RE: MySQL hits...

might this help ?? 


see http://dev.mysql.com

FEATURE ARTICLE
Securing a MySQL Server on Windows
At the end of January 2005 a new worm-like malware named Forbot spread
across the Internet, targeting poorly configured MySQL installations and
exploiting them to gain access to the Windows host machines. MySQL takes
security very seriously and we are working on a set of proactive services to
help alert you to bugs, security issues and new features.

Read the article >

More Articles >   Forums > 


> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of 
> [email protected]
> Sent: February 5, 2005 10:01
> To: [email protected]
> Subject: [Intrusions] MySQL hits...
> 
> 
> All...
> 
> I have been hit with 1047 mysql sessions on THP!  The bulk of the 
> hits came at 0929 EST and continued until 1051.  I have attached the 
> SYNs.  Is there a new MYSQL exploit, or was this guy just beating his 
> head against a wall?
> 
> B.
> 
> On 20 Jan 2005, this text appeared purporting to belong to Jason
> 
> From:           	"Jason \"JC\" Monroe" <[email protected]>
> To:             	"Intrusions List (GCIA Practicals)" 
> <[email protected]>
> Date sent:      	Thu, 20 Jan 2005 22:38:46 -0800
> Subject:        	[Intrusions] Re: Summary of large-scale 
> portscanning detects
> Send reply to:  	"Intrusions List \(GCIA Practicals\)" 
> <[email protected]>
> 	<mailto:[email protected]?subject=unsubscribe>
> 	<mailto:[email protected]?subject=subscribe>
> Keywords:       	
> > On Thu, 2005-01-20 at 19:26, [email protected] wrote:
> > > The following extracts show the beginning and ending of scan 
> > > activity was detected on my network.  The number 
> following each set 
> > > is the total number of probes for that source.  Timestamps are 
> > > GMT-0600.
> > > 
> > > Jan 19 06:01:54 68.164.218.138:2433 -> xxx.yyy.1.1:3306 
> SYN ******S*
> > > Jan 19 06:01:54 68.164.218.138:2434 -> xxx.yyy.1.2:3306 
> SYN ******S* 
> > 
> > 
> > The only tools that I've located have been mysqlf**k and 
> another brute 
> > forcer. Has anyone else found evidence of a MySQL based worm?
> > 
> > Thanks,
> > 
> > JC
> > _______________________________________________
> > Intrusions mailing list
> > [email protected] 
> > http://www.dshield.org/mailman/listinfo/intrusions
> 
> 
> 
> 
> __________ NOD32 1.992 (20050205) Information __________
> 
> This message was checked by NOD32 antivirus system. 
> http://www.nod32.com
> 
> 

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions