From: John Aldrich ------------------------------------------------------ FYI, I saw this on another list... thought I'd pass it along... ---------- Forwarded Message ---------- Subject: Headsup ! MySQL.com Serves Malware Date: Mon September 26 2011, 5:11:10 PM From: Stu Sjouwerman To: "NT System Admin Issues" MySQL.com Sold for $3k, Serves Malware Warm regards, Stu http://krebsonsecurity.com/2011/09/mysql-com-sold-for-3k-serves-malware/ A security firm revealed today that mysql.com, the central repository for widely-used Web database software, was hacked and booby-trapped to serve visitors with malicious software. This disclosure caught my eye because just a few days ago I saw evidence that administrative access to mysql.com was being sold on the hacker underground for just $3,000. Web security firm Armorize stated in its blog that mysql.com was poisoned with a script that invisibly redirects visitors to a Web site that uses the BlackHole exploit pack, an automated exploit toolkit that probes visiting browsers for a variety of known security holes. "It exploits the visitor's browsing platform (the browser, the browser plugins like Adobe Flash, Adobe PDF, etc, Java, ...), and upon successful exploitation, permanently installs a piece of malware into the visitor's machine, without the visitor's knowledge," say the researchers. "The visitor doesn't need to click or agree to anything; simply visiting mysql.com with a vulnerable browsing platform will result in an infection." Late last week, I was lurking on a fairly exclusive Russian hacker forum and stumbled upon a member selling root access to mysql.com. As part of his pitch, which was published on the criminal forum Sept. 21, the seller called attention to the site's daily and monthly stats, and posted screen shots of a root login prompt in a bid to prove his wares. The seller, ominously using the nickname "sourcec0de," points out that mysql.com is a prime piece of real estate for anyone looking to plant an exploit kit: It boasts nearly 12 million visitors per month -- almost 400,000 per day -- and is ranked the 649th most-visited site by Alexa (Alexa currently rates it at 637). ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ ~ --- To manage subscriptions click here: http://lyris.sunbelt- software.com/read/my

=============================================================== From: Ryan Bales ------------------------------------------------------ mysql.com delivering malicious software... Isn't that redundant? ~Ryan Bales

=============================================================== From: Lisa Ridley ------------------------------------------------------ I thought that was just Oracle in general=85.:/ wrote: http://krebsonsecurity.com/2011/09/mysql-com-sold-for-3k-serves-malware/ serve because browsers without to forum mysql.com. root kit: -- at

=============================================================== From: Stephen Kraus ------------------------------------------------------ This is news? wrote: without kit:

=============================================================== From: Adam Jimerson ------------------------------------------------------ No but the fact that it took Oracle this long to relicense MySQL is news, figured that would have been one of the first things they did (besides adding alot of bugs and security holes). Source http://monty-says.blogspot.com/2011/09/oracle-adding-close-source-extensions.html