About net attack with MSSQL "sa" account

[ahbeng78]

Dear all,

Greetings and my sincere thanks for your kind advise in advance.

I have got a virtual web server which use to connect to a MSSQL2005 DB. This server contain a web base application running Tomcat and MSSQL 2005 as the default DB system.

These few weeks I realized that the connection speed to this server decease tremendously. I then checked in the App Event log of that server and found out that plenty of the "suspicious" connections attempt to the MSSQL2005 via "sa" account on this server (from different countries). And those IP addresses were not belong to anyone of what I know or assigned before.

Those IP vary from many countries that I don't recall I have assign the login account to. Would you please kindly advise the following:

1) How can I tell if the IP addresses that I grabbed from the App Event log if it is real IP addresses or "fake" IP addresses?

2) Is there any free tools that I can install on my server that monitor and report/alert me once there are suspicious network bandwidth or suspicious network attack?

3) How can I achieve to block those IP addresses that trying to access my server. By blocking IP addresses would not possible considering that if the "attacker" have a dynamic IP address everytime he/she connect to the internet. Blocking the DNS name to those countries would not feasible as well because many time, there are users (in same country) that I did assigned their access to this server.

I have a non real-time scanning feature FREE anti virus program, does it mean I have to purchase a better security suite (include firewall management and virus/spyware/malware/trojan detection feature)?

* by the way, how can I know if the connection from my server to the local ISP is having a connection bandwidth challenge? Is there any tools out there that I can use to check?

Regards,

Soh, Eng Beng

[+BudMan MVC]

so you have a web page page that uses this mssql database as its backend right. And the database is housed on the same server the website is served from?

If this is the case why would you need to allow direct access to the database from anywhere other than that webserver? Opening up a sql server to the public net is going to generate lots of traffic to be sure.. Many worms and bots that all they do is look for sql servers open to the public.

So standard sql port is 1433, you will see this is on the top 10 list on sans

http://isc.sans.edu/port.html?port=1433

So yeah your going to see lots of traffic to it, just like you see brute to ssh server ;)

example in last 24 hours or so in my log for ssh

Jan 16 12:59:00 ubuntu sshguard[11163]: Blocking 201.134.42.58: 4 failures over 18 seconds.

Jan 16 15:52:59 ubuntu sshguard[11163]: Blocking 218.239.223.97: 4 failures over 6 seconds.

JJan 16 23:02:35 ubuntu sshguard[11163]: Blocking 85.198.188.145: 4 failures over 5 seconds.

Jan 17 07:09:56 ubuntu sshguard[24707]: Blocking 222.222.194.187: 4 failures over 9 seconds.

Jan 17 08:32:14 ubuntu sshguard[24707]: Blocking 122.200.76.162: 4 failures over 10 seconds.

Jan 17 09:57:51 ubuntu sshguard[24707]: Blocking 147.32.84.189: 4 failures over 4 seconds.

Jan 17 11:22:29 ubuntu sshguard[24707]: Blocking 147.32.84.189: 4 failures over 4 seconds.

Jan 17 17:15:08 ubuntu sshguard[24707]: Blocking 59.175.210.120: 4 failures over 8 seconds.

Jan 17 18:53:48 ubuntu sshguard[24707]: Blocking 116.255.254.197: 4 failures over 30 seconds.

Jan 17 22:21:45 ubuntu sshguard[24707]: Blocking 211.157.108.95: 4 failures over 7 seconds.

Jan 18 00:34:22 ubuntu sshguard[24707]: Blocking 61.19.248.45: 4 failures over 8 seconds.

Jan 18 08:17:50 ubuntu sshguard[5941]: Blocking 114.80.97.201: 4 failures over 10 seconds.

Jan 18 10:29:51 ubuntu sshguard[5941]: Blocking 80.237.155.55: 4 failures over 4 seconds.

Now I don't even allow password auth, only public key so they are never going to auth - but I still just block their ips 4 failures in specific amount of time. But your going to see this noise for sure on any common service port.. Even if you don't even run services on the ports your going to see probes for it.. The net is full of NOISE!!

Here is sample of destination ports my firewall is seeing on my home box

Where your problem is if your letting mssql even be talked to by anything other than your webserver -- Not sure exactly what your doing, but databases used for the backend of a website do not need to be open to the public net.. Only connections from itself (webserver) should be allowed.

BTW log only runs for like 24 hours and then is recycled. That graph is

This is a firewall log summary, of the last 2021 lines of the firewall log (Max 5000).

[+John Teacake MVC]

Yeah should you not have some kind of DMZ set up there to protect against this kind of thing?

[ahbeng78]

thanks Bud and Chuck, i will have the public port disable now. actually i took over this APP server from ex-colleague where i wasn't aware that they have not turn the public port off.

again, many thanks

[+John Teacake MVC]

Wow! These are the people working in IT.