Here is a method to block RDP hacking attempts

[Steve Wood]

I have been looking for some method to block the tens of thousands of brute force hacking attempts on the couple servers where I host Alpha Five web apps. Its not that I think they will ever hack my password, but when they hit it takes up more than half of my CPU with several attempts per second over a sustained period of time. If you are not familiar with this kind of attack, go to Computer Management on your server, find the Event log for Security and look for a ton of Audit Failure records. Most of the attempts are to gain access to my Remote Desktop service.

Anyway, the product is RDPGuard and found at http://rdpguard.com/

Simple concept - if someone hits my server X times with a bad username/password it blocks their IP for X hours.

[ZebraHost]

Re: Here is a method to block RDP hacking attempts

Sounds like a great solution Steve. We will download the trial version and test it.

[Steve Wood]

Re: Here is a method to block RDP hacking attempts

Here is an example only 8 hours after I installed the RDP blocker. On the left are about 20 Audit Failure's and on the right the five hacker IP's. RDPGuard blocked them after 4 or 5 failed attempts. Without the blocker in place, there would be many, many thousands of Audit Failures by now, each of them stealing a bit of performance from my users.

Since I think it is useful, if anyone wants to purchase this item, I quickly built an "Other Products" page on IADN. This will be for 3rd party utilities, not built by Alpha Five Developers.

The address is: http://www.alphadevnet.com/other_products.a5w

[glenschild]

Re: Here is a method to block RDP hacking attempts

Hi Steve

It is a great solution, I have it on a couple of VPS's and it works!

[kkfin]

Re: Here is a method to block RDP hacking attempts

It is funny how we trust everything that is in net. We install software and try it without knowing anything about company and their background. The company has been since 2007 but where are other products? RDPGuard seems quite new product. Although Idea is good behind this software I must say I don't have courage to install and try it.

[bea2701]

Re: Here is a method to block RDP hacking attempts

Ken,
The correct ANSWER you sholuld NOT TRUST anything on WWW.
Issue in this part that users (administrators)on vps trust MS what is a fake trust
the problem is not new see msdn august 2011, or simple Google.
Beside this even "RDPGuard will hold fake users", if your running OOA php versions on your server(s) without patches installed incl. to Mysql even RDPGuard has no means.
Perhaps >97% of your systems services are secure and the rest needs detailed attention

m2p

[Steve Wood]

Re: Here is a method to block RDP hacking attempts

I guess you have choose who to trust. So far RDPGuard has blocked 45 IP addresses of hackers trying to brute-force hack in to my Remote Desktop. That is roughly 200,000 hit on my website that have been thwarted. It would probably take 100 million brute-force attempts on my RDP to guess the password (I should run a contest), but if any of those actually DID crack my Remote Desktop, my data would be exposed.

RDPGuard has no way to send any information out of my server if that is what you are thinking. I would have to add it as an outbound exception to my Firewall.

[Lenny Forziati]

Re: Here is a method to block RDP hacking attempts

RDP really should not be publicly exposed anyway. At a minimum, RDP access should only be allowed from known source IP addresses, but you really should have a VPN in front of anything like RDP.

[Steve Wood]

Re: Here is a method to block RDP hacking attempts

Lenny, yes every place I looked said VPN or to change the RDP port. I pushed those aside to find the lazy man's solution. My experience with VPN (via clients) has always been a pain, is there a decent not-such-a-pain VPN solution?

[bea2701]

Re: Here is a method to block RDP hacking attempts

There are alternatives like teamviewer.com free for non commercial use that as optional serieus alternative between basic RDP and a VPN backend.
Setup VPN can be a pain in the xxx for most average basic vps users but Lenny is correct as he mentioned in his last post at least use a certificate between client and host on Windows basic RDP. You can install this from the Windows Management Console. Allow only remote access from known remote ip is not a full safeguard unless work from your office 24/7. If your "home" office cable provider provides semi-dynamic ip adress your lost or you need access to your vps from a ipad (out of office) the connection is refushed based on your remote VPS config settings at the vps.

