the lower severity.

solution

[its_not_a_tumah]

so we've got tsunamis in asia, droughts in africa, worms in australia.... frank: "here, this here wombat 'ill toyk kehr of um"

slashdot's super post editing strikes again!

[Anonymous Coward]

What does a vulnerability in mySQL have to do with MSSQL? Or are you blaming Microsoft for a mySQL worm because it wouldn't be /. any other way?

What?

[Anonymous Coward]

Do you realize how much of a pain it was to get postgres working on Windows until fairly recently?

Re:What?

[einhverfr]

Do you realize how much of a pain it was to get postgres working on Windows until fairly recently?

Not only that but the Cygwin port didn't scale too well. That was one of the real issues why the Windows port was so important even for those of us using Cygwin.

I don't get it

[gowen]

I don't understand the sans report. First it says :

The bot uses the "MySQL UDF Dynamic Library Exploit".

before adding

This bot does not use any vulnerability in mysql.

Come again?

Re:I don't get it

[Anonymous Coward]

It's not a vulnerability, it's a feature.

Oh, wait. Wrong software company.

Re:I don't get it

[Qzukk]

Well, to spread it specifically uses weak default/unset DB admin passwords and MySQL running as a system or admin level task with write access to everything. Once the worm is in your server as the db admin password, it uses the db admin's ability to load a dll into mysql to allow it to perform actions outside of mysql.

See the details on this for information about what exactly is happening. There are plenty of DLLs on windows laying around that do all sorts of stuff, once you define a function call in MySQL to use a dll that allows you to execute whatever you want on the system, you win.

Re:I don't get it

[Whispers_in_the_dark]

I think they're referring to the method of entry -- poorly configured mySQL instances (with open or common root passwords). Once in, the Windows level security takes over and the worm can act pretty freely it seems.

Re:I don't get it

[Zontar The Mindless]

This affects MySQL on Windows only, and does not exploit MySQL so much as it exploits Windows users who don't take basic precautions.

Things to do to keep from getting wormed:

1. Set a strong password for the root account.

2. Don't let root log in from an arbitrary host. Don't let root log in from anywhere but 127.0.0.1/localhost if at all possible.

(1 and 2 should be SOP for any MySQL installation as soon as you've verified that mysqld is actually running.)

3. Run MySQL on a port other than 3306.

4. Switch to something besides Windows.

Re:I don't get it

[prockcore]

Well, to spread it specifically uses weak default/unset DB admin passwords and MySQL running as a system or admin level task with write access to everything.

The default MySQL admin account only allows connections from localhost. So it sounds like it only affects people who purposely created an admin account with a host of '%' and no password.

Re:I don't get it

[secolactico]

I don't understand the sans report. First it says :

The bot uses the "MySQL UDF Dynamic Library Exploit".

UDF stands for "U Dumb Fscker" refering to those admins that don't bother setting up an admin password on their Mysql servers.

Re:I don't get it

[lotrtrotk]

Could you explain why, exactly.. running on something other than 3306 is needed?

The only port I have open is 80. If someone were to gain access to my MySQL server, they'd have to some-how get a server-side script running off my webserver, would they not? I have my root user only accessible through localhost, and 3306 is closed... so I'm sure that I'm ok.

Re:I don't get it

[Anonymous Coward]

The default MySQL admin account only allows connections from localhost. So it sounds like it only affects people who purposely created an admin account with a host of '%' and no password.

4.0 on Windows used to create a passwordless "root@%" account. I'm not sure if this happens in 4.1.

Re:I don't get it

[DrSkwid]

mysql can load arbitrary dlls?

lol that's one of the dumbest features I ever heard!!

Re:I don't get it

[Qzukk]

Dumbest? Thats how you extend mysql. Thats how you extend any serious database (replace dll with so or other dynamic object for the platform of choice). Thats how you can add things like server-side scripting, new datatypes and operations, new functions, and so on. The reason only database administrators are allowed to install such extensions is because it is inherently insecure.

Re:I don't get it

[DrSkwid]

that's right, dumbest

even when you redundantly explain it, it doesn't get any cleverer

arbitrary dlls == dumb

Re:I don't get it

[Qzukk]

Then explain how you intend to provide the same service in a cleverer way? It can't be "dumbest" if there are no better ways to do it.

Re:I don't get it

[DrSkwid]

The key word is "arbitrary". The ability to load winsock.dll into mysql is dumb

You *could* compile against a set of headers to mark the dll as database server safe

You *could* compile against a set of headers to mark the dll as owned by the owner of a particular database

You could cryptographically sign the dlls and only accept signed dlls

"ooh but it's just sooo flexible"

just like activeX email

Re:I don't get it

[cookd]

(Yes, this is on-topic.)

Two guys were hiking in the forest. Suddenly, they realized that they had walked between a mother bear and her cubs. Immediately, one of the guys kicked off his big hiking boots, pulled his running shoes out of his pack, and started lacing them up.

The other guy said, "you can't outrun the bear, even in running shoes!"

The first guy replied, "I don't have to outrun the bear. I just have to outrun you."

Moral: While a dedicated hacker who really wants to get into your particular site won't be stopped by changing ports, that is rare. More commonly, you just have to stop worms and script kiddies, and generally they just portscan for servers with the "normal" port open.

Re:I don't get it

[Qzukk]

You win. There could be special headers to indicate that a given object is a mysql extension.

Now to find a mysql developer that cares enough to implement that in the next version.

Re:I don't get it

[DrSkwid]

yeah, don't hold your breath.

=)

Not for the first time ...

[enoraM]

Actually we have seen this before with MySQL in the beginning of 2003:

SELECT INTO outfile was buggy up to 3.23.55

I got hit

[LiquidCoooled]

My test server was compromised at 18:50 yesterday.
When I got back to my machine at 19:20, I cleaned it down and found out what was happening.

All firewall logs etc and have archived the executable and dll files dropped.

One into the mysql data folder (app_result.dll), and the executable spoolcll.exe was dropped into windows.
Only now that I've gone into the archive folder has Norton picked it up and archived it (it had shutdown/ran the QConsole.exe NAV application to ensure Norton didn't find it, or it just wasn't in the definitions yesterday).
Its been detected as a href='http://securityresponse.symantec.com/avcente r/venc/data/w32.spybot.worm.html'>w32.Spybot.worm.

Re:I got hit

[jeffy210]

Okay I must ask. If this attack comes across a port. Why in the world did you have that port open to the outside? Not trying to flame you, but a little common sense.

Re:I got hit

[operagost]

All firewall logs etc and have archived the executable and dll files dropped.

Wha? Translation, please.

Re:I got hit

[KyleJacobson]

Clicky for the lazy

Re:I got hit

[LiquidCoooled]

If I locked the port down, I couldn't connect to it...

I have 2 ports open for remote access, and both were supposedly locked with complex passwords (mysql and vnc)
It was running as a dev server for access from work. The work account is a dynamic IP, so I couldn't lock access directly to that one ip.
I had removed the root account from remote access, but must have restored it.
Look at my other comments in this article for extra info.

I already know I cocked up, and my sig is very appropriate.

I was exposed to 30minutes before detecting it and locking it out, many others are still active.

Re:I got hit

[Abcd1234]

Just a suggestion for the future, just drop an SSH server on the machine. Then lock down the database ports on the server so you can only connect from localhost, and use SSH port forwarding to access them from a remote machine. Much safer, and it's a secured connection so you don't have to worry about traffic being sniffed.

Re:I got hit

[LiquidCoooled]

For the future, I have removed ALL remote access from mysql, and won't be re-enabling it again.
When I return to work on monday, I will setup a local install of mysql for testing.

There was never a real need for it, it was simply convenience rather than necessity.

However, I *do* have a vnc port wide open, and whilst today there isn't an exploit, there may be tomorrow.
I guess I should setup the SSH tunnel for that as well.

The biggest bitch about this is that I had discussed all this with my boss a few weeks ago, and had the live machine locked down correctly (not our server, but noticed it was wide open). I think it was when I was explaining the problem to my boss that I re-enabled root access (as at the time the live server had) to show him how exploitable it was...

It sux to talk about it like this, especially considering I normally think in very logical secure steps. I've never been rooted before, and feel violated.

Re:I got hit

[jrockway]

> I've never been rooted before, and feel violated.

You mean you've never found out that you've been rooted. The dedicated attacker isn't going to page you saying "I 0wn3d your b0>!!11", he's going to install rootkits that make him undetectable.

The worm behavior is obvious but humans are a bit more difficult to understand. Never assume that you aren't compromised :)

Re:I got hit

[LiquidCoooled]

I assume that I am compromised every time I sit at a machine.

Granted, I couldn't check everything, but I have a very good feel for my machine and the timings of things. I always assume things are worse than they actually are, some would say paranoid...

I'm comfortable with the applications running on my machine, steer clear of novelty items, and generally run a tight ship. If I have been rooted without my knowledge, then I dread to think how others cope.
Remember, I identified and removed this within a couple of minutes of returning to my machine, noone was there to hold my hand and talk me through it, I saw that "something" was wrong and dealt with it.
If I have been rooted previously without my knowledge, then so have a LOT of other very intelligent people.

Re:I got hit

[doorbot.com]

the executable spoolcll.exe was dropped into windows.

So your MySQL service runs with administrative rights? I did a setup a while back for Win32 MySQL and it actually was pretty easy to setup a MySQL_USR limtited user and then make the service run with that account. I just had to grant permissions to the data and log directories (as I recall). Of course I no longer work for the company that runs the system so for all I know it could be hacked anyways.

Re:I got hit

[doorbot.com]

For the future, I have removed ALL remote access from mysql, and won't be re-enabling it again.
When I return to work on monday, I will setup a local install of mysql for testing.

I'm not sure what your needs are, but the Uniform Server is a great product for Windows. Full LAMP setup without the registry dust, and it works fine when you run it as a limited user. It's small enough that I can keep multiple copies of the whole "server" for testing and/or archival purposes. It's also designed for "localhost" only use... obviously you can edit the config if you want, but neither MySQL or Apache can be accessed remotely.

Re:I got hit

[Anonymous Coward]

um...wouldn't that be WAMP?

Re:I got hit

[k12linux]

However, I *do* have a vnc port wide open, and whilst today there isn't an exploit, there may be tomorrow. I guess I should setup the SSH tunnel for that as well.

Either that or some kind of VPN at least. The VNC authors don't consider the data stream secure even. See this FAQ for more details on that. The password is also limited to 8 chars, btw.

Since no user name is used, a hacker just needs to break your password and they have easy access to your system. During login a random string is sent to the viewer, encrypted with the user password and sent back. I suspect that someone evesdropping on the full conversation could probably work out the password with some effort.

So..

• Use a VPN, SSH or some other way to encrypt the datra stream for VNC
• Firewall access to VNC from the Internet
• Under Windows, set preferences to log you out or lock the session when you disconnect (At least the person getting in will have to also know/guess your windows password.)

Re:I got hit

[LiquidCoooled]

thx :)
Looks like I'm going down the SSH route, or may just completely remove all remote access and use the nice 256MB usb stick I picked up.
However, using a memory key isn't best, because theres always that one file you left at home that you absolutely need.

The need for vnc and usefulness it brings has up until now outweighed the danger of being rooted.

I didn't see my machine as insecure, I was using the maximum built in security I could use (complex password, abnormal port and firewall). Its similar to buying a house, the locks are normally pretty secure to all but the most determined attacker.

My system was locked down enough, and I wouldn't be sat here discussing this if I had re-removed the root account from mysql, which I had reactivated recently to show how insecure it would be...

Re:I got hit

[k12linux]

If you want to be paranoid, you could always use a seperate box for your firewall, lock out all ports except SSH which you have running on a non-standard port which is still firewalled from all but the subnets and IPs you expect to need access from... and even then only accessable if you port-knock another odd port or two first... with SSH disabled for root and both the use account and root have really strong passwords.... both of which are different from any you use on other boxes on your LAN.

Sadly I have to admit that (except for the port-knocking part and non-standard SSH port) I just almost described my home setup.

But I make up for that level of paranoia by using a cheap wireless AP with a static WEP key.

Go figure.

Bandwidth comparison, please ?

[LordPixie]

What is going to soak up more of the Internet's bandwidth ? A MySQL worm port scanning every IP in existance, or a gigantic mob of Slashdotters flaming Microsoft because it only affects Windows machines ? And will either of them even come close to breaking the current record held by BitTorrent Porn ?

For the stirring conclusion, stay tuned to Netcraft: As the Internet turns...


--LordPixie

Re:Bandwidth comparison, please ?

[Anonymous Coward]

You talk of "BitTorrent Porn". Then continue with "For the stirring conclusion". How the hell can you twist that around in to a Netcraft reference?!

Re:Bandwidth comparison, please ?

[Anonymous Coward]

I believe it's something they refer to as 'internet humour' which is so named, because in general it's not funny, and sometimes, but rarely has anything to do with the internet. also, it never ever has both humour and internet references.

Not a worm

[RDosage]

It's a bot. ISC said that it requires someone to initiate the scanning.

Not surprising

[barryman_5000]

I wonder why Microsoft doesn't just decide to build a new OS from scratch that will only run its own software and be very limited but only do one thing good. It doesn't surprise me everytime an exploit appears for programs or OS's nowadays since no one tries to make their stuff secure. Even OpenBSD doesn't do enough. They need to start with more limits and be less user friendly when you are doing something like database software.

Re:Not surprising

[Jaime2]

Why would the responsibility for this be on Microsoft? It was the MySQL distribution that didn't use good defaults or the dumb users who opened themselves up. Sure MS typically does this kind of stuff (but much less nowadays), but this one wasn't their fault.

PS - for those of you thinking MS isn't doing anything to address these problems, take a look at new stuff from Redmond -- look at the defaults for Windows 2003 (yes, two years ago), nothing is turned on by default. IE doesn't even work. Also take at new MS training course. They force you to do everything as a normal user if possible, using RunAs (like sudo for windows) to run selected admin apps when necessary. They also enforce complex passwords in the OS by default. Sure XP isn't locked down by default, but XP is designed to be sold to morons. However, if you are a non-moron, you can lock it down yourself.

Believe me, the day Linux is designed to be sold to morons, it will have the same challenges. And since 50% of the people in the world are morons (at least in the computer realm), Linux cannot be the dominant OS until they deal with the issue.

Re:Not surprising

[Anonymous Coward]

However, with XP if the user has no password (default) then that user cannot be used in any context other than logging in at the console. So you cannot remotely exploit a user with no password, even if they are an Administrator.

Re:Not surprising

[ultranova]

I wonder why Microsoft doesn't just decide to build a new OS from scratch that will only run its own software

Isn't this the point of Palladium ?

Re:Not surprising

[Anonymous Coward]

Excellent post.

Re:Not surprising

[Anonymous Coward]

What exactly do the OpenBSD folks need to do that they aren't doing?

Re:Not surprising

[Anonymous Coward]

Any OS that tries to dictate what I can or can't do is taking WAY too much liberty with limited information and simply demonstrating their designers prejudices and egotism.
OpenBSD or Windows: it's a choice of draconian discipline -vs- ineptitude and an impulse to voyeuristic profit.

Ok, this is strange

[digitalgimpus]

Just a few minutes ago, Sygate Personal Firewall allerted me to several portscans on my system.

I am running mySQL 4.0.x...

I guess it's time to see what's going on.

I do keep all ports closed, all mySQL passwords are secure, no remote access to mySQL. It's just for dev purposes.

Not sure if there is a connection, but I'm going to look into it.

Re:Ok, this is strange

[stanleypane]

You seem very concerned. Better submit that last Slashdot comment before checking it out.

Re:Ok, this is strange

[Anonymous Coward]

Just a few minutes ago, Sygate Personal Firewall allerted me to several portscans on my system.

SPF is too paranoid on port scans. if you play games online (or any app based on UDP) and the server responds to queries in a different port to which you sent the request, SPF will cry "port scan!".

Re:Ok, this is strange

[digitalgimpus]

No games going...

and never really had portscan detection go off.

so far, looks like nothing signifigant, don't see any connection.

Just coincidence I guess.

Re:Ok, this is strange

[Cecil]

Oh noes, teh port scans! A port scan from a worm is just that -- a scan. It's looking to see if you've got that port open. It's not an attack, just a test. The attack comes if the test succeeds and finds you are running MySQL on an open port.

If you keep all ports closed, how precisely do you suspect a connection may have been established? Why bother checking? Perhaps it would do you good to do a bit of learning about how connections and ports actually work. TCP is a pretty simple protocol, nmap's stealthy tricks with FINs and SYNs not withstanding.

Re:Ok, this is strange

[IdleTime]

What can you expect from a person with a pyramide scam in his sig? I didn't know that they had started with the "free minimac" scams already...

Re:The attack on MySQLs without a password is..

[Uptown Joe]

the Snake... Not the new worm. I remember how much of a pain Slammer was, I'm glad I don't admin SQL servers anymore!

I want my money back!

[netsavior]

Man if I had known that this software was vulnerable to worms I would never have bought it.

Re:I want my money back!

[Anonymous Coward]

Huh? I don't get it! MySQL is....

Oh! You mean Windows!

We know...

[Anonymous Coward]

I think everyone readin SlashDot knows what all that means...:P

Re:Your not from the Marketing dept,

[Uptown Joe]

Are you?

Re:slashdot's super post editing strikes again!

[Anonymous Coward]

Requirements to get a story on /.
1. Must bash MS or any of a number of companies on the "not cool" list
2. If a story does not fit #1 then random pieces of info should be thrown in to make it fit #1
3. If there is any chance that a story could bash *nix, #2 should be used to prevent this.

MySQL a real DB?

[Atomizer]

Does this mean MySQL is considered a real DB now?

