New worm targets MySQL

By Damian Clarkson, ITWeb junior journalist

Johannesburg, 28 Jan 2005

Security experts have identified one of the first worms to target computers running the MySQL open source database software.

The worm, dubbed MySpooler by the SANS Internet Storm Centre, is one of the first known examples of an automated Internet threat targeting MySQL, says Justin Stanford, CEO of anti-virus vendor NOD32 South Africa.

MySQL is an open source database software program managed by MySQL AB. The product runs on Unix, Linux and Windows systems and is a popular alternative to Microsoft`s proprietary SQL Server database among Web developers.

According to the MySQL AB Web site, there are more than five million MySQL installations worldwide.

The worm is unlikely to prove widespread, as it can only infect machines by taking advantage of administrator accounts with weak or non-existent passwords, says Stanford. "It isn`t particularly high risk, as there are not many Windows machines with MySQL installed that have bad administrator passwords and public port access."

It will not affect many home users, but rather companies that operate MySQL on publicly accessible Windows servers, says Stanford. "They should ensure they have proper passwords set and that access to MySQL`s port 3306 is blocked."

The worm cracks accounts by trying values from a predefined list of around 1 000 possible passwords.