[richatal5soft]

Re: Here is a method to block RDP hacking attempts

Thank you for this information.

I went ahead and looked at our Audit Success entries in the Security Event.
I see some "anonymous logons" as below from machines all over the world.

Does anyone know what this means?

An account was successfully logged on.

Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0

Logon Type: 3

New Logon:
Security ID: ANONYMOUS LOGON
Account Name: ANONYMOUS LOGON
Account Domain: NT AUTHORITY
Logon ID: 0x1f670141
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x0
Process Name: -

Network Information:
Workstation Name: TJASERVER
Source Network Address: 200.87.35.194 (from Bolivia)
Source Port: 3229

Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): NTLM V1
Key Length: 128

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

-------------------------------------------------------------------------------------------

An account was successfully logged on.

Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0

Logon Type: 3

New Logon:
Security ID: ANONYMOUS LOGON
Account Name: ANONYMOUS LOGON
Account Domain: NT AUTHORITY
Logon ID: 0x1f557845
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x0
Process Name: -

Network Information:
Workstation Name: SERVERACGDB2
Source Network Address: 31.195.162.51 (from Italy)
Source Port: 4326

Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): NTLM V1
Key Length: 0

-----------------------------------------------------------------------------------

An account was successfully logged on.

Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0

Logon Type: 3

New Logon:
Security ID: ANONYMOUS LOGON
Account Name: ANONYMOUS LOGON
Account Domain: NT AUTHORITY
Logon ID: 0x1fa787d4
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x0
Process Name: -

Network Information:
Workstation Name: PCOS-10250653
Source Network Address: 110.211.83.27 (from China)
Source Port: 39558

Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): NTLM V1
Key Length: 0

[bea2701]

Re: Here is a method to block RDP hacking attempts

Rich,

check the ip# from the eventlog into RDPGuard grid view is there a row with that acc ip and status blocked ? if not you might [ i say not you have]have a guest on your system change the passwords with very strong passwords and a minimal length of 8# remove any not needed user from the system at least "guest", setup a second systemadministrator user as fallbackup RUN YOUR ANTIVIRUS SOFTWARE TO SCAN YOU ENTIRE SYSTEM.
check the system eventlog or application are there any logevent with the subject "jsshell.php" ? it will search for "proxyserver.* php is PHP installed on iis or apache?
check the A5 access error log file can you see that "red" ip in the log file?

contact me if you need any further help

Eric
check the log in you anti virus application

[richatal5soft]

Re: Here is a method to block RDP hacking attempts

Thanks Eric. I will try to do that.

I had not yet installed the RDPGuard, I sort of wanted to run some system checks first of all.

This is actually a Zebrahosted server with Windows SB2008. IIS is running, but not in use.
Password was 10 characters long, have doubled it.

Nothing else is installed apart from the A5 Appserver. No PHP at all.

We had just started doing some online tests, luckily our web application is benign, nothing much to steal, but nobody wants a compromised host.

Any idea what kind of logons these are and whether they would be expected in such a setting?

Security ID: ANONYMOUS LOGON
Account Name: ANONYMOUS LOGON
Account Domain: NT AUTHORITY
Logon ID: 0x1fa787d4

[bea2701]

Re: Here is a method to block RDP hacking attempts

In fact the A5 appserver is more stable for security then most people think or know, simple follow the security rules and guidelines.
Install the trial from RDPGuard do a crossref check from the eventlog versus blocked.
I am in contact with Clive from Zebrahosting to find out this is the correct tool.
Nothing to steal ? even if the appsserver is secure but your backend DB is not then what? so by example there is the need to have your mysql port open at the vps firewall then anyone can try to connect or are you using a proxy DB to prevent backend sql injections because the only user is full grant "Root" other example My company stores credit card info "that is save in the backend" but is your vps/system PCI/DSL level 4-1 compliant. To complete take steps by full complementation and safeguards rules, if you have other questions send pm.

tx

[kkfin]

Re: Here is a method to block RDP hacking attempts

I must say I did buy the product. What did convince me was their ultimately S3 client.