MySQL bot infecting servers

As reported on the Internet Storm Center site (http://isc.incidents.org) at
"bot" is traversing the Internet infecting MySQL servers installed on
Windows systems. Check out the description below:

"A "bot", exploiting vulnerable MySQL installs on Windows systems, has been
spotted. It infected a few thousand systems so far. Like typical for bots,
infected systems will connect to an IRC server. The IRC server will instruct
them to scan various /8 networks for other vulnerable mysql servers."

So if you have MySQL servers check out your firewall logs for the following
activity:

* Outbound activity to IPs: 212.105.105.214, 63.64.164.91, 63.149.6.91;
these are dynamic DNS IPs so they'll likely change with their domain names
(dummylandingzone.dns2go.com, dummylandingzone.hn.org,
dummylandingzone.dynu.com, zmoker.dns2go.com,
landingzone.dynu.com, landingzone.ath.cx, dummylandingzone.ipupdater.com)

* Outbound connection attempts on port 5002 and 5003

* Look for FTP servers popping up out of nowhere - bot creates one - scan
network for these

* Scan network for 2301 and 2304 - backdoors setup by bot; there may be
other ports

You'll find the security alert that Mysql.com issued for this worm at the address below. A word on detecting it:

Quote:

---

4. How do I know if my MySQL installation has been infected?

Run the following SQL statement: SELECT * FROM mysql.func;

If a UDF is found with a name of "app_result" then you have been infected with the worm.

You should look at all UDFs and determine whether or not they are legitimate. The worm is likely to mutate over time and will take on different UDF names.

---

http://dev.mysql.com/tech-resources/...ity_alert.html