Strange new tables appeared in my DB

[Andrew Culver]

We have mysqld running on a machine with a private ip address (not accessible from the internet), running iptables and only allows connections to mysqld from a small number of ip addresses. Today one of the people who uses the database noticed a number of very strangely named tables in the database:


mysql> show tables;
+----------------------------------------+
| Tables_in_idp_logs |
+----------------------------------------+
| idp__
+:\uffff2NULL\uffff&\uffff\uffff[\uffff\uffffC:\uffff\uffff GN\uffffz\uffff\uffffL |
| idp__%20S" |
| idp__ |
| idp__0 \uffff+5I\uffffI\uffff\uffff*\uffff\uffff\uffff"'\uffff\uffff\uffffab\uffff |
| idp__39I>36E7 |
| idp__3\uffffF\uffffFRl\uffffr\uffffi\uffff" |
| idp__NO%20EVEN%" |
| idp__ali_blue1970 |
| idp__andreiradu_popescu |
| idp__ashkan_sardari |
| idp__bufffitnessfreak |
| idp__camohioguy |
| idp__charud1910 |
| idp__gabisandu2004 |
| idp__kariamanoj |
| idp__|'\uffffB\uffff" |
| idp__\uffff\uffff\uffff\uffff&P^ \uffffT x2C\uffffC\uffff\uffffTNULL |
| idp__\uffff\uffff\uffff\uffff\uffffm\uffff\uffff\uffff\uffff$\uffff
J(" |
| idp_apr |
| idp_aug |
| idp_dec |
| idp_dec_2004 |
| idp_feb |
| idp_feb_2005 |
| idp_jan |
| idp_jan_2005 |
| idp_jul |
| idp_jun |
| idp_mar |
| idp_mar_2005 |
| idp_may |
| idp_nov |
| idp_oct |
| idp_sept |
| idp_septa |
| recent |
| summary |
+----------------------------------------+
37 rows in set (0.00 sec)


The idp_MONTH and idp_MONTH_YEAR are normal, as are recent and summary. The rest shouldn't be there. The few tables that I looked at contained 1 row with all null/zero values.


The machine is an intrusion detection appliance, and we experienced network problems related to this machine today. Looking at the timestamps on the "weird" tables, they are around the same time.

I'm wondering if this might be the result of a disk failure or perhaps someone got into the machine? Or maybe some other explaination?

tia,
Andrew