RE: break in?

From: Laura A. Robinson (larobins_at_bellatlantic.net)
Date: 11/12/05

  • Next message: jordanpw: "Re: What server hardening are you doing these days?" 
    Date: Sat, 12 Nov 2005 16:54:25 -0500
To: "'Paul Greene'" <techlists@comcast.net>, <focus-ms@securityfocus.com>

    Okay, a few things first:

    1. You say you saw lots of failed login attempts. Did you see any successful
    ones?
    2. The printers that appeared on your DC are normal. By default, the RDP
    client will try to install the printers that are installed on the client
    machine into the terminal session, as well.
    3. Have you run netstat to see what's trying to connect to the ftp and web
    sites? I'd recommend netstat -b -v so you can see the executables that
    spawned the processes making the connections.

    Then let us know what you find. :-)

    Laura

    > -----Original Message-----
    > From: Paul Greene [mailto:techlists@comcast.net]
    > Sent: Saturday, November 12, 2005 12:19 AM
    > To: focus-ms@securityfocus.com
    > Subject: break in?
    >
    > Hello,
    >
    > I have a Win2K domain controller running on my home network
    > that had Terminal Services enabled through my firewall so
    > that I could access the box from my office at work. I had
    > configured the firewall to only all TS access from the IP
    > block of the company where I work. (the firewall is an
    > openbsd box that also acts as the gateway to my ISP)
    >
    > Well, I went out on a road trip and allowed TS access from
    > "any" so that I could access the DC from my hotel room, and
    > then forgot to restrict access again when finished. Ooops!!
    > Big mistake.
    >
    > I was looking through Event viewer troubleshooting another
    > issue a few days ago, then noticed a whole bunch of failed
    > administrator logins in the security logs. Oh, crap what
    > happened now. I ran Symantec AV, Spybot search and destroy,
    > and Adware and none of them found anything. I ran MS Update
    > service and realized I was out of date on several patches
    > (going back about 2 months worth of patches).
    >
    > Another ominous sign was that the DC had two printers
    > configured that I use at the office, but I have never
    > configured a printer for this DC. I deleted the printers, and
    > they came right back.
    >
    > I wanted to see what was going on with the DC, so rather than
    > wipe it clean and re-install, I locked the firewall down real
    > tight and started logging everything to see if the DC was
    > going to try to "phone home"
    > somewhere. I'm only allowing outgoing http access to the MS
    > Update site, and outgoing DNS queries (UDP port 53) because
    > this is also the dns server for the network.
    >
    > More ominous signs. The server was trying a few times a day
    > to make connection attempts to some outbound websites and ftp
    > sites. Some of the IP addresses were located in Rumania and
    > Poland. All connection attempts were getting blocked and logged.
    >
    > Based on these symptoms, can anyone tell me what happened? In
    > particular, for educations sake, can anyone tell what the
    > specific exploit that was used in this case, and possibly a
    > reference where I can go analyze further what happened?
    >
    > I don't have anything especially valuable on this server, so
    > I won't lose much by wiping it and starting over again. I
    > think I've also locked it down enough now with firewall ACL's
    > that some turkey isn't going to be stealing my bandwidth for
    > some nefarious purpose either.
    >
    > Thanks in advance,
    >
    > Paul Greene
    >
    > --------------------------------------------------------------
    > -------------
    > --------------------------------------------------------------
    > -------------
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: jordanpw: "Re: What server hardening are you doing these days?"

    Relevant Pages

    • Re: Sharing files and printers
      ... The server can ping the client and can access the shared documents folder ... and printers on the client. ... The problem is probably caused by a firewall (Windows Firewall, ...
      (microsoft.public.windowsxp.network_web)
    • problems with CUPS printer sharing (browsing)
      ... I'm trying to use the printers which are offered by a CUPS network print ... The CUPS server (running on a SuSE 9.1 host) seems to be ... firewall on that client is completely switched off. ...
      (alt.os.linux.suse)
    • Re: Sharing files and printers
      ... The server can ping the client and can access the shared documents folder ... and printers on the client. ... The problem is probably caused by a firewall (Windows Firewall, ...
      (microsoft.public.windowsxp.network_web)
    • Re: printer icon does not appear in the desktop tray
      ... Verify that notifications are enabled on the client (Printers Folder, File, ... Server Properties Advanced) ... If these are connections to a server and the firewall is enabled, ... How to Open Ports in the Windows XP Internet Connection Firewall ...
      (microsoft.public.windowsxp.print_fax)
    • Re: Home network problem
      ... I think part of the issue has been a firewall issue. ... top computer running windowsxp professional with a lyksys wireless router. ... All were able to access the internet and share folders and printers ... setting up the same type network i had before and was only able to get the ...
      (microsoft.public.windowsxp.network_web)