0

We have a Microsoft Azure virtual instance and over there we have installed the SQL Server 2014 Express edition. While investigating a issue we found below logs in windows event viewer in application section.

Login failed for user '401hk'. Reason: Could not find a login matching the name provided. [CLIENT: 220.180.111.229]

We observed that there are around 5250 such request in last 24 hours. The IP and Login name is changing after some requests and all IPs (i.e. 220.180.111.229 ) are locating to China. Is it kind of SQL attack? If yes then how to prevent it on Azure(without blocking countries)?

  • What type of NSG rules do you have set up? My guess is that these are attempts to log on to the VM via RDP. – joeqwerty Apr 8 '17 at 15:38
  • The issue is resolved after blocking 1433(sql server) port from azure portal. – Swapnil Sonawane Apr 10 '17 at 5:45
1

Any Azure instance that is exposed to the public internet is likely to see this sort of brute force traffic, it's unlikely to be a coordinated attack against you personally, but some sort of automated port scan looking for open ports in an IP range and trying out common username/password combinations. This sort of traffic is particularly common for Cloud providers given that they general publish the list of their public IP ranges, so easy to scan.

You can look to mitigate this by using NSG's to restrict traffic into your virtual network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.