Re:MySQL a real DB?

[Anonymous Coward]

No, that title comes when it has real database features.

Re:MySQL a real DB?

[KingBahamut]

Ive always thought it was a REAL database. -- 11:15, restate my assumptions: 1. Mathematics is the language of nature. 2. Everything around us can be represented and understood through numbers. 3. If you graph these numbers, patterns emerge. Therefore: There are patterns everywhere in nature.

Re:MySQL a real DB?

[Anonymous Coward]

If vulnerabilities validated programs, I should have charged good money for my "Hello, World!" programs that had a buffer overflow exploit when you enterd your name.

Re:MySQL a real DB?

[Anonymous Coward]

Such as? Don't confuse "Database" with "Relational Database", and yes, MySQL is an RDBMS, just not the version you're probably running.

Re:MySQL a real DB?

[KingBahamut]

Lol....REAL DATABASE features.....thats an odd term. Let us go to the Websters. 1. A collection of data arranged for ease and speed of search and retrieval 2. An organized body of related information 3. One or more large structured sets of persistent data, usually associated with software to update and query the data. A simple database might be a single file containing many records, each of which contains the same set of fields where each field is a certain fixed width. Now then I clearly think that MySQL fits one or more of those definitions...making it a REAL DATABASE.....lol....wake up people.

Re:MySQL a real DB?

[Anonymous Coward]

Such as?

How about ACID compliance, and not screwing up your data?

Until it has these, it's not at real database, it's just a toy.

Re:MySQL a real DB?

[qwijibo]

Thank you for that beautiful demonstration of the tao of technical opinions.

The sig is critical of those whose opinions are based on a limited view of the real world while the post criticizes those who would say the same thing about MySQL and the world of databases.

Re:MySQL a real DB?

[oconnorcjo]

A simple database might be a single file containing many records, each of which contains the same set of fields where each field is a certain fixed width. Now then I clearly think that MySQL fits one or more of those definitions...making it a REAL DATABASE.....lol....wake up people.

What I think most people who talk about REAL DB'S are refering to is the ACID Test. I have not checked recently but for the longest time MySQL failed those requirements.

Re:MySQL a real DB?

[KingBahamut]

But most DBAs that I know recognize at least a little (makes a small symbol with the thumb and forefinger) that MySQL is itself an actual DB. Still, my reponse was not to illicit angry notions of other opinions...."but this is Slashdot", as quoted from the owner of temp123.org =)

Re:MySQL a real DB?

[Guillermito]

Lol....REAL DATABASE features.....thats an odd term. Let us go to the Websters.

You go for a general purpose dictionary to find out the meaning of highly specialized, technical terms?

FYI, some would think you'd need an entire book in order to explain what is a REAL DATABASE, and what it is not

Anyway, I hope you are not a doctor, "Heart: a hollow muscular organ of vertebrate animals that by its rhythmic contraction acts as a force pump maintaining the circulation of the blood" "- Yup! That's all I need to know!"

Re:MySQL a real DB?

[KingBahamut]

http://en.wikipedia.org/wiki/Mysql

Bite me , dunghound.

"MySQL is a multithreaded, multi-user, SQL (Structured Query Language) relational DATABASE server (RDBMS). MySQL is available either under the GNU General Public License (GPL) or under other licenses when the GPL is inapplicable to the intended use."

Re:MySQL a real DB?

[Guillermito]

And your point is...?

I criticized you for taking the definition of a technical term (Database) from a non specialized source (Webster).

You respond by citing a (suposedly) more authoritative source (wikipedia). So, you are actually making *my* point.

Re:MySQL a real DB?

[KingBahamut]

I chose to be general, making a broader statement of fact. You didnt like that, so I went to a more defined source to satisfy your need.

Me: An orange is an orange because dictionary.com says so.

You: Your using a non agricultural source to define something agricultural.

Fine,

You outcite me for using a generalized source to define something. So in turn I chose to validate my point that Mysql is itself a database, that for which you must contend it isnt. Therefor I cite a more credible source to prove this statement. I of course am assuming that not everyone here ais as genius oriented as you are Guill. Sounds like to me you cant get your head screwed on straight enough.

I hope to god your not a Doctor, you might send someone home with a brain tumor telling them its nothing but something going on in their head and to go home and take two Aspirin.

Re:MySQL a real DB?

[Guillermito]

You outcite me for using a generalized source to define something.

Exactly

So in turn I chose to validate my point that Mysql is itself a database, that for which you must contend it isnt.

I never said if MySQL was or was not a database. I just challenged your definition. Let's go to a really credible source (like the books I mentioned) and see if MySQL meets their definition.

Therefor I cite a more credible source to prove this statement.

But you cited the wrong entry.
If you would have cited the entry 'database' (not MySQL as you did) from wikipedia AND if wikipedia were an authoritative source in the database domain AND if MySQL met the wikipedia database definition THEN you would have a point.

Windows + Internet = Bad Things

[WoodstockJeff]

This is yet another reason to not attach a Windows-based computer to internet without a firewall. Of course, having a public-access SQL server (regardless of its software) isn't a particularly good idea, either.

For both of these, there are exceptional requirements that can negate these general rules, but anyone who has these requirements should know better than to not take exceptional measures to protect the server.

Re:Windows + Internet = Bad Things

[Anonymous Coward]

Please, stop your trolling. There is no reason this exact worm couldn't be ported to Linux and exploit MySQL in a fine-and-dandy fashion.

Re:Windows + Internet = Bad Things

[LiquidCoooled]

Windows DOES have a firewall, I have everything locked down, and only 2 remote ports exist.
One is for VNC, and the other is for the mysql test server.

Both were protected by strong passwords, and I thought I had done everything possible to prevent these kind of intrusions.

I connect remotely from a dynamic adsl line with varying IPs, so cannot tie the connection to a specific remote IP, the best I could do is lock it to my works' ISP range, and even then there are thousands of possible computers able to exploit it.

I see the rights escalation as a problem with windows, but the initial exploit is not microsofts fault.

Re:Windows + Internet = Bad Things

[3dr]

Good points. And to just emphasize the underlying security issue, corporate environments are far from being safe havens, too. It's imperative the DB root account has a good password (for sufficient values of good!).

I run several MySQL servers on XP/w2k3server/linux boxes at work. All are closed to non-localhost access.

Re:Windows + Internet = Bad Things

[Malc]

You should be moderated troll. An overly anti-Microsoft zealot at that. This isn't about Windows. This is about MySQL and poor admins (weak passwords and poor firewall configuration).

Re:Windows + Internet = Bad Things

[WoodstockJeff]

You can still avoid this problem. Even if you have to have remote access, do NOT allow 'root' to log in remotely. Create another user, also password protected, to do root-like things on MySQL.

The way to do this:

use mysql;
grant all privileges on *.* to obscureusername@"%" identified by 'strongpassword' with grant option;
delete from user where host='localhost' and user='';
flush privileges;

Re:Windows + Internet = Bad Things

[LiquidCoooled]

I had *thought* I had removed root@% account.
I had granted remote privs to one single user with a lengthy password.
Obviously my sig is useful today.
*hangs head in shame*

Re:Windows + Internet = Bad Things

[WoodstockJeff]

Gee, according to the article, it's about MySQL, Poor Administration, and Windows. Remove any of the ingredients, and it's not a problem!

That said, Windows, by default, has a lot of things going on that the user is unaware of. Does the average Windows user know that LSASS is running? Or the Messenger service? And why does Windows default to loading MSMessenger, and fight most attempts to disable it?

And the firewall is considered laughable by many sources I've read, including Windows zealot sites. It's very easy to write a program to disable it without the user's knowledge. And it's off by default, unless you've got SP2... which many users are scared of, because it has a history of killing systems and certain programs.

I install SP2 where I can, but there are some systems where the risk of something not working outweighs the customer's desire to be fully patched... The only thing we can do is build another system for them, and verify everything still works under SP2, before they'll let us touch the working system. If the system is behind a hardware NAT firewall, I don't concern myself with it too much.

Re:Windows + Internet = Bad Things

[YU Nicks NE Way]

The reason this is a Windows issue is that the worm drops a Windows executable on the box and spawns it (in binary). The exact same mechanism would have worked against Linux.

Re:Windows + Internet = Bad Things

[budgenator]

No it's about
1. MySQL is doing what it is supposed to
2. having any password on a known user means, sooner or later it's going to be cracked.
3. how readily MS software will try to execute anything even remotely looking like an executable
4. the only thing I'm not sure about is if Windows can run MySQL as a non-priveliged user? I know its standard practice on linux/unix systems to run MySQL as a standard user with no shell account.

Re:Windows + Internet = Bad Things

[Malc]

Why couldn't Windows run it as a normal restricted user?

I do it all the time for services. And I often run user space programs as a different user with the runas command. In fact, I've written applications that use different security contexts in threads just so that the whole application (C++ ISAPI extension) doesn't have access to the network (shares and database).

