Intrusion Detected: Advice needed - Tilted Forum Project Discussion Community

Jove · 04-18-2010, 07:43 AM

Last week at work, I noticed the Terminal Server (OS:Windows Server 2003) was infected with malware and an unknown user was trying to gain complete control of the server. Luckily, I was able to disable/delete the user accounts created by this individual, disabled the FTP server referencing to the newly created computer name and removed the malware from the server using AVG Antivirus and Malwarebytes Antimalware.

However, I have noticed in my security event logs of a computer along with the IP Address that has made many failed attempts to log into the terminal server. I tracked the IP address using Who Is IP address and noticed it is from the Ukraine.

I would like to know if any of you have additional advice or can provide me with additional security tools that could prevent this user from making attempts to accessing the server?

Anxst · 04-18-2010, 09:56 AM

I'd suggest reporting the activity to your local ISP. They may choose to do nothing, but that's up to them. other than that, perhaps set up an ACL to only allow established connections for that subnet from the Ukraine? Or heck, Supernet if you're unsure what range of addresses you're dealing with. Unless there's a legitimate reason for users from that block of addresses to be accessing your network, just lock them out unless something inside requested the packet delivery.

tcp · 04-23-2010, 11:53 AM

I'm not an expert with Windows servers but you need to look at your security policy and ban repeated failed login attempts. You should also probably limit the user accounts that can be accessed via RDC and secure their passwords or set up key-based access. Also, if you haven't already done so, you need to secure your file system and give accounts only the access they need so that exploits are less likely to work. By default, a lot of the critical directories in your machine are user-writable. You should also probably being running network services under less-privileged accounts.

There are a lot of security auditing tools that you can use to get the basics down. You can probably ask for help on a security mailing list if you need help along the way, maybe SecurityFocus . After you get some new measures in place, try to stay on top of security bulletins and the latest methods people are adopting.

Regarding IP banning, there are IPs that are known to be running constant probes but I don't think ISPs bother to block most of them. Also, even if you block every IP range from foreign countries, the next attack still might come from somewhere unexpected. Since he is already being targeted, the attacker might be interested enough to just proxy his attack after he gets blocked. Setting up your firewall to drop unsolicited packets is a good general rule though and will work for some services. An ACL will only be particularly effective if you are willing to deny all except the list of subnets that you maintain, for at least some of your services. You may also look into port knocking for a more advanced way to limit your exposure.

Jove · 05-01-2010, 05:44 AM

Excellent advice all around.

I thought I would update you on the situation and tell you I changed the domain administrator password, blocked the ip addresses trying to gain access to the terminal server in my firewall and the malware/trojans were removed from the server. I looked at my security logs and have not viewed any failed attempts at logging into the terminal server, which is great, but I noticed in my firewall logs a mention of port scanning, so I will be looking into port knocking next and signing up for the security focus mailing list.

LordEden · 05-01-2010, 08:50 AM

Are you running a software or hardware based firewall?

Martian · 05-01-2010, 09:06 AM

Sounds like you have things pretty well in hand. Unless you need that box to be publically accessible though (running a mail server or web server, DNS server etc) I'd just block all external attempts at access as a matter of policy and whitelist specific IP addresses as needed.

If your firewall is worthwhile, it'll drop the ping requests and your server won't respond to port scans. Everyone on the internet gets scanned -- it's just part and parcel of the internet experience. As long as you're properly secured it's nothing to worry about.

As a good faith policy I always look up the owner of the IP and send a 'heads up' email to abuse@ in situations like this. It's not likely to amount to much, especially for traffic originating out of the Ukraine, but it only takes a few seconds and then at least you've done due diligence.

Jove · 05-02-2010, 05:13 PM

Quote:

Originally Posted by LordEden

Are you running a software or hardware based firewall?

Hardware based firewall.

