Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've just uploaded my ASP.NET web app (VS2010, C#, SQL Server2008) to a Win2008Server R2, everything works fine but I think my database is under attack!

SQL Server ERRORLOG constantly writes some messages saying "Error logging user 'sa', password didn't match...." and writes some IP addresses, it seems I'm being attacked, I DO NOT use 'sa' user at all, so I disabled 'sa' user, now message has changes (but attacks still continue), now message is "Error logging user 'sa', error evaluating passowrd...", error no: 18456, severity: 14, state: 7.

What should I do not? Is it safe for me now or they can penetrate my DB? what should I do? I've disable user 'sa', so it is safe? I cannot delete it as I get an error, can anyone enter my DB? please help me If now I'm safe, can I disable SQL ERROR LOG? how? should I block these IPs? if so, how can I do so?

thanks

share|improve this question

migrated from stackoverflow.com Jul 17 '11 at 5:24

This question came from our site for professional and enthusiast programmers.

4  
Is your database visible to the public Internet? It should not be. –  Michael Petrotta Jul 17 '11 at 4:59
2  
"can I disable SQL ERROR LOG" - that statement is ludicrous at best. –  Mitch Wheat Jul 17 '11 at 5:05
    
Shut down your site - go do that now. Put a static page there saying "down for maintenance" or some such (maybe use app_offline.htm). Because it's obviously not safe as it is. –  Damien_The_Unbeliever Jul 17 '11 at 5:14
add comment

3 Answers

Check your logs to determine the IP address(es) of the client, and then have your server's firewall block all traffic from the attacker. Do this first to mitigate any immediate risks.

After that, look at what you can do differently. Ensure your database only authorizes access from trusted sources, first of all (can you limit it to localhost access only, or at least a short list of trusted IP addresses?).

Chances of this being a targeted attack are slim unless your site is widely popular. I'm guessing the attacker is running an automated script to try common users/passwords to access your database, may try some common exploits, and will then move on. Consider it a warning shot, though, and evaluate site- and server-wide security and backup procedures as soon as possible.

share|improve this answer
    
Also, DO NOT disable logging. From your post, it sounds like your log is the only thing that alerted you to this problem in the first place (and logs are infinitely useful for other reasons). Beyond this, I'm afraid I don't have much advice: I'm not really a Windows guy. –  NotDaveLane Jul 17 '11 at 5:14
add comment

You might want to check if your website is susceptible to SQL injection attacks because your database should not be accessible from outside the server. That seems the most likely to me.

share|improve this answer
    
thanks, but how can I check if my website is susceptible to SQL injection attacks? also how can I see if my database is visible to public internet? I use a connection string with username and password? how can I disable ERRORLOG? its size is increasing with a really high speed –  user833139 Jul 17 '11 at 5:05
    
Since you're coding in ASP.NET I'm hoping you're using SqlParameters instead of concatenating strings together. Also using the standard Textboxes that have options for escaping strings that may contain SQL inside of them. Check if from another computer you can connect to the database, if you can then there's a problem. –  Jesus Ramos Jul 17 '11 at 5:07
    
thanks ramos, I use remote desktop from my system to connect remotely to me server, then I can view my DB, and errorlog files, is it bad? –  user833139 Jul 17 '11 at 5:12
    
remote desktop is fine, can you connect normally as in typing in the address from another computer (instead of using localhost) and access the database? –  Jesus Ramos Jul 17 '11 at 5:14
    
in fact I'm using my connection string with IP address, not localhost, what you mean by another computer? my database is located only in my server, also I connect it remotely (with the same IP and connection string) from VS2010/C#, I have changed name of 'sa', but attack still continues and ERRORLOG file increases in size, now error has changed-> no login name 'sa' found! thanks dear ramos –  user833139 Jul 17 '11 at 5:21
show 1 more comment

The first question I would have is: Is your database server directly accessible to the Internet? If your answer is 'yes' then you need to fix this right now. At the very least you should be firewalling off the SQL server connection so that its not available to random internet people.

Beyond that, its hard to know what to say. You've asked how to check if the database is vulnerable to injection attacks (which is a basic question in coding design for security) and it appears from your comments about connecting to it via visual studio and RDP that you've got it directly connected to the Internet without much in the way of protection. This is all basic stuff which, without wanting to sound rude, you seem unaware of. You probably need to get an experienced person to check over your set up but at the very least I think you need to consider securing this server properly against the outside world with a firewall, and connecting to it through a VPN in the future.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.