Don't keep the port open!

[hacker]

99.99% of people who run MySQL run it on the same machine as their webserver that queries it. Most people don't actually do queries across the network to the database server.

Just run MySQL with --skip-networking at startup (skip-networking in my.cnf), to disable MySQL from listening on port 3306. I know on most systems, its probably the default, but in almost all of the cases, its completely unnecessary.

And also, validate your input !! Don't just assume that whatever is passed on the URI field of a browser, is going to be correct. Check it. Then check it again.

Re:Don't keep the port open!

[Pierce]

...and block direct access to your database from the Internet. Better yet, restrict it to only the machines you know need to have that access.

Re:Don't keep the port open!

[Malc]

Good points that all good admins should consider in case they have an issue with their firewall (e.g. screwing reconfiguring open ports). If you don't have a firewall, then why not? If you're a home user on broadband, then why aren't you behind a cheap router?

Re:Don't keep the port open!

[drinkypoo]

Turning off networking makes remote administration more difficult. Why not just block the port? Every supported version of NT, plus the two most recent unsupported versions (and probably more) has port filtering. Just block those ports (or, you can default deny) on the external interface.

Re:Don't keep the port open!

[hacker]

"Turning off networking makes remote administration more difficult."

What 'remote administration' tools are you referring to? No open network port is required for remote administration.

Re:Don't keep the port open!

[Anonymous Coward]

...except Windows lacks domain sockets so ported apps typically use network sockets!

I don't know what validating input has to do with an open db port? Was that just some general advice pulled from the start of "Computer Security for Dummies"?

Re:Don't keep the port open!

[drinkypoo]

By definition you need SOME kind of network port open for remote administration. Otherwise you can only connect locally. Or through serial I guess, but since the overwhelming majority of Windows software is manageable only via GUI, you really need Terminal svcs or VNC. However, I was talking specifically about being able to use a SQL client on another box to muck with the db. You could put mysqladmin on the box, but then you'd need a web server and php, and a http port open.

Re:Don't keep the port open!

[Dausha]

if you are going to remote administer a server, you should first SSH into the server. Then as a "localhost" user, you can access the database. You wouldn't remote administer via the port. Or, at least, you should.

Re:Don't keep the port open!

[hacker]

"By definition you need SOME kind of network port open for remote administration. Otherwise you can only connect locally."

Almost right.

Since you should, as a good administrator, limit the number of ports open for potential exploits. This means using vnc-over-ssh (locked to specific incoming hosts, of course) to admin the box, instead of vnc (on 5900) and then 3306 for MySQL (which isn't secure anyway). This way, you keep one port open (22) instead of three ports (22, 3306, 5900).

But you can, and should, be using some tools that communicate locally to MySQL, through a remote interface (vnc-over-ssh, phpMyAdmin, etc.).

Take whatever works, I'll use the more-secure approach, while you keep unnecessary ports needlessly open.

Re:Don't keep the port open!

[fishbowl]

"99.99% of people who run MySQL run it on the same machine as their webserver that queries it."

What research method did you use to come up with that precise number?

Re:Don't keep the port open!

[Anonymous Coward]

It was a rectal approximation.

Re:Don't keep the port open!

[drinkypoo]

Uh, no, I'll take the more secure approach, and I won't use windows :) Well, I do use it on my desktop, but on my Linux system I block most services from outside, or I don't turn them on in the first place, and I ssh in.

I don't lock ssh to specific hosts because I want to be able to administer from anywhere. I do plan to move to one-time passwords soon, however, since I got a j2me otp generator that should run on my phone.

Re:Don't keep the port open!

[Anonymous Coward]

The question isn't how many windows boxen are running a SSH server, the question is how many windows *admins* can get by without a GUI.

You should not remotely admin a database server over the internet but it is common to run user queries over the net, if you only need local access then you can disable networking but somebody already pointed out that Windows lacks domain sockets, so disabling networking is not really viable on Windows is it?

Re:Don't keep the port open!

[Anonymous Coward]

Let's make this painfully obvious for you.

On *nix you connect to the MySQL database server via a domain socket, Windows doesn't have domain sockets, if you disable networking on MySQL/Win32 you cannot connect or perform queries against the DB server.

Good luck securing things without understanding how they work! Man, I luv armchair security guru's.

Re:Don't keep the port open!

[Anonymous Coward]

Disable networking? Who said anything about that? If you wanted to disable all networking you might as well pull the network plug.

IP filtering is far from disabling networking.

Re:Don't keep the port open!

[Anonymous Coward]

The post you're replying to:

if you disable networking on MySQL/Win32

First post in thread:

Just run MySQL with --skip-networking

Your IQ:

LOW

Re:Don't keep the port open!

[Anonymous Coward]

Unless you use named pipes, eh?

Re:Don't keep the port open!

[Anonymous Coward]

...except Windows lacks domain sockets so ported apps typically use network sockets!

But windows do have named pipes!

Re:Don't keep the port open!

[legirons]

"99.99% of people who run MySQL run it on the same machine as their webserver that queries it."

This random "plucking of statistics from ass" is starting to get irritating. There are "Over 5 million active MySQL installations worldwide" [Link. By your reasoning there would only be 500 or so installations of MySQL on separate machines. Right. So less than 100 customers then? (even small sites like wikipedia have 5 MySQL machines)

99.999% of people who quote statistics with nines in are making them up, and of those, 99% can't count

Re:Don't keep the port open!

[Anonymous Coward]

Named pipes still require a network layer, eh?

Re:Don't keep the port open!

[obender]

Also --bind-address=127.0.0.1
This way you deny access to other computers but all the tools that connected locally through tcp/ip still work.

Re:Don't keep the port open!

[budgenator]

Most people don't actually do queries across the network to the database server
You would be suprised. Ome time a web app I was working on seemed to not be updating the database on my dep platform only I later discovered my Developement system was acutaly using the database server on the web instead of my local machine!
Seems to me that if the server is comprmised a virus attacking your database server through a socket is not much differnet than through a tcp/ip port.

Re:Don't keep the port open!

[wolrahnaes]

"so disabling networking is not really viable on Windows is it?"

I don't know about other services, but MySQL on Win32 supports named pipes, and can use those instead of TCP/IP. It even asks in the installer if you want to disable networking.

Re:Don't keep the port open!

[pinball667]

exactly - or if you prefer to use gui tools on your local station break out port forwarding - `ssh -L 3306:localhost:3306 you@yourserver` and point your local clients at your workstation.

Some info

[Squeebee]

Ok folks. This is a bot, and it uses weak root passwords to gain entry to MySQL. From there, it loads a BLOB in a table with a payload DLL, which it then writes to disk and loads as a MySQL UDF. The UDF is called, which creates the bot and the system is compromised.

Damage appears to be low as it is more spyware than anything, and you are only at risk if you A) Have not firewalled the MySQL Port, B) Have a root account that is allowed to login from anywhere, not just localhost, and C) Have a weak root password.

So, the fix is this:

A) Firewall port 3306
B) Remove the root@% account, only allow root@localhost
C) Set a strong password

I have more info at http://www.openwin.org/mike/index.php/archives/200 5/01/batten-the-hatches-mysql-targeting-bot-on-the -loose/

Re:Some info

[Squeebee]

Now with href goodness: http://www.openwin.org/mike/index.php/archives/200 5/01/batten-the-hatches-mysql-targeting-bot-on-the -loose/

temporary fix

[greechneb]

Open the Administrative Tools/Services app.
Find the "Event Monitor" service.
Open the Properties for this service.
You cannot pause or stop this service, so set the General/Startup Type to Disabled.
On the Recovery tab, set all 3 failure actions to Take No Actions.

Reboot.

Since the service didn't start, spoolcll.exe is not running.
Delete it (or whatever).

But, do not delete the service, as its existence will prevent new copies of the virus from activating.

Re:temporary fix

[advocate_one]

Reboot?!?!?!?!?! surely not... oh you're talking about ms-windows here... not Linux.

Re:temporary fix

[Anonymous Coward]

"Event Monitor"? I don't see it at all. I only see "Event Log".

Re:temporary fix

[tr0p]

"Event Monitor"? I don't see it at all. I only see "Event Log".

Sounds like your system is completely compromised =/

MySQL in practice

[Marcus Erroneous]

Well, I'm pretty sure I've got that port blocked already, but . . .
I stood up MySQL on a Linux box and on a Win2k box to show that, unlike MSSQL, MySQL ran on more than one platform. One database could be deployed to both platforms with the ability to keep the application running even if one goes down. Instead of having the app be entirely offline, you can bring the other over very quickly. Did this just after the first MSSQL worm to show that there are alternatives and that entire sites don't have to go down because of one bug. Now we're working on deploying some Linux clusters.

Re:MySQL in practice

[Anonymous Coward]

Well, I'm pretty sure I've got that port blocked already, but . . .

I think this is the problem. MySQL makes it too easy for people who can't be bothered to take security seriously to put their database on the network.

Ahh... but you are forgetting...

[cnelzie]

...that many of these same people swear by MS Software and by way of the design of MSSQL in that is uses RPC even for local requests, will often configure MySQL to act like MSSQL, 'cause that is what they were done taught.

HOLY SHIT - YOU'RE DUMB

[Anonymous Coward]

How is the fact that you, one person [and actually, given the stupidity of your comment, I would argue that you're only half a person], use Postresql on Windows a statistic that backs up the original poster's claim?

Guess what Jason, you're really fucking stupid and you should commit suicide, today.

In fairness

[wowbagger]

In fairness, I would generalize your statement to:

Don't connect ANY computer to the Internet, or any other hostile network, without a firewall.

Now, you can argue that, in the case of some operating systems, the firewall built into the OS, when properly configured, is enough.

You can also argue that a firewall should be a firewall, and a firewall ONLY, and that any other services should be provided by another machine BEHIND the firewall.

And depending upon the circumstances, either argument can win.

However, if you think in terms of "First the firewall, THEN the services", you will be miles ahead.

Connecting a Linux box, or a *BSD box, or a Mac, or an AS/400, or .* to a hostile network with any non-trivial set of services running and no firewall, and it is going to have problems.

The problem here is that the people who set up the MySQL servers on these boxes did not insure they were firewalled - this could have happened just as easily to a Linux box with a similarly bad setup.

Re:In fairness

[Anonymous Coward]

Isn't a firewall a computer?

Re:In fairness

[Anonymous Coward]

Don't connect ANY computer to the Internet, or any other hostile network, without a firewall.

I don't understand. I have more than one server with SSH, WWW, FTPS, POP3S and other services running on them, and I've never used a firewall to 'secure' them. If the services themselves are secure, how will a firewall help? If they're not, again, how will a firewall help?

Re:In fairness

[Anonymous Coward]

This is bullcrap! Although I won't dispute your comments about firewalls, that is NOT what caused this particular fiasco!

From another poster (with a link that verified his analyasis of this):

it specifically uses weak default/unset DB admin passwords and MySQL running as a system or admin level task with write access to everything. Once the worm is in your server as the db admin password, it uses the db admin's ability to load a dll into mysql to allow it to perform actions outside of mysql.

So, to get compromised a user had to:
1. leave the default or no DB admin password
2. have MySQL running as an admin level task

1 is the installer/user's fault! No way should passwords be anything but different than the default and STRONG if hooked up and open to the Web! Othert posts have mentioned that MySQL's DB admin acoount can be restricted to localhost login and that's much, much better!
Now, 2 is unarguably Windows' fault. I have fought the problems with running almost any application as anything but Admin. Generally, it just doesn't work soooo often that I just install stuff as Admin to avoid hassles. This is most certainly MS's fault for their lame understanding of multiuser and security!

After the first 2 conditions are met, a .dll is loaded into MySQL to allow operations outside of MySQL. This is first and foremost MySQL's fault! Why it dhould allow the loading of .dll's for any reason is way beyond me! Much of the credit for this belongs to MS, though. The original concept of dll (Dynamic Link Library) was to cut down on the duplication of common code routines, NOT to extend the OS. MS used them as a way to obfuscate OS functions, however. In my opinion a large number of things that MS put into dll's has no business there. Through the overuse of dll's they have fostered the notion that the only way to extend program capabilities in Windows is by using dll's.

So, although firewalls may have helped some, this exploit requires a whole buncha other stupidity that has nothing to do with firewalls! and your attempt at fairness in response to a pretty blatent anti-Microsoft post just illustrates how much slack people are willing grant Microsoft by blaming lusers for "not using a firewall".

Re:In fairness

[Anonymous Coward]

Don't be stupid. What do you think a firewall is? A computer running Linux, mostly.

Large organizations such as universities runs tens of thousands of UNIX boxes directly connected to the Internet.

A firewall is an administrative tool that you lock down network services with, not some magic dust that keeps hackers away.

Re:In fairness

[Anonymous Coward]

mysqld runs fine as a normal user in windows
try it before you start spouting crap

Re:In fairness

[Anonymous Coward]

RTFP, Moron!

I have fought the problems with running almost any application as anything but Admin. Generally, it just doesn't work soooo often that I just install stuff as Admin to avoid hassles.

My point was: there are so many problems installing/running so many apps as anything but Admin (and this most especially includes Microsoft apps) that I (and most others) just install/run all apps as Admin to eliminate problems.

It says WINDOWS in the TITLE

[Anonymous Coward]

nt

Re:It says WINDOWS in the TITLE

[pete-classic]

I'm fairly certain that it didn't when I posted. Either the editors changed it or I've lost all of my powers of observation in one go.

-Peter

mlod u4

[Anonymous Coward]

goal here? H0w can

Does mysql on windows have root@%?

[lorcha]

I just looked at my Debian and Gentoo installations and neither of them leave you vulnerable to this type of crap by default.

Who really creates an unpassworded root@% superuser account?

Re:Does mysql on windows have root@%?

[Squeebee]

Non-Windows installations are not vulnerible.

Re:Does mysql on windows have root@%?

[RollingThunder]

To having the DLL loaded, true.

However, if you're foolish/ignorant enough to have root@% with no password, then anyone can connect to your database remotely and browse your data to their hearts content.

Re:Does mysql on windows have root@%?

[WoodstockJeff]

Who really creates an unpassworded root@% superuser account?

The MySQL install program, because you need SOMETHING to administer it with. Of course, the first thing it tells you to do is to change the root password, and how to do that.

The alternative is to create a passworded root user account, with a published password... Which is just as bad. How many consumer routers have the password of "admin"?

Re:Does mysql on windows have root@%?

[lorcha]

The MySQL install program, because you need SOMETHING to administer it with.

How about root@localhost instead of root@%??! How about having skip-networking enabled by default like some Linux distros do?

I can think of 100 safe ways to handle new installations. Opening up an unpassworded root@% account is certainly not one of them.

Re:Does mysql on windows have root@%?

[YU Nicks NE Way]

Non-windows machines are not vulnerable to attacks using Windows executables, yes. However, the same attack would work perfectly well against a non-Windows box; the only difference would be in the executable dropped.

Re:Does mysql on windows have root@%?

[Nos.]

if you're foolish/ignorant enough to have root@% with no password, then anyone can connect to your database remotely and browse your data to their hearts content

That's a little broad. I have to development MySQL servers running. At least one of them has root@% with no password. Go ahead, browse my data. Oh, you'll want the IPs: 192.168.112 and 192.168.1.15. Oh, that's right, they're both behind a firewall (well, actually two firewalls). No port forwarding to either box. You have to either connect internally, or connect remotely (from specific IPs to either SSH or VNC) to another box to get inside.

Of course, for the record, a machine with a root@% account with no password were to exist, anyone connecting to that account could do a lot more than "browse" the data there.

In other news

[Anonymous Coward]

There have been reports of large amounts of thefts occuring from persons leaving stacks of cash outside their front doors. Apparently, perpetrators would use a vehicle to drive up to individual's houses and take the money.

Sad to say, but this is where ease of use and point-and-click stuff brings you.

To MySQL's credit, IIRC, latest MySQL for Windows installers are fairly insistant on warning you about enabling network access and setting a root password.

I've got a bullseye on my forehead

[Ceriel Nosforit]

On my desktop maching I'm running Apache, PHP, Perl and MySQL on WinXP in order to run one of those PHP portal-things. My 'pooter stays on 24/7, mostly serving friends with annoying or funny pictures, and as I use all sorts of 'network aware' apps my static IP would certainly not be concidered dead. So if this worm is going to hit I should be quick to know about it. So far a search for that mentioned file turns up no hits, but if I catch it I'll post it on my portal, URL above.

(And don't you dare /. me. I've gotta present a PHP app I'm coding tomorrow.)

Mod parent down

[Professor S. Brown]

Read the fucking article - it exploits a flaw in Windows to propogate itself once it finds a vulnerable system. MySQL on *nix is vulnerable to the MySQL flaw, but not the part that does the damage. This is why the parent is not a troll, and you are an idiot.

Re:Mod parent down

[Anonymous Coward]

You RTFA. It exploits weak passwords to gain root within MySQL.

Re:Mod parent down

[WoodstockJeff]

It exploits weak passwords to gain root within MySQL.

Just like so many worms exploit weak or non-existant administrator passwords in Windows XP to promote themselves to services. Weak passwords are worse than no password. At least no password means you know anyone can access your system. And Windows XP doesn't do much to discourage you from running as Administrator, and does a lot to prevent you from running as anything else (What? I can't sync my Palm Pilot without being an Administrator?!? DO IT!).

Re:Mod parent down

[budgenator]

It exploits weak passwords to gain root within MySQL.
Which has nothing to do with
weak or non-existant administrator passwords in Windows XP
Database root != system root. Hell I can create a database user shitbird, grant shitbird all of the privilages of root then delete root as a user of the database and everything runs fine. The virus attacks root because it the one database account likely, but not necessary, to be on all databases.

Want an eye-opener, nmap a chunk of the internet for open MySQL port 3306's and try to connect to them as any user, no password, and database test, you will be amazed!

Re:Mod parent down

[SupremeTaco]

Dude, with a name like that, I'd definitely NOT include it in my sig.

**sheesh**

Re:Mod parent down

[Anonymous Coward]

Sorry Charlie, you're wrong as well.

http://isc.sans.org//diary.php?date=2005-01-27

The bot uses the "MySQL UDF Dynamic Library Exploit".

If you combine a mysql exploit along with a really poor password you get what? Mysql problem. Ding Ding!

Re:Mod parent down

[benjymouse]

For your information it is a flaw in *MySQL* that allows a script to store binary code in a BLOB (not a problem) and afterwards dump the content to an OS file named *.dll (some problem) and finally execute the damned file (big problem). I'm sorry, but this is exclusively a problem with bad admins (weak passwords) and MySQL bugs.

People have their DB open to the world?!

[Abcd1234]

Good lord, are you kidding? I would assume any reasonable organization that was accessing their database over a network would keep the webserver on a DMZ and the database server behind a firewall that's tightened up and only allows access to the database from the DMZ. Isn't this, uh, kinda obvious? And, of course, if the database and the webserver are on the same box, *why* is remote access enabled at all?

Re:People have their DB open to the world?!

[Undertaker43017]

Sadly, basic security measures seem to escape some. Mostly I would say anyone deploying databases this way deserves what they get, unfortunately I do buy things on the Internet and it scares me to think how many of those sites do exactly this...

Re:People have their DB open to the world?!

[RazzleDazzle]

And what about hosting companies who have customers accessing the database server from all over the internet to make changes and update the database? Not everyone who uses mysql is just some guy in the basement of his parent's house with too much free time on his hands to come up with the wonderful idea that no one else has thought of: restricting access to tcp port 3306 except from his web server and from his workstation.

Don't mean any offense to you personally since I have no idea who you are, just using the common stero type of open source junkies.

Re:People have their DB open to the world?!

[LurkerXXX]

Those would be expected to only allow access to the DB server via SSH only, otherwise the DB server be totally blocked from talking to anything but the webserver which should reside in a separate DMZ.

Having an SQL port directly accessible to the internet is NOT professional.

Re:People have their DB open to the world?!

[pavera]

Um, we're talking about windows boxes here, probably little devel machines... the question is why are these windows boxes right on the net at all... your setup obviously is the most rational if you've got the cash/hardware for it. However, I run a box with db and web on the same box (its a linux box) but access to the db is restricted to the localhost, and the firewall on the box only allows connections to port 80, 22, and 25...

Anyway, running db + web on the same box is not necessarily evil for small sites that don't require a separate db box for processing, but certainly you don't want your db open to the world, firewall that port, or restrict access to the db deamon to localhost (its easy to tell mysql not to allow root logins from anywhere but localhost) if you need remote db access, let some less privileged user have remote access... silly people.

Re:People have their DB open to the world?!

[Anonymous Coward]

Good lord, are you kidding? I would assume any reasonable organization that was accessing their database over a network would keep the webserver on a DMZ and the database server behind a firewall that's tightened up and only allows access to the database from the DMZ. Isn't this, uh, kinda obvious?

Hello? We are talking about people using MySQL. Seriously, what did you expect? Calm down, no one is running MySQL for any mission critical database, and no one has any mission critical database open to the world. We are talking about blogs here and small websites, but still I agree that using SQLite would be much better idea -- it's secure from the network, it has real ACID transactions, it is a real RDBMS. But people prefer MySQL running on Windows, what are you gonna do? Nothing. So calm down. It's not the end of the world, is it?

Re:People have their DB open to the world?!

[RazzleDazzle]

And if it is a Microsoft Windows server running MySQL or MSSQL without an SSH server?

MyWorm

[Doc Ruby]

We've got the source code. Where's the hole? And, more important from the OSS perspective, where's the patch? And what happens when different people release incompatible patches? Is a worm a good way to force a fork in an OSS project, making it less competitive?

Re:MyWorm

[catenos]

We've got the source code. Where's the hole?

The worm doesn't use a hole within MySQL, but only bad admin passwords. In short, it's a problem with people not a technical one.

But there are mitigating factors:
- MySQL allows loading of libraries (UDF) for users with the right privileges (of which root usually is one, of course), which is a powerful feature and that power can be abused.
- The worm requires that MySQL is set up for networking, and that the port is freely reachable from the internet.

And, more important from the OSS perspective, where's the patch?

No patch needed. The mitigating factors are configurable (you can disable networking in the config, and restrict accounts to certain hosts; you can compile MySQL without UDF support; and of course, you should have installed a firewall that restricts access to the port, if networking is really required).

Btw, better distributions already come configured this way (if you want UDF support and whatever, you use the MySQL-Max binary).

And what happens when different people release incompatible patches? Is a worm a good way to force a fork in an OSS project, making it less competitive?

Are you trolling? No admin with any clue would use any 3rd party patch (especially when work-arounds are available), but wait for the update from his vendor.

Changing your vendor after such an attack may be a good thing to consider, after security holes have been mishandled several times. But considering 3rd party stuff for an urgent hole only opens you to the equivalent of phishing attacks (nonwithstanding all the other problems such an idea has, like that you can't know the quality of the patch).

Re:MyWorm

[Doc Ruby]

As you point out, this attack exploits weak passwords in MySQL - a social engineering attack, irrelevant to the source code. But the patch question I raised,

"And what happens when different people release incompatible patches? Is a worm a good way to force a fork in an OSS project, making it less competitive?"

is still valid in general. Sometimes it takes a while for the "official" distributor of the software to issue a patch. In the meantime, many of us with the source of a vulnerable OSS program will patch the hole ourselves. And distribute the patch, at first to our friends, but then into general circulation. If we distribute the SW we patched, and it's under GPL, we're obligated to distribute the patch. So multiple patches, from different sources, can be available, and even necessary when the official vendor doesn't release one faster, leaving our systems vulnerable. Especially if we examine the "alternate" patches ourselves before installing, using them can be teh safest alternative. But now the source has forked. So this is a "social engineering" DoS opportunity to attack the official app project: exploit enough bugs too quickly for the official project to issue patches quickly enough to meet demand, and people will write their own, forking the project. If that happens enough, and a full patchset remains unavailable from the official project, the source might remain forked.

This scenario seems unlikely, though possible, and is hypothetical until it is actually encountered. But it is a vulnerability that OSS projects have that proprietary ones don't, relying on the usually advantageous property of open "patchability". I won't be surprised to see it actually happen someday. Especially when some valuable, resourceful proprietary apps get lethally threatened by competing OSS apps. So, just like any other security scenario, it's worth considering in advance. So when it does happen, at least the attackers won't have the element of surprise totally on their side.

Re:MyWorm

[catenos]

I already answered to the second part, too. Usually there are work-arounds available. I am not sure which experience you are referring to, but I see professionals to wait for official patches and vendor updates, usually. Applying patches manually seems to be the exception, not the rule.

But let's assume people do what you say and your scenario would happen. Why would this be a vulnerablity? What is the problem? Actually, I see it as another advantage of OOS. With binary software, you *have* to use a work-around until a fix comes, and you *have* to hope that a fix will be part of the next patch-day.

IMHO, it would probably happen as it happened with the Linux kernel some days ago: one good soul offers to maintain a fork with security patches. All is well. Where is the problem again?

"Fork" is often used as a bad word, a worst-case scenario, when it isn't. There are a lot of distributions, and in some way, they are all forks of a lot of packages they contain (any Linux distro still delivering their main kernel unpatched?). The world still stands.

Forks become a problem, if there happen too many and if they happen due to social problems and leave people not cooperating (because then it becomes unrealistic to backport all those patches). But in the scenario you suggest, I see people working together. Someone just taking some load from the main project.

Still using Windows? Your fault.

[Anonymous Coward]

Our sysadmin came running this morning and was totally devastated. The last two windows servers we have were gone because of this(we had numerous virus problems before). It was a quick decision: from now on those two boxes will run Linux just like all our other machines and we will be a 100% windows-free environment! Yeah!!!

Re:Still using Windows? Your fault.

[fishbowl]

"Our sysadmin came running this morning and was totally devastated."

Devastated? You sure it wasn't the happy dance? He just got handed a SA's dream -- no longer wearing the pager for a Windows server!

Re:Still using Windows? Your fault.

[Anonymous Coward]

What utter bullshit.

If in fact you DID get hit with this then you sysadmin should be FIRED FOR GROSS INCOMPETENCE!

Switching to Linux will not save you from being a complete ass-hat.

Hooking a Linux machine up to the net and 1) Not using a firewall, 2) Not using a password other than "123" and 3) Not setting up user/program permissions means that you will be rooted in no time anyway.

Good luck to your buisness, you'll need all of it there is.

Don't do the editors job for him!

