Handlers Diary January 27th 2005Updated January 27th 2005 17:07 Utc (Handler: Deb Hale)
* MySQL BOT
MySQL Bot A "bot", exploiting vulnerable MySQL installs on Windows systems, has been spotted. It infected a few thousand systems so far. Like typical for bots, infected systems will connect to an IRC server. The IRC server will instruct them to scan various / 8 networks for other vulnerable mysql servers. Infection Method The bot uses the "MySQL UDF Dynamic Library exploit". In order to launch the exploit, the bot first has to authenticate to mysql as 'root' user. A long list of passwords is included with the bot, and the bot will brute force the password. Once connected, the bot will create a table called 'bla' using the database 'mysql'. The 'mysql' database is typically used to store administrative information like passwords, and is part of every mysql install. The only field in this database is a BLOB named 'line'. Once the table is created, the executable is written into the table using an insert statement. Then, the content of is written to a file Called 'App_Result.dll' USIN g 'select * from bla into dumpfile "app_result.dll"'. The 'bla' table is dropped once the file is created. In order to execute the 'app_result.dll', the bot creates a mysql function called 'app_result' which uses the 'app_result.dll' file saved earlier This function is executed, and as a result the bot is loaded and run Post Infection Behavior The bot will now try to connect to one out of a number of IRC servers:.. dummylandingzone.dyndns ......................................................
212.105.105.214zmoker.dns2go.com -> 63.64.164.91landingzone.dynu.com -> 212.105.105.214landingzone.ath.cx -> 212.105.105.214dummylandingzone.ipupdater.com -> 212.105.105.214 The bot will connect to the IRC server on port 5002 or 5003. At this point, the IRC servers appear busy and unable to accept new connections. Note that dynamic DNS services are used. The IP addresses will likely change. Last time we where able to connect, about 8,500 hosts where Connected to the Irc Server. The Bot Will Connect To a Channel Called '#RampenStampen' Using The Key 'Gratisporn'. The topic of the channel is set to '! adv.start mysql 80 10 0 132.xxx -a -r - s'. This will instruct the bot to scan random ips in '132.0.0.0/8' for mysql server. Throughout our observation, the topic was changed regularly. to be scanned networks included 10.0.0.0/8, likely an attempt to infect Other MySQL Servers Withnin a local network this is otherwise protected by a firewall. so far, the bothaas been Identified As a Versio n of 'Wootbot'. It appears to include the usual set of bot features like a DDOS engine, various scanners, commands to solicit information from infected systems (eg system stats, software registration keys and such). The bot provides an FTP server, and a backdoors (details later. Appears to be listening on port 2301 / tcp and 2304 / tcp, maybe other ports). Mitigation This bot does not use any vulnerability in mysql. The fundamental weakness it uses is a week 'root' account. The Following Mitigation Methods Will Prevent Exploitation: STRONG Password: SELECT A STRONORD Password, in particular for the 'root'
