MySQL table suddenly disappeared and a func table was created
4 Message(s) by 4 Author(s) originally posted in mysql database
| From: wongwaichi |
Date: Monday, April 02, 2007
|
Hi, everyone. I am not sure if I am writing in the correct group. But
somehow it relates to MySQL, I hope someone can help me.
I am working on a web site which is developed by PHP and MySQL,
host ed
by a hosting company. Last week, all
table s in MySQL suddenly
disappeared and a "func" table is created there. I never create that
table in my
data base.
I asked the Hosting company what happened. The staff claimed that
most probably my computer was hacked and someone use the
admin
password to
delete all the tables. Or another possiblity is someone
use
SQL injection to grab the database
control through the web site.
So I follow their instruction to check my web log to see if any
suspected access and also I checked my
program if there is
hole for
SQL injection. But seems that isn't the reason. Then I checked if
my computer is hacked. No signal that my computer was hacked.
Now they helped me to restore the database. But since the reason is
still unknown. It may happen again. I am wondering if anyone had
same problem before. I am appreciate if any
feedback on this issue.
I really want to know the reason for the problem and try to prevent
it.
My local environment:
MacBook with Mac OS X 10.4.9
Using Aqua Data Studio to
connect remote MySQL
Thanks for advanced.
Priscilla
| From: gordonb.1vcx6 |
Date: Tuesday, April 03, 2007
|
I am working on a web site which is developed by PHP and MySQL, hosted
by a hosting company. Last week, all tables in MySQL suddenly
disappeared and a "func" table is created there. I never create that
table in my database.
"func" is a table that appears in the "mysql" database to
support
user-defined functions. Or it could be something entirely unrelated
except for the name.
I asked the Hosting company what happened. The staff claimed that
most probably my computer was hacked and someone use the admin
password to delete all the tables. Or another possiblity is someone
use SQL injection to grab the database control through the web site.
Possible. You do have backups, do not you? Of the site, the database,
*AND* the hosting company.
So I follow their instruction to check my web log to see if any
suspected access and also I checked my program if there is hole for
SQL injection. But seems that isn't the reason. Then I checked if
my computer is hacked. No signal that my computer was hacked.
Now they helped me to restore the database. But since the reason is
still unknown. It may happen again. I am wondering if anyone had
same problem before. I am appreciate if any feedback on this issue.
I really want to know the reason for the problem and try to prevent
it.
There are a number of unlikely WHOOPS!! happenings that could happen.
A sector going bad or getting scribbled on during a power failure
(or employee tripping over power cord, or resetting the wrong
machine ) could account for it.
Do you know what OS the MySQL
server machine is running?
| From: Bill F |
Date: Friday, April 06, 2007
|
That's kinda curious that you web host's first suggestion'd be they
were cracked. I'd think they wouldn't want to spread that.
Anyway, it was a good idea to check the logs, but my first thinking'd
be hard\software glitch. Crackers tend to leave evidence. They want you
to know they did something.
I am by no means a MySQL or PHP
guru but since I tend to do stupid things
to my files,like deleting the wrong one, I'd check to see if there is
a way you
code could've overwritten the tables. Could it be that someone
else's code\site on your web host
hit you pages?
You also might find out what other kinds of things were done,
backup\restore of data or a
hardware replacement even if it wasn't the
server your site is on. It could be related some how.
Sorry I couldn't give the magic bullet to fix you issue.
With that said check out this link. It mentions something about a
vulnorability
http://archives.neohapsis.com/archives/vulnwatch/2005-q1/0083.html
Bill
wrote in message:
Hi, everyone. I am not sure if I am writing in the correct group. But
somehow it relates to MySQL, I hope someone can help me.
I am working on a web site which is developed by PHP and MySQL, hosted by
a hosting company. Last week, all tables in MySQL suddenly disappeared
and a "func" table is created there. I never create that table in my
database.
I asked the Hosting company what happened. The staff claimed that most
probably my computer was hacked and someone use the admin password to
delete all the tables. Or another possiblity is someone use SQL injection
to grab the database control through the web site.
So I follow their instruction to check my web log to see if any suspected
access and also I checked my program if there is hole for SQL injection.
But seems that isn't the reason. Then I checked if my computer is
hacked. No signal that my computer was hacked.
Now they helped me to restore the database. But since the reason is still
unknown. It may happen again. I am wondering if anyone had same problem
before. I am appreciate if any feedback on this issue. I really want to
know the reason for the problem and try to prevent it.
My local environment:
MacBook with Mac OS X 10.4.9
Using Aqua Data Studio to connect remote MySQL
Thanks for advanced.
Priscilla
| From: Priscilla |
Date: Saturday, April 07, 2007
|
Gordon, thanks for your comment. I do not know what OS the MySQL
server machine is running.. But my web plan is using window server.
Maybe the MySQL server is also on Window platform.
Priscilla
wrote in message:
>I am working on a web site which is developed by PHP and MySQL, hosted
>by a hosting company. Last week, all tables in MySQL suddenly
>disappeared and a "func" table is created there. I never create that
>table in my database.
"func" is a table that appears in the "mysql" database to support
user-defined functions. Or it could be something entirely unrelated
except for the name.
>I asked the Hosting company what happened. The staff claimed that
>most probably my computer was hacked and someone use the admin
>password to delete all the tables. Or another possiblity is someone
>use SQL injection to grab the database control through the web site.
Possible. You do have backups, do not you? Of the site, the database,
*AND* the hosting company.
>So I follow their instruction to check my web log to see if any
>suspected access and also I checked my program if there is hole for
>SQL injection. But seems that isn't the reason. Then I checked if
>my computer is hacked. No signal that my computer was hacked.
>Now they helped me to restore the database. But since the reason is
>still unknown. It may happen again. I am wondering if anyone had
>same problem before. I am appreciate if any feedback on this issue.
>I really want to know the reason for the problem and try to prevent
>it.
There are a number of unlikely WHOOPS!! happenings that could happen.
A sector going bad or getting scribbled on during a power failure
(or employee tripping over power cord, or resetting the wrong
machine) could account for it.
> Do you know what OS the MySQL server machine is running?
Next Message: clean up tables after deletes