[fm6]

It makes him lazy!

Re:Don't do the editors job for him!

[sanityspeech]

It makes him lazy!

Point taken.

What do you suggest? I only decided to post because of the questions that came to mind. I do agree with you that the story could have used some more work, but I don't know that whining would solve the problem.

I saw a flaw, and decided to fix it.

Re:Don't do the editors job for him!

[fm6]

I was being sarcastic. Your post was actually very helpful.

best fix

[Anonymous Coward]

The best fix is to format your harddrive and install a real OS on your machine. How stupid can people be to still use windows for a server. Anyone who knows anything about MySQL and wants a decent performance should know better and run it on a Linux server anyways.

wooooo the scary worm is after me

[DanGroom]

So, having RTFA I'm not even slightly concerned. I have mysql running on windows, but since the exploit this thing uses requires a)straight up access vis the internet (eg, no firewall) and b) a brute force atack on the root password, I feel pretty safe. As should anyone else who's behind a firewall and who's root mysql password isn't '12345'....

Re:wooooo the scary worm is after me

[sremick]

You're soooo opening up yourself for Spaceball jokes...

Re:wooooo the scary worm is after me

[Slightly Askew]

What a coincidence, I have that same combination on my luggage.

Re:wooooo the scary worm is after me

[Jeff Hornby]

my god, how'd you guess my password?

serious?

[dtfinch]

"the bot first has to authenticate to mysql as 'root' user. A long list of passwords is included with the bot, and the bot will brute force the password."

This makes MySQL look about as vulnerable as ssh.

I can see there are some great sys admins

[Anonymous Coward]

Having any db server accessible directly from the internet is plain idiocy. There is no justification for it. You deserved to be 0wn3d. And hopefully it will keep you off the net for a long time while you try to repair.

Open source, closed source isn't the issue. Having half a brain is.

more windows problems on the way

[Anonymous Coward]

Someone who knows anything about MySQL doesn't run a windows server to begin with. Windows performance is very poor and security will always be at risk. Particulary for applications like MySQL Linux is the OS of choice. I can't believe some of those windows freaks that are still out there call themselves professionals. That's scary.

Re:more windows problems on the way

[Anonymous Coward]

Some of us would say the same thing about people using MySQL as a database...

Re:more windows problems on the way

[DrSkwid]

Particulary for applications like MySQL Linux is the OS of choice.

I love that, they DO go together rather well.

I hope you see the irony of that =)

I can't believe some of those windows freaks that are still out there call themselves professionals.

Linux : by amateurs, for amateurs.

I really need to remember to check the HTML option

[LetterJ]

I rewrote PHPTriad, securing the default password for root and did so 3 years ago. The new product is Sokkit. However, Sourceforge won't let me take PHPTriad down, point to the new commercial version or in any way indicate the project has been shut down.

The only reason I left it alone in the old PHPTriad package was that was how MySQL themselves ship the setup. The official MYSQL binaries have (unless it's changed very recently) *no* password on the root account unless you deliberately go and change it.

Even today, I get constant complaints because I secure the root account, even though I ask them to supply the password.

Can this be that widespread?

[Bootsy Collins]

I just checked my firewall logs for the last several days, and haven't seen a single hit on 3306.

Re:Can this be that widespread?

[PigleT]

zsh/scr1, potato 8:11PM log/ # grep -c 'DPT=3306' kern.log
32

That's 32 hits *today*. There were 46 packets yesterday:

kern.log.2.gz:16 (2 days ago)
kern.log.3.gz:9 (...)
kern.log.4.gz:10
kern.log.5.gz:18
kern.lo g.6.gz:3
kern.log.7.gz:4
kern.log.8.gz:2

So I guess there must be a random-scanner element to it and it's on the increase. Woopiee....

Good

[Pan T. Hose]

Does it mean that MySQL is now officially "ready for the desktop"? Hopefully, the Linux version will be next.

What a load of rubbish

[Anonymous Coward]

Even for slashdot, there are a lot of FUD posters out here.

If you installed ANY database on ANY system and didn't take efforts to lock it down then you are an idiot.

This worm only affect people that made all three classic errors below:
1) Didn't set up a useful firewall
2) Didn't lock down the administrator access
3) Didn't set a secure root password for the DB.

Well, now you know where you went wrong and should learn a bit about system security.

On top of all the above, you have to be running an operating system that has been configured to allow a new data file to be created by the DB then loaded as executable code. That is also poor system administration - you should NOT give a DB app rights to create executable files.

The old saying is always true:
Wise people learn from other people's mistakes
Most people learn from their own mistakes
Fools never learn at all....

Yahoo Finance

[Anonymous Coward]

I wonder if that is why Yahoo Finance is not working correctly at the moment. It is suppose to be powered by MYSQL

Yahoo Error

Re:Yahoo Finance

[Anonymous Coward]

Yeah, Yahoo Finance does use MySQL, on Linux and FreeBSD. Not Windows. The worm attacks installs on Windows. And besides that, I somehow doubt they left the default install logins in place on their machines since the guy in charge of their servers has written a book on MySQL and is anything but dumb.

What passwords does it try?

[Anonymous Coward]

Anyone have a list?

So it's the admins' fault?

[goldspider]

Let me make sure that my understanding is aligned with the Slashbot collective.

When a clueless admin doesn't secure Windows, it's Windows' fault. But when a clueless admin doesn't secure an OSS application, it's the admin's fault.

Do I have that right?

Re:So it's the admins' fault?

[sloanster]

Let me make sure that my understanding is aligned with the Slashbot collective.

When a clueless admin doesn't secure Windows, it's Windows' fault. But when a clueless admin doesn't secure an OSS application, it's the admin's fault.

Yes, you've got the drill down pat:

Whenever another windows security crisis arises, immediately try to make light of it with sarcasm like what you've written above. The whole idea is to start a flamewar, and divert attention away from the real issues. Extra points if you can manage to insult linux, and linux users in the process.

You have done well.

Re:So it's the admins' fault?

[m50d]

No, it's always the admin's fault. But in this case, windows could have stopped the admin's mistake doing any damage by having a firewall.

Re:So it's the admins' fault?

[Anonymous Coward]

XP SP2 has a firewall.

Re:So it's the admins' fault?

[Anonymous Coward]

Redhat comes with a firewall? No? You mean every version of Linux isn't automatically firewalled?? [gasp]!. Some versions of Windows do have firewalls and do have them on by default.

Any more broad stuid things you'd care to share?

Re:So it's the admins' fault?

[EvilJoker]

uhh, I seem to remember there being an option during the Fedora Core 2 install where it asked about firewall (and basically said I probably needed it, enabled by default). Being being behind NAT on such a low-end box, it wasn't really worth it, so I couldn't tell you how well it works.

Yes, some versions of Windows (SP2 only) do have firewalls enabled by default. All the rest have to get a third party firewall like ZoneAlarm. ZA itself probably wouldn't have helped with this worm, since ZA would pop up a box asking if the program (MySQL) should be allowed to run as server. If the admin is going to allow blank passwords, they're probably not going to think twice about allowing it to run as server.

running as admin

[ghum]

I guess this idea of "privilege escalation" in one way or another is one of the reasons why PostgreSQL refuses to run as admin (especially on win32)

Re:running as admin

[jadavis]

Great point. In fact this topic was just discussed again on the PostgreSQL mailing lists, and the importance of running the database unprivileged was emphasized.

Not only that, what is the benefit of running a DB as root/Admin? If it didn't need port 80, I bet people wouldn't run apache as root either.

MySQL on Win32, market share

[HvitRavn]

No need to flame people who use MySQL on win32. This has been briefly mentioned already, but here's a slightly better explanation. One of MySQL's major advantages over other free medium-to-lightweight (such as pgsql) is that MySQL has been available for the win32 platform for a very long period of time (if you are about to mention firebird, take a look here). This enabled developers to install their webserver of choice (apache) with some cool script mod (php) alongside a database well suited for small to medium web projects (mysql). So if you are a supporter of (F)OSS, then you better not flame people who use MySQL on win32, because that is one of the reasons why MySQL is so popular today.

Re:MySQL on Win32, market share

[ckolar]

Interestingly I have made two software purchases that have used MySQL as a backend: SPSS Text Analysis for Windows as well as the new version of WebTrends. While I was happy to see the programs using an open backend, it was troubling that the installation processes assumed that mySQL was not running on the local box (as it was in my case), so the install process did not want to take into account such things as existing permissions schemes.

How I Found This

[Anonymous Coward]

I'm doing an audit of a 2000 machine and discover that it appears to have MySQL installed and is running a service for it. Which weirded me out, because I DEFINITELY don't run MySQL, I'm a POSTGRES guy.

It appears that some adware that had dropped itself on the machine had downloaded and installed it for me (one of my users is an idiot).

THEN the worm was able to load itself onto my machine.

Make sure to check all your machines, not just the ones that should have SQL running on them.