04-18-2010, 07:43 AM	#1 (permalink)
Jove Groovy Hipster Nerd Location: Michigan	Intrusion Detected: Advice needed Last week at work, I noticed the Terminal Server (OS:Windows Server 2003) was infected with malware and an unknown user was trying to gain complete control of the server. Luckily, I was able to disable/delete the user accounts created by this individual, disabled the FTP server referencing to the newly created computer name and removed the malware from the server using AVG Antivirus and Malwarebytes Antimalware. However, I have noticed in my security event logs of a computer along with the IP Address that has made many failed attempts to log into the terminal server. I tracked the IP address using Who Is IP address and noticed it is from the Ukraine. I would like to know if any of you have additional advice or can provide me with additional security tools that could prevent this user from making attempts to accessing the server?

04-18-2010, 09:56 AM	#2 (permalink)
Anxst Condensing fact from the vapor of nuance. Location: Madison, WI	I'd suggest reporting the activity to your local ISP. They may choose to do nothing, but that's up to them. other than that, perhaps set up an ACL to only allow established connections for that subnet from the Ukraine? Or heck, Supernet if you're unsure what range of addresses you're dealing with. Unless there's a legitimate reason for users from that block of addresses to be accessing your network, just lock them out unless something inside requested the packet delivery. __________________ Don't mind me. I'm just releasing the insanity pressure from my headvalves.

05-01-2010, 09:06 AM	#6 (permalink)
Martian Young Crumudgeon Location: Canada	Sounds like you have things pretty well in hand. Unless you need that box to be publically accessible though (running a mail server or web server, DNS server etc) I'd just block all external attempts at access as a matter of policy and whitelist specific IP addresses as needed. If your firewall is worthwhile, it'll drop the ping requests and your server won't respond to port scans. Everyone on the internet gets scanned -- it's just part and parcel of the internet experience. As long as you're properly secured it's nothing to worry about. As a good faith policy I always look up the owner of the IP and send a 'heads up' email to abuse@ in situations like this. It's not likely to amount to much, especially for traffic originating out of the Ukraine, but it only takes a few seconds and then at least you've done due diligence. __________________ I wake up in the morning more tired than before I slept I get through cryin' and I'm sadder than before I wept I get through thinkin' now, and the thoughts have left my head I get through speakin' and I can't remember, not a word that I said - Ben Harper, Show Me A Little Shame

04-23-2010, 11:53 AM	#3 (permalink)
tcp Crazy	I'm not an expert with Windows servers but you need to look at your security policy and ban repeated failed login attempts. You should also probably limit the user accounts that can be accessed via RDC and secure their passwords or set up key-based access. Also, if you haven't already done so, you need to secure your file system and give accounts only the access they need so that exploits are less likely to work. By default, a lot of the critical directories in your machine are user-writable. You should also probably being running network services under less-privileged accounts. There are a lot of security auditing tools that you can use to get the basics down. You can probably ask for help on a security mailing list if you need help along the way, maybe SecurityFocus . After you get some new measures in place, try to stay on top of security bulletins and the latest methods people are adopting. Regarding IP banning, there are IPs that are known to be running constant probes but I don't think ISPs bother to block most of them. Also, even if you block every IP range from foreign countries, the next attack still might come from somewhere unexpected. Since he is already being targeted, the attacker might be interested enough to just proxy his attack after he gets blocked. Setting up your firewall to drop unsolicited packets is a good general rule though and will work for some services. An ACL will only be particularly effective if you are willing to deny all except the list of subnets that you maintain, for at least some of your services. You may also look into port knocking for a more advanced way to limit your exposure.

05-01-2010, 05:44 AM	#4 (permalink)
Jove Groovy Hipster Nerd Location: Michigan	Excellent advice all around. I thought I would update you on the situation and tell you I changed the domain administrator password, blocked the ip addresses trying to gain access to the terminal server in my firewall and the malware/trojans were removed from the server. I looked at my security logs and have not viewed any failed attempts at logging into the terminal server, which is great, but I noticed in my firewall logs a mention of port scanning, so I will be looking into port knocking next and signing up for the security focus mailing list.