Here is a method to block RDP hacking attempts

[richatal5soft]

Re: Here is a method to block RDP hacking attempts

Thanks Eric and also for the PM link. On a side note, I was amazed that I could understand the Dutch posting with my English and German knowledge only.

I found a link explaining those "anonymous logon" events.

http://serverfault.com/questions/192...rity-event-log

Looks like we have to talk to Zebrahost about it.


I also found this conversation between the creator of RDPGuard and a netter interesting.

http://www.bitsdujour.com/software/rdpguard/

We will definitely be installing the Guard.

[SNusa]

Re: Here is a method to block RDP hacking attempts

I'd like to add one following simple way to deter brute force attacks for automated login attempts: (And it's built right into windows)

Most of you probably know this, but:
There is a registry setting, actually use local security policies under administrative tools in the control panel. (Policy editor).
Under security settings -> account policies -> account lockout policy there are several settings of interest:

You can limit the amount of failed logins (to like 3) and then lock this account for 30 minutes lets say....
It won't stop an educated person from getting in, but it will certainly throw water on the fire when an automated service is trying to break in.

[bea2701]

Re: Here is a method to block RDP hacking attempts

I'd like to add one following simple way to deter brute force attacks for automated login attempts: (And it's built right into windows)

Most of you probably know this, but:
There is a registry setting, actually use local security policies under administrative tools in the control panel. (Policy editor).
Under security settings -> account policies -> account lockout policy there are several settings of interest:

You can limit the amount of failed logins (to like 3) and then lock this account for 30 minutes lets say....
It won't stop an educated person from getting in, but it will certainly throw water on the fire when an automated service is trying to break in.

You don't want [non] educated person from getting in to your systems
Windows allways start as session to the loginproces then aks for the user credentials

[SNusa]

Re: Here is a method to block RDP hacking attempts

You don't want [non] educated person from getting in to your systems
Windows allways start as session to the loginproces then aks for the user credentials

Sure, but whats your point? If they [educated people as opposed to automated scripts] guess a simple password, they will get in, and it's your ignorance that cased this as a result of the "easy-to-guess" password you have chosen. ~What my suggestion provides is defense against brute force automated login attacks. I implemented this about 3 years ago after "something" kept trying to [unsuccessfully] break in to one of my boxes at a hosting location.

Once an automated process gets hold of your box and decides it wants in, it will try over and over again via brute force to "guess" the login. A simple setting in the policy editor will prohibit this from happening. ~With the settings I recommended, after 3 invalid attempts, the account becomes locked down automatically for a specified amount of time.

At the time this occurred, I first enabled firewall logging and saw literally thousands of unsuccessful break-in attempts.... After adding these settings, they attackers quickly gave up and [presumably automatically] moved to easier targets/systems..... When this attack attempt occurred, fortunately I had previously renamed my primary Administrator account, and that's what probably saved the day..... The attacking computer had to guess both password & login..... (And they were assuming a valid user ID was "Administrator" ~ NOT!!!)

Simple lesson here: Always rename the Administrator account (which can also be done via the policy editor) and defend your system against repeated incorrect login attempts. It's just smart. I can't think of any reason not to do so, as "defense comes in layers."

PS: I'm pleased that in this particular post, "I actually sound smarter than I am!"

[richatal5soft]

Re: Here is a method to block RDP hacking attempts

This (lock out after x attempts) does not seem to work if the attempts are made with a username which is unknown to the system.
Of course there is no harm possible, but they still fill up the security log.
I'm still getting one or two per night, since I changed my RDP port. I guess they already knew I had RDP before and simply scanned all the ports?
E.g.

An account failed to log on.

Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0

Logon Type: 3

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: Administrador
Account Domain: FXNB

Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc0000064

Process Information:
Caller Process ID: 0x0
Caller Process Name: -

Network Information:
Workstation Name: FXNB
Source Network Address: 93.155.131.236
Source Port: 2113

You don't want [non] educated person from getting in to your systems
Windows allways start as session to the loginproces then aks for the user credentials

Sure, but whats your point? If they [educated people as opposed to automated scripts] guess a simple password, they will get in, and it's your ignorance that cased this as a result of the "easy-to-guess" password you have chosen. ~What my suggestion provides is defense against brute force automated login attacks. I implemented this about 3 years ago after "something" kept trying to [unsuccessfully] break in to one of my boxes at a hosting location.

Once an automated process gets hold of your box and decides it wants in, it will try over and over again via brute force to "guess" the login. A simple setting in the policy editor will prohibit this from happening. ~With the settings I recommended, after 3 invalid attempts, the account becomes locked down automatically for a specified amount of time.

At the time this occurred, I first enabled firewall logging and saw literally thousands of unsuccessful break-in attempts.... After adding these settings, they attackers quickly gave up and [presumably automatically] moved to easier targets/systems..... When this attack attempt occurred, fortunately I had previously renamed my primary Administrator account, and that's what probably saved the day..... The attacking computer had to guess both password & login..... (And they were assuming a valid user ID was "Administrator" ~ NOT!!!)

Simple lesson here: Always rename the Administrator account (which can also be done via the policy editor) and defend your system against repeated incorrect login attempts. It's just smart. I can't think of any reason not to do so, as "defense comes in layers."

PS: I'm pleased that in this particular post, "I actually sound smarter than I am!"

[SNusa]

Re: Here is a method to block RDP hacking attempts

I forgot to mention the notion about changing the RDP default port.
The other thing you can do is set your system so that it will only allow RDC from specific IP's.

If you use remote backup services, there is also a company called KineticD that includes a separate RDC service built right into their backup client.
(Then you must use their backup client on on your system to log in through their service on your server. I haven't tried it yet, but I think you can disable the built in windows RDC services & ports and their "flavor" of RDC will still work.) ~ Works great except the screen sizing isn't as comprehensive......

Using this method, you can [presumably] keep all your inbound ports closed, and a standard windows remote desktop session won't see your box.... (In theory, I believe that only a successfully logged in KineticD user who knows your box is there (and knows the name of the Kinetic-D login account name can gain access.) And since the service is always running on your box, the port is "occupied and in use" (talking to KineticD) at all times. ~ Service starts at about $7/mo. ~ For what it's worth, I have no affiliation with Kinetic-D, and actually prefer the cheaper SpiderOak service for automatic remote backups. (~$75/year for 100 gigs as I recall, and the more you get the cheaper it is.)

[waldhorn]

Re: Here is a method to block RDP hacking attempts

Lenny, yes every place I looked said VPN or to change the RDP port. I pushed those aside to find the lazy man's solution.

Back in October, I noticed that my terminal server's security log was filling with numerous brute force logon attempts. I found that it took just a few minutes to change the RDP listening port on my Windows terminal server, update the RDP port on my Sonicwall firewall and add a port suffix on our RDP clients. And, like magic, not a single unauthorized outside logon attempt has been logged since then. Fortunately, this 'security through obscurity' method has worked well for me, at least for now.

[kkfin]

Re: Here is a method to block RDP hacking attempts

One good feature with true cloud servers (like amazon ec2 or leaseweb cloud) is that they have built in extra firewall that you can directly control from your cloud panel. (You do not have to pay any extra to get one. It is a basic feature)

Put new tcp rule to allow just your ip to rdp port (default 3389). Done.

This extra firewall is also nice feature when you are testing your application live. Again allow just your ip to tcp port 80/443.

[Clipper87]

Re: Here is a method to block RDP hacking attempts

Another approach is to stop using RDP & use Teamviewer instead. Teamviewer offers both remote control & & very good software VPN solution.

[Deniss_S]

Re: Here is a method to block RDP hacking attempts

Interestingly, I tested three tools to stop RDP password guessing attacks, which are RDPGuard, syspeace and Anti ddos guardian. I tried all the three tools
and found that all work great to stop RDP brute force attacks. In addition, RDPGuard and syspeace utilize Windows default firewall while anti ddos guardian comes
with it's own firewall.

[jamerson]

Re: Here is a method to block RDP hacking attempts

i've checked my eventvwr on my domain controller and found this ,
192.168.4.x is my local netwrok.

An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Type:			3

New Logon:
	Security ID:		ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x21bef51
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	KANTOOR
	Source Network Address:	192.168.4.8
	Source Port:		50753

Detailed Authentication Information:
	Logon Process:		NtLmSsp 
	Authentication Package:	NTLM
	Transited Services:	-
	Package Name (NTLM only):	NTLM V1
	Key Length:		128

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested

.

[DoronF]

Re: Here is a method to block RDP hacking attempts

Hi All,

I found a great detailed link of how to change the RDP port and allocate specific IP Address to it.

http://www.iteezy.com/change-rdp-338...erver/qc/10098

In my case it was good enough to change the port number.

Regards,

Doron
The Farber Consulting Group, Inc.

Web site: http://www.dFarber.com
MS SQL Blog: http://www.dfarber.com/computer-consulting-blog.aspx
Convert Ms Access to Web
MS SQL Remote DBA
Alpha Five Development

[ZebraHost]

Re: Here is a method to block RDP hacking attempts

We like RDPGuard because not only does it block unauthorized RDP access attempts but it blocks the culprit from ALL services. If a hacker is trying to access via RDP it is likely they are also probing other ports including ftp. Also you can whitelist/blacklist and get some limited reporting.