How to track hackers during dictionary attacks? 1

[Ovatvvon]

Hello all,

I have been undergoing attacks for the past few days of someone (or, some entity) trying dictionary attacks on my SA account of my SQL Server. Since then, I deactivated the SA account and went with purly NT Accounts Authentication. Now, they have been trying to log into random accounts guessing at different passwords. I've blocked IP's as I've seen them come in in floods, but for random tries, it's harder to locate the source IP and such.

Is there a way to do any and/or all of the following?...

1) See what passwords have been attempted by these users during all the attempts.
2) Track where the source is of this attempt to logon.
3) Do something to stop this person / these people from continuing further attacks from different computers, etc.

Here is a sample of a couple audits from my event viewer (Any help in this matter would be GREATLY appreciated) Thank you!!!


Event Type: Warning
Event Source: MSFTPSVC
Event Category: None
Event ID: 100
Date: 12/12/2004
Time: 3:00:24 AM
User: N/A
Computer: WEB
Description:
The server was unable to logon the Windows NT account 'administrator' due to the following error: Logon failure: unknown user name or bad password. The data is the error code.
For additional information specific to this message please visit the Microsoft Online Support site located at:

http://www.microsoft.com/contentredirect.asp.

Data:
0000: 2e 05 00 00



Event Type: Warning
Event Source: MSFTPSVC
Event Category: None
Event ID: 100
Date: 12/12/2004
Time: 3:00:24 AM
User: N/A
Computer: WEB
Description:
The server was unable to logon the Windows NT account 'webmaster' due to the following error: Logon failure: unknown user name or bad password. The data is the error code.
For additional information specific to this message please visit the Microsoft Online Support site located at:

http://www.microsoft.com/contentredirect.asp.

Data:
0000: 2e 05 00 00



Event Type: Warning
Event Source: MSFTPSVC
Event Category: None
Event ID: 100
Date: 12/12/2004
Time: 3:00:24 AM
User: N/A
Computer: WEB
Description:
The server was unable to logon the Windows NT account 'root' due to the following error: Logon failure: unknown user name or bad password. The data is the error code.
For additional information specific to this message please visit the Microsoft Online Support site located at:

http://www.microsoft.com/contentredirect.asp.

Data:
0000: 2e 05 00 00



-Ovatvvon :-Q

 

[agrappe]

http://www.snort.org

 

[shrubble]

What conduit are they using for the attempted login?

If the attack is external, it's gotta go through a firewall somewhere; a dictionary attack should have pages of connections from a single IP.

If it's being attempted through HTTP, check your weblogs for lots of strangely-crafted URLS. These URLS will often bear the attempted passwords within them.

The key is to realize how this person is attempting to do this, and then checking the logs and tightening security along every step. Often with attacks that brazen the source is a RIPE IP from overseas. If that's the case, just block the whole IP range in your firewall.

Another big problem occurs when someone on the outside manages to authenticate him or herself as a user (or other object) on your domain because of a weak password. Once that occurs, they may have a direct-trusted path to your data, and can sit there all day hammering away at our password.

Hope this helps!

"I would rather have a free bottle in front of me, than a pre-frontal lobotomy..."

-Shrubble

http://www.ishrubble.com

 

[Ovatvvon]

Thanks shrubble. I'll direct myself to check out the areas that you did and work on them.

agrappe, at first glace it would appear that Snort primarily works with MySql. Since I'm running Sql Server, I'm thinking this would be a problem. I'm I wrong?

-Ovatvvon :-Q

 

[agrappe]

Snort is network intrusion detection software and should be run from a machine that isn't being attacked. I installed it on an old PC running RedHat Linux. It sniffs the wire for signatures it recognizes as intrusion attempts. It's a nice piece of software that is very customizable.

To answer your question; yes, both on the same system might be a problem.