Brute Force Attack

Hello,
I notice a brute force attack to discover the sa password on a public
SQL Server.
Do anybody know an intrusion detection system that notify when there are
N attempts in N minutes ?
Thanks
Vittorio Pavesi
--
http://www.vittorio.tkVittorio Pavesi ha scritto:
> Hello,
> I notice a brute force attack to discover the sa password on a public
> SQL Server.
> Do anybody know an intrusion detection system that notify when there are
> N attempts in N minutes ?
> Thanks
>
> Vittorio Pavesi
> --
> http://www.vittorio.tk
Ok, I'll develop it by myself...
Vittorio Pavesi
--
http://www.vittorio.tk|||Vittorio Pavesi ha scritto:
> Hello,
> I notice a brute force attack to discover the sa password on a public
> SQL Server.
> Do anybody know an intrusion detection system that notify when there are
> N attempts in N minutes ?
> Thanks
>
> Vittorio Pavesi
> --
> http://www.vittorio.tk
Ok, I'll develop it by myself...
Vittorio Pavesi
--
http://www.vittorio.tk|||Vittorio,
If you use SQL 2005 on a Win2003 server, then the OS security policy can
be configured to allow you to only allow N attempts, then block that IP for
X minutes.
No such luck with SQL 2000 - Microsoft is never going to fix it - the
whole mess started when they released a product with an sa account that
couldn't be deleted or changed with a blank as the default password. This
started a whole industry of nerds breaking into SQL servers. They knew the
account name, and many had blank passwords. Those that didn't, they went
after with a brute force pw attack.
Anyway - what works for me.
Write a 20 line custom program (I use VB .NET but you could use anything)
that is run by the Windows task scheduler every 5 minutes (or whatever). Run
under an admin account. The program does the following
1. Runs netstat -n and dumps the result to a file.
2. Read the file - look for port 1433 - make a list of the ones that are
timing out. Collect the IP numbers of the bad guys.
3. Then run netsh from the custom program to block the IP by adding it to
an existing IP filter list. ie - the command would be (this is for a Win
2003 server)
cmd /c netsh ipsec static add filter filterlist="Block IP Numbers"
srcaddr=CurIP dstaddr=me protocol=ANY mirrored=no
where "Block IP Numbers" is the name of the filter list and CurIP is the IP
you are blocking.
4. Then send an email to yourself from the program
*************************
This is kind of a convuluted way of doing it but it works fine. Why
Microsoft couldn't come up with something more elegant after all these years
is hard to understand. Have fun. - AND - make sure you are using an
impossible sa password - they will never guess it but unless you stop them
they can sure use up a lot of bandwidth trying.
Russ Stevens|||Thanks Russel for your very complete post, I totally agree with you !!
I developed it and released with source code for free.
It's a plugin for HealthMonitor (http://healthmonitor.sourceforge.net)
so you can use its notification and scheduling feature.
The plugin name is CheckSQLSec, to download go to:
http://sourceforge.net/project/show...
se_id=434781.
I hope this will be useful for everybody.
Vittorio Pavesi
--
http://www.vittorio.tk