RE: break in? - terminal services on alternate port

From: maralisa (maralisa_at_villatiburon.com)
Date: 11/12/05

  • Next message: Steve Friedl: "Re: On the topic of Windows Hardening" 
    Date: Sat, 12 Nov 2005 09:00:14 -0800
To: <focus-ms@securityfocus.com>, <techlists@comcast.net>

    Paul,
     
    The smartest and best thing to do if you must open the terminal services
    port to the world is to change the port that terminal services runs on.
    I do this, and it never gets attacked. You should also change the name
    of your administrator account. This is best practice. I've had my
    terminal server accessible to the worls for literally year now with no
    problems.
     
    Read this and give it a shot.
    http://support.microsoft.com/default.aspx?scid=kb;en-us;q187623 When
    you connect using the terminal services client, you put a : and the port
    number after the server name, like this, server:6432
     
    -steve

    ________________________________

    From: Paul Greene [mailto:techlists@comcast.net]
    Sent: Fri 11/11/2005 9:18 PM
    To: focus-ms@securityfocus.com
    Subject: break in?

    Hello,

    I have a Win2K domain controller running on my home network that had
    Terminal Services enabled through my firewall so that I could access the
    box from my office at work. I had configured the firewall to only all TS
    access from the IP block of the company where I work. (the firewall is
    an openbsd box that also acts as the gateway to my ISP)

    Well, I went out on a road trip and allowed TS access from "any" so that
    I could access the DC from my hotel room, and then forgot to restrict
    access again when finished. Ooops!! Big mistake.

    I was looking through Event viewer troubleshooting another issue a few
    days ago, then noticed a whole bunch of failed administrator logins in
    the security logs. Oh, crap what happened now. I ran Symantec AV, Spybot
    search and destroy, and Adware and none of them found anything. I ran MS
    Update service and realized I was out of date on several patches (going
    back about 2 months worth of patches).

    Another ominous sign was that the DC had two printers configured that I
    use at the office, but I have never configured a printer for this DC. I
    deleted the printers, and they came right back.

    I wanted to see what was going on with the DC, so rather than wipe it
    clean and re-install, I locked the firewall down real tight and started
    logging everything to see if the DC was going to try to "phone home"
    somewhere. I'm only allowing outgoing http access to the MS Update site,
    and outgoing DNS queries (UDP port 53) because this is also the dns
    server for the network.

    More ominous signs. The server was trying a few times a day to make
    connection attempts to some outbound websites and ftp sites. Some of the
    IP addresses were located in Rumania and Poland. All connection attempts
    were getting blocked and logged.

    Based on these symptoms, can anyone tell me what happened? In
    particular, for educations sake, can anyone tell what the specific
    exploit that was used in this case, and possibly a reference where I can
    go analyze further what happened?

    I don't have anything especially valuable on this server, so I won't
    lose much by wiping it and starting over again. I think I've also locked
    it down enough now with firewall ACL's that some turkey isn't going to
    be stealing my bandwidth for some nefarious purpose either.

    Thanks in advance,

    Paul Greene

    ------------------------------------------------------------------------ 

    ---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Steve Friedl: "Re: On the topic of Windows Hardening"

    Relevant Pages

    • Re: How to Maintain an IIS Server?
      ... > server running on a Windows 2000 server. ... before a firewall and antivirus have been installed]. ... open ports; however, this will not identify which program is using the port. ...
      (microsoft.public.inetserver.iis.security)
    • Re: CEICW fails at firewall config
      ... ISA Server prevents connection to a remote desktop when you connect through ... Remote Web Workplace on a Windows Small Business Server 2003-based computer ... Acceleration Server as a firewall. ... connection uses TCP port 4125. ...
      (microsoft.public.windows.server.sbs)
    • Re: How to Maintain an IIS Server?
      ... >> server running on a Windows 2000 server. ... > before a firewall and antivirus have been installed]. ... > program or executable using that port. ...
      (microsoft.public.inetserver.iis.security)
    • Re: Activesync / Airsync - Alternative Ports
      ... Setup a reverse HTTP proxy. ... Another idea is to use the PPTP capabilities of a Windows Server to allow ... Satellite - Cisco Firewall - Exchange Server ... So on the server side you would configure the port 80 to redirect to ...
      (microsoft.public.pocketpc.activesync)
    • Re: Activesync / Airsync - Alternative Ports
      ... "Chris De Herrera" wrote: ... Another idea is to use the PPTP capabilities of a Windows Server to allow ... Satellite - Cisco Firewall - Exchange Server ... So on the server side you would configure the port 80 to redirect to 8888 ...
      (microsoft.public.pocketpc.activesync)