1

I help a client manage a website that is run on a dedicated web server at a hosting company. Recently, we noticed that over the last two weeks there have been tens of thousands of Audit Failure entries in the Security Event Log with Task Category of Logon - these have been coming in about every two seconds, but interesting stopped altogether as of two days ago.

In general, the event description looks like the following:

An account failed to log on.

Subject:
    Security ID:        SYSTEM
    Account Name:       ...The Hosting Account...
    Account Domain:     ...The Domain...
    Logon ID:       0x3e7

Logon Type:         10

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       david
    Account Domain:     ...The Domain...

Failure Information:
    Failure Reason:     Unknown user name or bad password.
    Status:         0xc000006d
    Sub Status:     0xc0000064

Process Information:
    Caller Process ID:  0x154c
    Caller Process Name:    C:\Windows\System32\winlogon.exe

Network Information:
    Workstation Name:   ...The Domain...
    Source Network Address: 173.231.24.18
    Source Port:        1605

The value in the Account Name field differs. Above you see "david" but there are ones with "john", "console", "sys", and even ones like "support83423" and whatnot.

The Logon Type field indicates that the logon attempt was a remote interactive attempt via Terminal Services or Remote Desktop. My presumption is that these are some brute force attacks attempting to guess username/password combinations in order to log into our dedicated server. Are these presumptions correct?

Are these types of attacks pretty common? Is there a way to help stop these types of attacks? We need to be able to access the desktop via Remote Desktop so simply turning off that service is not feasible.

Thanks

3 Answers 3

3

The March 2012 Security Bulletins included MS12-020, which is for a Critical vulnerability in Remote Desktop Services. On March 19, it was reported that there is proof of concept code in the wild.

http://www.pcworld.com/businesscenter/article/252092/patch_now_microsoft_rdp_exploit_code_is_in_the_wild.html

https://secunia.com/advisories/48395

https://technet.microsoft.com/en-us/security/bulletin/ms12-020

I would not expose Remote Desktop without a smart card or VPN solution. There are inexpensive VPN solutions available for evaluation and testing (such as Hamachi). There are even free versions if you don't need all the features or only have a small number of remote client computers.

1
  • FWIW, the Microsoft security patch was applied on 3/17. Mar 26, 2012 at 19:41
2

Are they common? Yes.

Can you stop them? No.

You can't stop someone from attempting the attack, but you can reduce their chance of success by keeping the system up to date with patches, by using some type of IDS/IPS, and auditing your logs regularly to stay aware of the frequency and volume of the attempts.

1

As Joe mentioned these are common and your best bet is to secure the surface area (updates, etc). I'm assuming since this is a dedicated server it should be behind a shared/dedicated firewall. Call up your hosting provider and have them white list your source IP's for 3389 and drop all other traffic not originating from your sources.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .