account compromised, are there mysql logs?

Question

Is there such a thing as mysql logs to determine if anything has been accessed/updated/removed. My account was compromised and it appears only spam scripts were uploaded.

I changed all passwords and installed a brute force detection. (I am not sure how they brute forced my password to begin with)

Answer 1

Yes, if configured so.

Manual >> 5.2. MySQL Server Logs

If the Binary Log has been configured, you can pretty much see any activity that has changed data, and also replay up to a certain point. Could prove useful if there has been a SQL-injection type of attack.

But considering the question I take it that you are not familiar with MySQL administration, and I therefore suggest you try to find someone to help you out.

Answer 2

What has been compromised? Was it a shell account with extended privileges or mysql? Do you feel you need to preserve evidence for an investigation or are you just trying to get back online ASAP? If it was mysql, the first step I would take is to prevent access from externally by setting the below in my.cnf. Once you have this you can start to take stock of the situation.

bind-address = 127.0.0.1

If you are concerned about mysql changes then a very simple way is to do an mysqldump of the db from now and compare it to one in your offsite backup from before the compromise. It will be quite verbose but should highlight the changes to you.

As far as I am aware, mysql only logs changes if you have it set in debugging mode but this is slow and verbose and not recommended at all.

If you suspect your shell account has been compromised then I would suggest you carefully examine /etc/passwd /etc/group etc and then start the process of building a more secure environment and shifting your application to it(there is a much longer post required about this which I'm not able to do right now but am sure someone else will be able to help ).