News Stay informed about the latest enterprise technology news and product updates.

New malcode targets MySQL

Forbot-DY exploits two Windows flaws, targets MySQL and attempts to create zombie PCs.

A new variant of Forbot exploits two Windows vulnerabilities, targets MySQL and attempts to create an army of zombie...

PCs that could be used to launch denial-of-service attacks and other mischief.

Lynnfield, Mass.-based antivirus firm Sophos Inc. said W32.Forbot-DY targets MySQL open-source database software on Windows systems connected to the Internet. MySQL is a popular alternative to Microsoft's SQL Server database software, and Sophos estimated there are more than 5 million installations globally.


 ISC said network administrators can protect their systems by:

-Selecting a strong password, especially for "root" accounts.

-Restricting root accounts so that they are only allowed to connect from the local host.

-Applying firewall rules. "MySQL servers should not be exposed to the 'wild outside.' Block port 3306 and only allow access from selected hosts that require such access

"System administrators should ensure that the computers under their care are properly protected with the latest antivirus software, sensible firewall configurations and up-to-date security patches," Graham Cluley, senior technology consultant for Sophos, said in a statement. "If you take the necessary steps then malicious malware will find it as hard to spread as frozen butter."

He added: "The Forbot worm uses brute force to try and break into systems with weak passwords. The message to system administrators is clear: Beef up your passwords now to stop these kinds of attacks from being possible."

It also exploits the RPC-DCOM and LSASS vulnerabilities in Windows. Microsoft released patches for the flaws in September 2003 and April 2004, respectively.

The MySQL Web site has posted further details on the threat, as has the Bethesda, Md.-based Internet Storm Center (ISC). According to the ISC, the malicious code has infected a few thousand systems so far.

Infected systems will connect to an Internet Relay Chat (IRC) server, the ISC said. The IRC server will then instruct the zombie machines to scan various networks for other vulnerable MySQL servers.

Dig Deeper on Malware, virus, Trojan and spyware protection and removal



Find more PRO+ content and other member only offers, here.

Start the conversation

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.







  • CIO Trends #6: Nordics

    In this e-guide, read how the High North and Baltic Sea collaboration is about to undergo a serious and redefining makeover to ...

  • CIO Trends #6: Middle East

    In this e-guide we look at the role of information technology as the Arabian Gulf commits billions of dollars to building more ...

  • CIO Trends #6: Benelux

    In this e-guide, read about the Netherlands' coalition government's four year plan which includes the term 'cyber' no fewer than ...