Blocking hack attempts

Question

I need some help.

I am seeing a lot of attempted logins in my Security Log.

This is a fairly new Godaddy VPS Server running Windows 2008 R2.

The attends are with various user IDs, that do repeat.

The log entry looks like this:

Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 8/23/2019 5:43:31 PM Event ID: 4625 Task Category: Logon Level: Information Keywords: Audit Failure User: N/A Computer: s132-148-82-95.secureserver.net Description: An account failed to log on.

Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0

Logon Type: 3

Account For Which Logon Failed: Security ID: NULL SID Account Name: Administrator Account Domain:

Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xc000006d Sub Status: 0xc000006a

Process Information: Caller Process ID: 0x0 Caller Process Name: -

Network Information: Workstation Name: MSTSC Source Network Address: - Source Port: -

Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

As you can see it doesn't give a caiier IP address.

And Microsoft says NTLM is not tied to any port.

I have tried blocking ports on TCP 1-79, 81-3388, 3390-20000, and in UDP 1-20000 in the firewall. But that doesn't stop the attempts.

I RDP into the server and it's only allowed from my IP address in the firewall.

Help.

I don't know what to try next.

Should I ever try to block them or should I just ignore them?

Gary

Answer 1

Are you 100% sure RDP is being restricted by IP at the firewall? My first impression would be that login attempts are being made to your server via RDP. You really need to check which ports are open and publicly accessible.

One way to do this is to launch a web browser on the server, go to GRC.com, click the Services menu and choose ShieldsUp!. At the next page, click the Proceed button. On the page that opens, find the ShieldsUp Services box where you can scan your server’s ports. Definitely use the Common Ports and All Service Ports buttons. Additionally enter 3389 into the input box and click User Specified Custom Port Probe. This will check to see if RDP is open and publicly accessible.

I would also recommend that on the firewall you block all incoming connections to all ports and then selectively open ports to your requirements. Make sure you don’t block yourself out of your own server when you do this!

Hopefully following these steps will end the unauthorised login attempts. Good luck!

Answer 2

Use wail2ban. It's like fail2ban but for windows https://github.com/glasnt/wail2ban here is the link for the project. But it seems like the development has stopped for it. If I find any better alternatives to fail2ban, I will update my answer. In the meantime, definitely try wail2ban. It will temporarily block IP Addresses of failed login attempts after 5 failed attempts for 10 mins (the conditions, bantime etc can be changed). Don't forget to whitelist your own IP because by mistake if you enter your password wrong 5 times, you will get yourself banned for 10 mins (Default bantime set in wail2ban)