1

I'm running Server 2012 R2.

When I look at the Network tab in the Resource Monitor, I see strange network addresses which last for a few seconds and then disappear.

The server is used as database server and should only be connected from Australian addresses. I can see many addresses from .ru, .tr, .fr, etc.

All these connections are being used by PID 4, the System image.

I have run a scan with Malwarebytes which picked up zero issues.

  1. Is there a way to see which System process is using these connections?
  2. Is this some type of worm and if so, how can I locate it?

I've attached an image of the kind of addresses that I'm seeing.

Network

8 Answers 8

3
+50

I cannot answer your question 1. As for your question 2, it is probably not a worm on your server if the connections are all incoming.

HOWEVER

Random people from the Internet should not be allowed to open any kind of connection to your database server. Your firewall should allow incoming access to

  1. the port for your administrative connections, hopefully identified by your static source IP address if you have one

  2. the port for the service you are providing, which is hopefully not a database directly but some web interface, Apache or IIS for example, maybe running on a different machine.

This means that you will not need to wonder what those addresses are connecting to, because there will only be two possibilities.

Another possibility is that the connections are outgoing. If so, best case is that they are DNS lookups that your server does to identify incoming connections (that would explain why the connections are being used by the system image). Worst case, of course, is something like "your server is totally compromised, your data has been exported to someone else and you will lose access to it or it will be modified in ways you will not like, and your server is being used for illegal purposes that will earn you a visit from the police" -- hopefully this isn't the case! Checking that you have up-to-date backups is always good.

If you still see these connections after restricting incoming connections to the specifically authorized ones, then you should dump the network packets using a packet sniffer in order to see what the packets are, and if that doesn't answer your questions then at least you will have a lot more data for your next question.

This may not be the answer you were looking for, but since nobody else has taken you up on this in two days, I'm giving you what I can.

TL;DR: You need a firewall.

5
  • Thanks for the answer. I've added an image to my original question which shows the Network Performance. It seems those connections are receiving and sending.
    – Daniel Gee
    Jun 14, 2018 at 8:59
  • 3
    Well, you really need a firewall, to start with, and then you can go from there.
    – Law29
    Jun 14, 2018 at 20:52
  • 3
    ^^ This, a thousand times over. A database server should never be directly exposed to the internet. At a bare minimum you absolutely must have a firewall with explicit white-listing of the source addresses you need to connect to it.
    – Steve365
    Jun 19, 2018 at 11:40
  • Is the basic Windows Firewall good enough? I only need the DB and RDP ports open.
    – Daniel Gee
    Jun 20, 2018 at 11:34
  • Sure -- much better than nothing in any case! At least you will only be answering on the DB and RDP ports, and those you can have (probably already have) passwords. You will need some more outgoing flows (with responses) like DNS and NTP, but the default configuration will probably allow all outgoing. However do people really connect directly to the DB port? That is a really strange setup. Best practice has for many many years been to provide access only to an HTTP(s) server that handles requests with a human-oriented web site and/or an API, with the database as backend.
    – Law29
    Jun 20, 2018 at 20:58
1

1 - Yes, there is: https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview

2 - Impossible to say without more details.

There are a lot of worms, scanners, search engines, idiots and other connection initiating mechanisms on the internet. There is no way to know with that not so great ammount of information.

3
  • I ran TCPView and didn't see the addresses that I'm seeing in the Network Performance in that list.
    – Daniel Gee
    Jun 14, 2018 at 8:58
  • Then there is no TCP connection (to any process on your machine). Maybe it's stateless, like ICMP or HTTP-Discover.
    – bjoster
    Jun 14, 2018 at 13:16
  • 3
    OR you didn't run it with enough priviledges. Both gather their data from the same sources.
    – bjoster
    Jun 15, 2018 at 10:40
1

Here's another way to find out more about these connections. Get Process Explorer from Microsoft Sysinternals, then run it as administrator, go to the System process, open its properties, go to the TCP/IP tab, you can there view these connections, along with which ports and protocol they're using.

Hope this helps.

0

So, "Kyivstar" is a Ukrainian ISP, and it's pretty well known for spam messages that are sourced from IP's that it hosts. Here's an article talking about it: https://glimmernet.com/blog/blocking-kyivstar-from-accessing-your-wordpress-site/

More or less, like others have said, you're going to have to invest in some kind of blocking mechanism for IP's (e.g. firewall) that you consider to be "not legitimate." That, or you could setup some kind of DMZ for whatever the public-facing application is for your database: https://www.techrepublic.com/article/lock-it-down-implementing-a-dmz/

Hope this helps.

0

The server is used as database server and should only be connected from Australian addresses. I can see many addresses from .ru, .tr, .fr, etc.

This is no surprise. Any server accessible from the general Internet is under permanent attack. If the service is not "Internet-hardened" you need to protect the network access.

A basic protection would be geo-based IP address screening. A better approach includes explicit whitelisting of desired clients/ISPs and SSL encryption, of course. With roaming worldwide users, VPN should be considered.

0

If you expose it to the Internet, They [TM] find you. I'll second the recommendation to firewall off your database server. That doesn't really answer your question, though.

Based on your comments specifying which database product you're using, perhaps the remote users are attempting to perform one of these PostgreSQL exploits. This video from 2016 shows someone hacking PostgreSQL on linux. They could also be trying to exploit Windows server 2012 R2.

It's trivial to find a server on the internet (They [TM] have scripts that scan IP ranges) and figure out what services it's running (nmap will do that). It's more likely that your server is being actively attacked than that you have a worm, IMHO.

1
  • 1
    Thank for your answer. I'm using PostreSQL on that server. PG uses a "allowed connections" text file to compare incoming connections to. Which means that if the IP is not on the allowed list, they don't even get to the server. Also, there are no logs to show logins from any other address than our application server.
    – Daniel Gee
    Jun 20, 2018 at 11:33
0

It's simply the remote machines trying to connect and gain access to one of your ports. The reason may be genuine and acceptable if you're part of peer network (like Torrent or Tor, etc), otherwise it's just some malicious machines trying to get a backdoor. They'll always pinging the internet for gaining access.

Don't panic!

There's a timeout for such connections and they'll automatically be closed once their grace time is over.

You can use TCP monitor programs from TCPView v3.05 which helps you to scrutinize the issue further. Some sites can still have unterminated connections which might vanish after a while.

The situation that needs attention is that you see such a connection or a suspicious IP with status 'LISTENING' or 'ESTABLISHED' on the TCPView. Otherwise, you can see them vanishing one by one or a bunch at a time. You can see 'Process Properties' and even 'Who is' query (if available) for the remote machine from menu.

here's more to that, enter image description here

TCPView v3.05

0

It's simply the remote machines trying to connect and gain access to one of your ports. The reason may be genuine and acceptable if you're part of peer network (like Torrent or Tor, etc), otherwise it's just some malicious machines trying to get a backdoor. They'll always pinging the internet for gaining access.

Don't panic!

There's a timeout for such connections and they'll automatically be closed once their grace time is over.

You can use TCP monitor programs from TCPView v3.05 which helps you to scrutinize the issue further. Some sites can still have unterminated connections which might vanish after a while. It's of no concern as long as the connection state is 'TIME_WAIT'

The situation that needs attention is that you see such a connection or a suspicious IP with status 'LISTENING' or 'ESTABLISHED' on the TCPView. Otherwise, you can see them vanishing one by one or a bunch at a time. You can see 'Process Properties' and even 'Who is' query (if available) for the remote machine from menu.

here's more to that, enter image description here

TCPView v3.05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .