Root access to MySQL.com sold for $3k - now serving malware

I'm pretty sure they're exhibiting confusion about the JVM vs. the browser plugin.

Lately, yes. Over the last couple of years (Read: after Microsoft mostly cleaned up its act), Java has been been one of the primary sources of client exploits, along with Adobe products.

I don't know that there's anything special wrong with it other than that anything deployed widely enough makes a good target.

Edit: here's one sample article from last year:

http://isc.sans.edu/diary.html?storyid=9916

Did you update all your Java installations – client and server – to at least Java 6 update 26 in June 2011?

There were a dozen "unauthorized Operating System takeover including arbitrary code execution" bugs fixed at that time, some exploitable via untrusted applets, others via tricking server installs to submit certain data to standard APIs:

http://www.oracle.com/technetwork/topics/security/javacpujun...

The problem is, how do you both

(1) Avoid obvious detection in the compromised software?

(2) Put in something that you can actually use for exploits? You have access to many hosts, but how many different configurations are there?

The only thing I can think of is have profiles for several popular packages (e.g. wordpress), and package-specific behavior for them.

Pretty sure he meant "rooted" in the sense of "inserted exploits into the codebase". In some sense that's much worse that mere root access to the host. Such a database could, for example, phone home with all updates to tables named "passwords", etc...

And even in the more banal sense you interpreted, sure: you might not run mysql.com-sourced daemons as root. But you almost certainly run the mysql command line utility as root from time to time.

Did you only look at 1/3 of the screenshot or did they update the article?

The screenshot shows

http1

http2

http3

with a root shell on each. Are there more than 3? Maybe. Maybe not.

Mysql.com has nowhere near 12m daily uniques.

> “It exploits the visitor’s browsing platform (the browser, the browser plugins like Adobe Flash, Adobe PDF, etc, Java, …)

Both Java and Flash. Java was more dangerous, but still...

I always browse with all plugins and java disabled. If a site uses Flash, I typically will just move on unless it's something absolutely essential to what I'm doing. Surprising how many sites that use Flash don't have any usable fallback for clients that don't support it or have it disabled.

I don't think I've come across a Java applet in the last 5 years. I see NO need to allow Java in the browser unless it's for a trusted, internal-use application.

Well, currently the malware itself is not detected. OK, some anti-virus solutions detect the piece of malware as suspicious or as a packed executable (which is suspicious of course). But those detections are just based on the inner working of the executable or how it behaves. It's not being detected by anti-virus definitions, that will be a matter of time before anti-virus providers will add definitions for this piece of malware.