Slashdot Mirror
Mysql.com Hacked, Made To Serve Malware
Orome1 writes "Mysql.com was compromised today, redirecting visitors to a page serving malware. Security firm Armorize detected the compromise through its website malware monitoring platform HackAlert, and has analyzed how the compromise of the site's visitors unfolded. The mysql.com website was injected with a script that generates an iFrame redirecting the visitors to a page where the BlackHole exploit pack is hosted."
According to Brian Krebs, the exploit used to compromise the site was being shopped around last week for $3,000.
I for one blame poor security.
Someone, a week ago, before anything bad actually happened, was openly selling the fact that mysql was cracked, and anyone seeing the ad knew it, but HackAlert is taking credit for "discovering" the cracking after something bad actually happened?
How about if HackAlert, instead of crawling the web looking for whatever pattern of deviation defines its detection of a hack, crawls the blackhat markets for ads for open access to presumed secure sites.
If they aren't doing that already, and crocking their detection speed...
little Bobby Tables is disappointed.
If the website redirects to an iframe (I thought these got phased out in like HTML4???) and tries to install malware, and there is no user interaction involved... what exactly is the browser doing?
Being really stupid...
http://antivirus.about.com/od/virusdescriptions/p/Blackhole-Exploit-Kit.htm
On that note, noscript, greasemonkey w/ script, and any addon that allows the blocking of the iframe tag should keep you safe, but then again how often do you visit mysql.com? :)
http://www.pcworld.com/businesscenter/article/240609/mysqlcom_hacked_to_serve_malware.html Article says the site was already fixed as of 11am PST.
I believe it was a multi-tiered attack in that Java, Flash, and PDF exploits were all tried. What is shown in the video is that the Java attack was successful.
Someone was shopping around the exploit used to hack the company's website - I am sure it had little to do with MySQL software unless it was an injection that got them access to change the site.
If the only way you can accept an assertion is by faith, then you are conceding that it can't be taken on its own merits
The disclosure caught my eye because just a few days ago I saw evidence that administrative access to mysql.com was being sold in the hacker underground for just $3,000.
At what point should Mr. Krebs have felt some sort of obligation to inform the owners of mysql.com that their root login was being actively shopped?
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
I would laugh (hard) if the exploit involved SQL injection.
If I hadn't been modded down, you'd be reading this right now.
A while back, I decided I don't need java, adobe acrobat or flash on my work machines (too much attack surface).
My philosophy is that you disable/uninstall everything and the switch it back on when you need it. Sometimes it is a pain, but it is better than browsing the net with a big "kick me" sign on your virtual back.
I found it strange that the Krebs on Security site linked in the summary would state that we should avoid using Java for security reasons, but then assume that we would be able to view an embedded youtube video on his page. Surely anyone interested in security would just link to the youtube page rather than hope we all allow flash to run on unknown websites.
If I hacked a website, and knew that it would eventually be exposed, I would announce the infection myself with a helpful flash video that was also a virus exploit. You could double the infection rate with such a scam.
You don't need java to view the youtube video, it uses javascript.
It actually required Adobe Flash in my browser. All I got was a black square because I locked down my security settings to only allow Flash on whitelisted sites.
I was not suggesting that YouTube uses Java, but that his comment was an indication that we should eliminate use of software with known security problems and that expecting his audience to run plug-ins on his site went against his advice. I should have been more clear about that point.
All he needed to do was include a link to the YouTube page along with the embedded video so that people who care about security could see the video without having to view the source to grab the address.
Good thing HTML5 won't need all those things to run code on your machine.
The fuck are you doing running Fedora in a enterprise environment?
-- Linux user #369862