Slashdot Mirror
Mysql.com Hacked, Made To Serve Malware
Orome1 writes "Mysql.com was compromised today, redirecting visitors to a page serving malware. Security firm Armorize detected the compromise through its website malware monitoring platform HackAlert, and has analyzed how the compromise of the site's visitors unfolded. The mysql.com website was injected with a script that generates an iFrame redirecting the visitors to a page where the BlackHole exploit pack is hosted."
According to Brian Krebs, the exploit used to compromise the site was being shopped around last week for $3,000.
Blame Oracle.
Someone, a week ago, before anything bad actually happened, was openly selling the fact that mysql was cracked, and anyone seeing the ad knew it, but HackAlert is taking credit for "discovering" the cracking after something bad actually happened?
How about if HackAlert, instead of crawling the web looking for whatever pattern of deviation defines its detection of a hack, crawls the blackhat markets for ads for open access to presumed secure sites.
If they aren't doing that already, and crocking their detection speed...
little Bobby Tables is disappointed.
If the website redirects to an iframe (I thought these got phased out in like HTML4???) and tries to install malware, and there is no user interaction involved... what exactly is the browser doing?
Being really stupid...
http://antivirus.about.com/od/virusdescriptions/p/Blackhole-Exploit-Kit.htm
On that note, noscript, greasemonkey w/ script, and any addon that allows the blocking of the iframe tag should keep you safe, but then again how often do you visit mysql.com? :)
If SQLi took down MySQL there's a pun about "hackception" here somewhere.
http://www.pcworld.com/businesscenter/article/240609/mysqlcom_hacked_to_serve_malware.html Article says the site was already fixed as of 11am PST.
I can only assume that mysql.com was running whatever raw sql queries the browser was submitting, but did you know that you can actually rewrite these to include a semicolon (terminating the query) and then whatever new query you want? Obviously, you can't rely on nobody thinking to do this, and the fact that mysql was hacked is just evidence that you should not expose mysql over the Internet.
I watched the video on the page, showing the step-by-step of the exploit working, and the trace of what it did.
Informative and interesting.
Seems if a person did _not_ have java enabled in their browser, then the attack would have failed.
Uh, Linux geek since 1999.
All three members of the FSF appreciate the correction.
Advice: on VPS providers
If you've disabled plugins, then how would you be compromised by that plugin?
The stories and info posted here are artistic works of fiction and falsehood.
Only fools would take it as fact.
Someone was shopping around the exploit used to hack the company's website - I am sure it had little to do with MySQL software unless it was an injection that got them access to change the site.
If the only way you can accept an assertion is by faith, then you are conceding that it can't be taken on its own merits
Now instead of serving malware directly it redirects to a site serving malware.
The disclosure caught my eye because just a few days ago I saw evidence that administrative access to mysql.com was being sold in the hacker underground for just $3,000.
At what point should Mr. Krebs have felt some sort of obligation to inform the owners of mysql.com that their root login was being actively shopped?
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
I ain't taking any security certification from them... the MySQL 1&2 was enough.
It was really just a matter of time before Oracle started trying to force MySQL users to move to their expensive proprietary solutions. It just happened a bit....What's that? ........
Oh, NEVERMIND!
I would laugh (hard) if the exploit involved SQL injection.
If I hadn't been modded down, you'd be reading this right now.
... has been hacked by Amazon
slashdot frenzy erupts in 3... 2... 1...
That's GNU/Cracked, thank you.
Sorry, did I miss something here? Could you please elaborate on your claim? I would be most interested to learn how MySQL does not qualify as an SQL RDBMS.
And as for your link. It even states that MySQL is one of the actual SQL RDBMS' available and not a noSQL sysstem.
IT Admins Group: Where you decide the content
You are so damn right that it ain't funny anymore.
Why is it that this W3C thing is pushing active content upon users, in spite of knowing better.
"Yes, yes, we have a sandbox, therefore we are secure!" is the stupid phrase I'm tired of hearing since the first days of the Java Virtual Machine.
Sandbox, my ass.
Just quit using Mickey$ofts CRAPWARE.
just wanted to make a dirty joke about exposing mysql over the intern but it was lost.
Truth be told it has started with a SQL-injection a few months ago and there was a web-shell available in semi-private access. Just recently the sourcec0de (newly registered member of an underground forum) posted that he sells the root shell for mysql.com. The kernel was pwned with a local exploit. The attacker also claimed that he modified the back-ups which I don't really believe.
Now, that fool who spent $3k and put BlackHole exploit kit directly (well with one redirect) seems to have no understanding of how to convert traffic or what to do with such a valuable item as mysql.com. (next time put backdoors into sources and use TDS before using an exploit kit, n00b)
I mean come on, the malware wasn't FUD (4/34). On a website with this amount of traffic it will be detected (and it was) within hours if not minuets.
This situation shows again that sysadmins shouldn't be lazy and do their jobs... http://www.habrastorage.com/images/msqlrootsa.png screenshot of the forum post.
Mysql serving malware, I don't see how's that news.
The Oracle merger is months old already...
He’s no longer a fetus. Republicans only care about you before you’re born. http://www.coolmonclerclothing.com/