Clarification

[Zontar The Mindless]

3306 is the default port for MySQL, and the worm tries to use this port.

* If you need remote access to MySQL from within the same network, keep 3306 closed off at the firewall. And it won't hurt to use another port even so.

* If you do need to access a MySQL server from outside the same network, then you should definitely use something besides 3306.

* If you don't need to access MySQL remotely at all, then run mysqld with --skip-networking.

Re:Clarification

[DrSkwid]

* If you do need to access a MySQL server from outside the same network, then you should definitely use something besides 3306.

yes, security through obscurity keeps you asleep at night

because on port 12345 no one will ever find it

Re:Clarification

[Anonymous Coward]

Works against worms and script kiddies, though. Fucker.

Re:Clarification

[Zontar The Mindless]

yes, security through obscurity keeps you asleep at night

I'm not advocating security through obscurity.The worm uses port 3306, the default port for MySQL. It appears not to use any others. Therefore, if it can't access 3306, it can't get to your MySQL server.

By the same token, I wouldn't set up the root directory for IIS as C:\InetPub, either: it's known to every worm and script kiddie on the planet, is therefore the first point of attack, and using a different one will stop many attempts to compromise IIS before they can even begin. That doesn't mean that's the only precaution you should take to secure IIS, and using a port other than 3306 isn't the only step you should take in securing MySQL, either.

All that I'm saying is that blocking 3306 and/or using a different port is effective against this particular threat, not that it's some sort of panacea. Please re-read my original post before jumping to conclusions.

Re:Clarification

[DrSkwid]

I know why you advocated it, no re-reading necessary

why not move IIS onto port 908 ?

after all, every script kiddie on the planet will attack port 80 looking for IIS vulnerabilities ?

Why a PITA to admin?

[DarrenR114]

I find PostgreSQL to be quite easy to admin.

The large community argument is not really an advantage either - the MS-Windows community is MUCH larger than the Linux community, but I would not recommend any version of MS-Windows to even my worst enemy.

As for the toolset - to what are you referring?

Of course, Perl is much better at database support than PHP with its DBI:DBD combination from CPAN.

And everyone knows that anything you can do in PHP, you can do in Perl just as easily.

Re:Why a PITA to admin?

[outZider]

I agree with the Perl remark. ;)

For most database administrators with a clue, pg is just as easy to deal with as MySQL. For those who are MySQL's target market, pg is intimidating.

Not fairness

[m50d]

My linux box has been connected to the internet with a static IP and no firewall for around 6 months. I'm pretty sure it hasn't been rooted or zombied (no unusual network access, no ports open that shouldn't be when I nmap it, all files that should be there are there). I get around two attempts every second to connect to my SMB server, and every so often someone tries a dictionary attack, in which case I complain to their ISP. I've also had a couple of dictionary attacks on my ssh server. None of these got through, for the simple reason that I don't use weak passwords. I'm not sure how you're defining non-trivial, but I have a reasonable number of services running here. I keep everything updated, use long passwords, and don't have any problems. And I don't see why others can't do the same.

Odd target for attack

[fsck!]

Are there that many installations of MySQL on Windows? Usually, worms will target the most common installations, and up until this moment, I don't think I even knew MySQL was working on Windows. Are the flaws this thing uses to spread (if there's something beyond bad passwords) specific to the Windows port? I would be much more concerned if this thing was targeted at Linux or was cross-platform. I guess MySQL should be proud that they're ubiquitous enough to host this sort of attack.

Egress Filtering

[Anonymous Coward]

Why would you allow port 3306 outbound to the internet?

Why is is that proper egress filtering is not being mentioned? Everyone talks about "filtering" but forgets that it's both directions that you need to check.

IT IS NOT A WORM !

[Anonymous Coward]

Did you read the SANS description of the problem !!!!
The cracker have to find the password of the administrator of the database (by brute force with a dictionary).
Then mysql must be run with administrator privileges.
Then the cracker copy his application in the database.
Finally it use sql function to copu the application (a scanner to infect other pc) in the filesystem and execute it.
? Where is the mysql worm ?

SANS resume of the issue:
"This bot does not use any vulnerability in mysql. The fundamental weakness it uses is a week "root" account."

SANS solution: set a strong password for the root account. Who the hell will open the mysql server to the internet with a root password as "adminpwd" and then wonder why he is infected ...

Just a side note:
some of the infected pc had windows xp sp2 with firewall policies activated ...
Does windows firewall let everyone connect to your box by default ? with database, web servers ...
well switch firewall appli or better OS , mysql cannot help you

Alban Browaeys

Time to check auth.log and firewall rules...

[MyHair]

Jan 27 09:57:27 (fakehostname) mysqld[338]: refused connect from 217.224.(#).(#)
Jan 27 09:57:47 (fakehostname) last message repeated 21 times

(A few more like this were in the log.)

D'oh! Didn't realize I had it open. At least I'm on Linux and don't have a blatantly obvious root password. PostgreSQL installed with IP off by default; I guess MySQL didn't. I don't even rememeber why MySQL's installed...some php toy I guess. PostreSQL and MSSQL ports are already blocked even though I don't have MSSQL.

Time to update the firewall (dedicated and local), MySQL config and revisit password strength. Maybe I should finally go to a deny by default policy....

Password List?

[sho222]

The article on the SANS site states:

A long list of passwords is included with the bot, and the bot will brute force the password.

Does anyone know of a site that has posted this list? I believe my password is sufficiently secure, but it would be nice to have some idea of the scope of the character combinations that this bot tries.

Difference between admin and root?

[harmonica]

Why are there two administrator accounts, admin and root? I'm trying to find something in the docs (I was at http://dev.mysql.com/doc/mysql/en/default-privileg es.html already). Can someone point out the right place in the docs, or explain it in his own words?

Re:Difference between admin and root?

[Zontar The Mindless]

Why are there two administrator accounts, admin and root?

There aren't. Where did you get the idea that there are?

Re:Difference between admin and root?

[harmonica]

I found them in a Windows installation of ours. But I guess someone must have created an additional account "admin".

Re:Difference between admin and root?

[Zontar The Mindless]

That had to be what happened.

As other have remarked, it's not a bad idea to create a new account with all of root's privileges, then delete the root account.

Programming Fat Ass in Practice

[e2d2]

Today I got up, took a shit, showered, drove to work, ate breakfast, then proceeded to fix bugs until lunch. I ate a turkey sandwhich to show that I am trying to lose a little weight and then went back to work.

So what I'm saying is what the fuck does your post have to do with the price of rice in China? Probably about as much as it has to do with the MySQL exploit listed in the post.

That's what they get...

[Anonymous Coward]

... for running a Windows OS. Kudos to the virus/work/trojan writers for taking the time to get Microsofties out of my way on the internet :)

It's still Microsoft's fault!?

[Anonymous Coward]

When MSSQL had the problem, people complained that it was caused by more badly written Microsoft software.

Now when MySql has the same problem, is it the developers of MySql who we should blame? No, now it's Microsoft's fault for not writing a better OS for MySql!

How convenient...so, isn't anyone going to take a shot at the people actually exploiting the problem? Or, is it Microsoft's fault for creating the culture that influenced them, too?

localhost

[woddfellow2]

Does this apply to people running localhost servers?

Readable version

[Anonymous Coward]

http://shit.slashdot.org/article.pl?sid=05/01/27/1 546222

This is normal

[Pan T. Hose]

It sux to talk about it like this, especially considering I normally think in very logical secure steps. I've never been rooted before, and feel violated.

Don't worry, mate. We all feel that way for the first time. G'day.

MOD PARENT UP! :)

[Anonymous Coward]

OK, if you are not an Aussie, then you won't get it. I only got it after I reread the entire post when I saw the "g'day" and "mate" which seemed to not belong there. It made my day! :) If you still don't get it, here's a hint. G'day, mates! :)

Just made all that flak worth it

[Anonymous Coward]

We've gotten a lot of flak over PostgreSQL's restriction on not installing under user accounts with admin privileges. A lot of "Why can't I install as Administrator" complaints. A LOT.

The MySQL worm writers have just proven our point dramatically ... and hopefully MySQL AB will learn that it's worth putting up with a few user complaints for widespread security.

Josh Berkus
PostgreSQL Project

I was atacked by this on January 18th.

[miscbs]

Suposedly this is a "zero day attack." Which means, an attack on the same day the exploit is made public - January 27th,2005. THIS IS NOT TRUE! I gave access to my server to a friend as a favor. He provides my server with colocation services so I thought it was only fair to let him add a web page to it. I thought he knew what he was doing. Well, he added his an IP and his site but did not secure the new IP in the firewall. OOOOPPPPPPSSSSSS!! OK my bad - I counted on the firewall to protect me. OOOOPPPPPPSSSSSS!! The server was infected on the January 18th, 2005 in nearly the exact same method that is described for this "MySQL worm." It does have few differances, but it is the same thing. It is probably an earlier version. Long story short - I know the name of the hacker that made this worm. This January 27th worm is not the first version of this worm.