Solved

How to block a hacker

Posted on 2010-11-28
16
465 Views
Last Modified: 2012-08-14
My SBS 2003 server has been logging failed login attemps at the rate of 5 per second for 2 days now. I have a lockout policy in place, so the hacker is unlikely to succeed. Is there anything I can do to determine his IP address and block him. In fact I would like to block all access attemps which originate from outside the UK.

Ian
0
Comment
Question by:TownTalk
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 5
  • 4
16 Comments
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34226711
I am fighting the same battle with a customer's server and using the logs on their hardware firewall I can determine the IP addresses of the hackers.

Make sure you expose only the ports you need exposed and log on your firewall all activity so you know what is coming in and out.

Please also have a read of my blog article about the increase of this type of attack:

http://alanhardisty.wordpress.com/2010/09/28/increase-in-frequency-of-security-alerts-on-servers-from-hackers-trying-brute-force-password-programs/
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34226716
I have blocked port 80 access to the server as it was not used, made sure the default website was redirected to /exchange virtual directory, restricted port 443 access to the IP of the customer's Mobile Service Provider and regularly add IP address blocks on their firewall.

It is a continual game of cat and mouse!
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 34226723
I assume those are type 10 logon attempts? If so they are almost guarenteed to be using port 3389 to attempt to gain access. SBS has a very unique feature called remote web workplace which uses 443 and 4125 which is much more secure that 3389 and will pretty well eliminate the thousands of 3389 attempts most anyone gets.

Best place to block IP's or ranges is with your router but hard to allow only the UK.
0
Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

 

Author Comment

by:TownTalk
ID: 34226740
Actually I just took a look at the Router logs, the attemps are coming from multiple addresses, but by far the majority are coming from one ip address and it is attempting to get into our ftp site. So I can shut that down. It seems that all the other attempts are on port 25. I havent seen any attempts yet on 3389 which I am relieved about.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34226749
I have seen the same with port 25 trying to login to your server with usernames / passwords.

Make sure your security is tight and force regular password changes with strong passwords.

Block IP's that keep trying access regularly if from countries you don't communicate with.
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 34226750
Very insecure to be running FTP, or a port 80 web server, on a domain controller. I would recomend hosting elsewhere or even on a PC if you have to have one. I am assuming this is enabled on the SBS?
0
 

Author Comment

by:TownTalk
ID: 34226752
Blocking ip's is exactly what I want to do. But I dont know how to do it.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34226757
I use www.dnsstuff.com to determine the IP address range and then block ALL access to your server from that IP address range on the firewall / router.
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 34226759
If it is possible you are best on the router to allow only specified IP's, but I appreciate that is not always a possibility. Avoid common account names like administrator, admin, sales, POS, backup, manager, and as Alan said make sure you have strong passwords (enforce complexity through GP) and account lockout policies enabled.
0
 

Author Comment

by:TownTalk
ID: 34226766
I've got strong passwords. So I think i'm covered there. I was just looking in the router. It's only a Netgear DG834. I cant see any way to block traffic from a specific address though.
0
 
LVL 77

Accepted Solution

by:
Rob Williams earned 250 total points
ID: 34226799
On that Netgear by default it allows "any". you can set an IP range to allow, but you cannot set ranges to block. If you can narrow down your UK users to a specific IP range, no matter how big, you could specify that, but it only allows one subnet.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34226801
Click on the Firewall Menu on the left and then on the Inbound Section Add a new rule - add the Ports (All) and then add the IP Range to the From section and click Add.

You will have to create a new rule per IP range to block - which makes the list very long if you block loads.
0
 
LVL 76

Assisted Solution

by:Alan Hardisty
Alan Hardisty earned 250 total points
ID: 34226829
Sorry - that should be Firewall Rules Section.

The Default for Inbound is Block and Default for Outbound is Allow.

You can happily add a new Firewall Rule for each IP Port Range to block all access.
0
 

Author Comment

by:TownTalk
ID: 34226832
Thanks Alan, I can see that now. I didn't realise it could be done. I going to split the points though because you both talked a lot of sense.

Thanks guys.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34226859
No problems - that's very fair.

Keep an eye on the router logs.  I get them emailed to me daily and monitor what is going on and make additional rules as necessary.
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 34226866
Thanks TownTalk, good luck with it.
Cheers!
--rOB
0

Featured Post

What Is Transaction Monitoring and who needs it?

Synthetic Transaction Monitoring that you need for the day to day, which ensures your business website keeps running optimally, and that there is no downtime to impact your customer experience.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Small Business Server 2011. NOTE: This guide has been written using the preview version of SBS2011 therefore some of the screens may …
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question