Root access to site offered on black market.
Yesterday, mysql.com, the official website of the popular database management system
MySQL
, was hacked and visitors to the website were at risk of being infected with malware.
The hack of popular websites is nothing new, and with such sites serving as the shop windows of the organisations behind them, it is little surprise that such website hacks make for big headlines. However, as perhaps
best expressed
by the
xkcd
comic, a simple hack does not say much in itself and may be little more than a nasty prank.
However, the situation is a lot worse when a website is not superficially defaced – appearing unaltered on the surface – yet serves malware behind the scenes. This is what happened to
mysql.com
: the website was modified to include a small JavaScript file hosted on the same server. This file generated an iframe which contained a URL that redirected to another URL. This final URL contained the ‘BlackHole’ exploit pack.
This exploit pack tries to infect the user via known vulnerabilities in the browser and plug-ins including Flash and Java. There is some irony in the use of Java by this particular exploit pack, as security journalist Brian Krebs points out: both
MySQL
and Java are owned by the same company,
Oracle
.
It is unknown how the attackers gained access to mysql.com’s servers and whether they used an SQL-injection (as they did earlier this year when the site was also hacked). However, it may well be that this time the attackers gained full access to the servers: last week root access to the servers was being offered on a Russian hacker forum for US$3,000. With the website attracting 400,000 visitors a day, it is not hard to see how someone with bad intentions could monetize root access.
For end-users and system administrators alike, the lesson to take from this story is the importance of running up-to-date and fully patched versions not only of the web browser but also of all plug-ins and add-ons.
More at
Armorize
‘s blog
here
with comments from Brian Krebs
here
.
Posted on 27 September 2011 by
Virus Bulletin
Leave a Reply