Root access to MySQL.com sold for $3k - now serving malware(krebsonsecurity.com)
krebsonsecurity.com
Root access to MySQL.com sold for $3k - now serving malware
http://krebsonsecurity.com/2011/09/mysql-com-sold-for-3k-serves-malware/
49 comments
Get off your high horse. An installation of the JRE on Windows will install the Java VM, plugins for several browsers, a Java update scheduler, the Java Web start framework, a control panel and a bunch of other related utilities. In other words, a software suite.
Well from the point of view of your typical end users, Java is just a random bit of software.
Java has security problems? That is surprising to me.
I have always considered it a relatively secure platform... am I so wrong?
I have always considered it a relatively secure platform... am I so wrong?
Did you update all your Java installations – client and server – to at least Java 6 update 26 in June 2011?
There were a dozen "unauthorized Operating System takeover including arbitrary code execution" bugs fixed at that time, some exploitable via untrusted applets, others via tricking server installs to submit certain data to standard APIs:
http://www.oracle.com/technetwork/topics/security/javacpujun...
There were a dozen "unauthorized Operating System takeover including arbitrary code execution" bugs fixed at that time, some exploitable via untrusted applets, others via tricking server installs to submit certain data to standard APIs:
http://www.oracle.com/technetwork/topics/security/javacpujun...
I've had the Java plugin disabled in firefox for a long time now. On the very rare occasions I need it, you can re-enable it without restarting the browser (unlike extensions.)
Lately, yes. Over the last couple of years (Read: after Microsoft mostly cleaned up its act), Java has been been one of the primary sources of client exploits, along with Adobe products.
I don't know that there's anything special wrong with it other than that anything deployed widely enough makes a good target.
Edit: here's one sample article from last year:
http://isc.sans.edu/diary.html?storyid=9916
I don't know that there's anything special wrong with it other than that anything deployed widely enough makes a good target.
Edit: here's one sample article from last year:
http://isc.sans.edu/diary.html?storyid=9916
I'm pretty sure they're exhibiting confusion about the JVM vs. the browser plugin.
Agreed - this has very little to do with the JVM and server-side Java processes.
Java applets.. shudder
Java applets.. shudder
A bug (exploit) in the JVM is a bug, it doesn't matter if you are running it server side or client side.
The only reason it doesn't matter server-side is that you are not trying to exploit your own installation. But the bug is still there.
The only reason it doesn't matter server-side is that you are not trying to exploit your own installation. But the bug is still there.
Of course, the JVM is the JVM wherever it runs, but when one is under the impression of a blanket statement like "Java is secure", they're likely to be thinking of server-side processes which rarely get compromised for reasons you've stated - despite having the same "level of security" wrt vulnerabilities.
You don't know that. Depending on the type of bug (for example a string overflow) simply accepting data from someone else could trigger it.
It seems like they could have done a lot more damage than just serving browser malware. How many mysql installs could they have rooted?
I think the point was that most of the visitors to mysql.com are developers and system administrators, and compromises to their machines can probably be leveraged into compromises of other sites. I doubt we've heard the last of this.
The problem is, how do you both
(1) Avoid obvious detection in the compromised software?
(2) Put in something that you can actually use for exploits? You have access to many hosts, but how many different configurations are there?
The only thing I can think of is have profiles for several popular packages (e.g. wordpress), and package-specific behavior for them.
(1) Avoid obvious detection in the compromised software?
(2) Put in something that you can actually use for exploits? You have access to many hosts, but how many different configurations are there?
The only thing I can think of is have profiles for several popular packages (e.g. wordpress), and package-specific behavior for them.
Doing this operation require quite an effort. And you do not really know how long it will take till this root access will be fixed (you can not really trust random vendor on hackers forum, this post could be searchable through google by mysql admins, some internal audit program could detect intrusion.)
So easiest to monetize - insert malware to put trojan on visitors machines. Next - hack in to their bank accounts, or use these as part of bot net or whatever. You basically got highly visited place to put classic malware.
The point is... To do such things as replacing mysql source flawlessly is hard, do not underestimate efforts needed to do that.
So easiest to monetize - insert malware to put trojan on visitors machines. Next - hack in to their bank accounts, or use these as part of bot net or whatever. You basically got highly visited place to put classic malware.
The point is... To do such things as replacing mysql source flawlessly is hard, do not underestimate efforts needed to do that.
The attackers were focussing on client workstations to infect with malware, that's where the big money is. Potentially they could have owned some mysql installs by replacing installer binaries but it's less interesting for banking fraud etc.
MySQL.com was successfully attacked earlier this year: http://developers.slashdot.org/story/11/03/27/2058246/mysqlc...
MySQL.com was successfully attacked earlier this year: http://developers.slashdot.org/story/11/03/27/2058246/mysqlc...
I think that they just have access to 1 or more web servers. The hostname in the screenshot is http3.web.mysql.com. An organization like Oracle would presumably have multiple levels of security. It's likely the web servers would run in a DMZ, i.e. the lowest level of security.
Did you only look at 1/3 of the screenshot or did they update the article?
The screenshot shows
http1
http2
http3
with a root shell on each. Are there more than 3? Maybe. Maybe not.
The screenshot shows
http1
http2
http3
with a root shell on each. Are there more than 3? Maybe. Maybe not.
Uh...
Would not the machines rooted with these exploits be likely to be used to log into many mysql installs?
Would not the machines rooted with these exploits be likely to be used to log into many mysql installs?
Don't even the most basic MySQL install tutorials have you create a separate user and group for the database user?
If you're running MySQL as root, you're trying hard to get owned.
If you're running MySQL as root, you're trying hard to get owned.
Pretty sure he meant "rooted" in the sense of "inserted exploits into the codebase". In some sense that's much worse that mere root access to the host. Such a database could, for example, phone home with all updates to tables named "passwords", etc...
And even in the more banal sense you interpreted, sure: you might not run mysql.com-sourced daemons as root. But you almost certainly run the mysql command line utility as root from time to time.
And even in the more banal sense you interpreted, sure: you might not run mysql.com-sourced daemons as root. But you almost certainly run the mysql command line utility as root from time to time.
The Armorize screencast embedded in the article is really wonderful. It's concise, full of information, and clear enough to duplicate the steps on your own. A nice 5-minute detective story.
This whole mysql saga was an excellent reminder to turn Java off again. I'd enabled it a few weeks ago for a site that I simply had to use and then promptly forgot to disable it afterwards.
If you use Firefox, the NoScript add-on has the option to block Java applets from any sites that you haven't specifically marked as being trusted. It can also block unwanted JavaScript, Flash, Silverlight and other plugins. (http://noscript.net)
Without actually registering on the site to verify, it looks like that's the Exploit.IN forum.
I've never seen a $$ number associated with these things, but really? Only $3K?
Apparently, I would have overbid if I were in the market for such things.
Apparently, I would have overbid if I were in the market for such things.
Well, it may be that the frightening reality is such that supply is so abundant that a single site with 12m dailies doesn't demand the prices one might expect.
edit: 12m monthlies, sorry.
edit: 12m monthlies, sorry.
its hard to say, but generally the public postings like that are a cover up to cover tracks.
you might imagine that no one ever puts such offer on public (or private with everyone having access to it) kind of boards.
its a very usual thing to do, at least, back in the day <strikeout>we</strikeout> they were doing that every time we weren't 200% sure of our tracks or for highly advertised targets (yeah you risk less hacking a whole ISP than you do hacking a nooby site such as mysql.com)
you might imagine that no one ever puts such offer on public (or private with everyone having access to it) kind of boards.
its a very usual thing to do, at least, back in the day <strikeout>we</strikeout> they were doing that every time we weren't 200% sure of our tracks or for highly advertised targets (yeah you risk less hacking a whole ISP than you do hacking a nooby site such as mysql.com)
It wasn't sold for $3K, as far as I can tell. The screenshot linked to reads "Don't bother calling if you don't have $3K". Now that might mean asking price or it might mean an order of magnitude, but it certainly seems like the domain was positioned as on auction.
You also have to figure it's very temporary root access, until a real root user repairs it from an uncompromised offline backup. It's not like they're selling the entire MySQL site in perpetuity for $3k.
Why is it that Flash is so exploitable? The web is rampant with Flash exploits and Adobe seems to do nothing about it.
Because plugins run under their own process. Not subject to the sandboxing you'd find in Chrome/Safari for instance. Plugins are given pretty high trust.
I always browse with all plugins and java disabled. If a site uses Flash, I typically will just move on unless it's something absolutely essential to what I'm doing. Surprising how many sites that use Flash don't have any usable fallback for clients that don't support it or have it disabled.
I don't think I've come across a Java applet in the last 5 years. I see NO need to allow Java in the browser unless it's for a trusted, internal-use application.
I don't think I've come across a Java applet in the last 5 years. I see NO need to allow Java in the browser unless it's for a trusted, internal-use application.
Good move. I suppose the most vulnerable are those driving desks being forced to use IE7, Standard Operating Environment that runs these plugins or some internal business application requires them.
This was a Java Exploit.
> “It exploits the visitor’s browsing platform (the browser, the browser plugins like Adobe Flash, Adobe PDF, etc, Java, …)
Both Java and Flash. Java was more dangerous, but still...
Both Java and Flash. Java was more dangerous, but still...
I decoded the scripts on some recent WordPress blogs that were hacked. It would try to exploit Java first, then Flash if that didn't work, and then a couple other things if I recall correctly.
Flash is likely the single most installed software in the world. Consider how many Windows, Mac, and Linux desktops and Android devices have Flash. Thus, Flash is an extremely popular target for bad guys.
I went to mysql.com this morning and Symantec popped up with a "malware detected" message. Do we know which browsers are vulnerable, and how to tell whether I'm infected?
Have a look at the movie that's embedded in the blog post. He's explaining which piece of malware is downloaded.
This link lists the AV packages that can currently detect the installed malware:
https://www.virustotal.com/file-scan/report.html?id=d761babc...
https://www.virustotal.com/file-scan/report.html?id=d761babc...
Well, currently the malware itself is not detected. OK, some anti-virus solutions detect the piece of malware as suspicious or as a packed executable (which is suspicious of course). But those detections are just based on the inner working of the executable or how it behaves. It's not being detected by anti-virus definitions, that will be a matter of time before anti-virus providers will add definitions for this piece of malware.
[deleted]
Great..! Now nobody will visit MySQL page and the downloads number will do down significantly. Yet another way to kill a community product!!
In reality - how many people actually downloaded it from the website, rather than running "{yum/apt-get} install mysql-server"? The documentation is a different issue - probably much more popular than downloads themselves.
Seriously, I'm not a fan of Java, but still, a software suite?
Anyway, it's quite hard taking that article seriously after that.