Logon attacks: how do attackers get my usernames? And what to do against it?

hi,
have lots of automated logon attacks. due circumstances can't change, server (windows server 2008 r2) has public ip , not placed behind firewall.

how attacker accounts? , can prevent it? passwords strong enough resist, the  users complain locked out accounts.

 
here like:

account failed log on.

subject:
    security id:        null sid
    account name:        -
    account domain:        -
    logon id:        0x0

logon type:            3

account logon failed:
    security id:        null sid
    account name:        john doe
    account domain:        ustlimia

failure information:
    failure reason:        unknown user name or bad password.
    status:            0xc000006d
    sub status:        0xc000006a

process information:
    caller process id:    0x0
    caller process name:    -

network information:
    workstation name:    ustlimia-srv
    source network address:    87.103.xxx.xxx
    source port:        1441

detailed authentication information:
    logon process:        ntlmssp
    authentication package:    ntlm
    transited services:    -
    package name (ntlm only):    -
    key length:        0


[names , ips altered]

in group policies changed settings without success:
network access: allow anonymous sid/name translation -> disabled
network access: not allow anonymous enumeration of sam accounts -> enabled
network access: not allow anonymous enumeration of sam accounts , shares -> enabled


group policy "network access: not allow anonymous enumeration of sam accounts" warns, has no impact
on domain controllers.
mean can't stop this?  windows firewall offer solution?


regards

jens

since have enable firewall check log/traffic....

type netstat -a , check listening port see if have backdoor.

the av first level security, doesn't mean can stop trojan through port 80 ex.

are u sure internal user..?

begin silent investigation.. first check traffic comes from.

dkotix

hello jens,

this scary situation. hate in shoes. please see: http://www.wonderdrug.com/

check windows firewall settings, should not getting network logon type 3 on public interface. problem. ports 137-139, 445 open?

when "users" talking 1 user or more? if attacker has enumerated numerous account names, it's has enumerated ad or ldap. scary. if it's 1, can social engineering tact targeted type of attack. attacker aware of  (or has ide about) valuable information may obtained via user's credentials.

first thing on mind server behind packet filter firewall or off net until things under control. brute force password attack prevail if given enough time. luckily have lockout policy in place , passwords policies. can complain source ip's isp (www.arin.net). getting packet filter firewall recommendation. packet filter firewall, can block source traffic , end of story. check out sonicwall or multi-tech if on budget, reasonably priced ($ 250-400).

to answer question, here's how can enumerate user name(s):

1. social engineering - calling phone, asking ceo's or it's email address send him info, etc.
2. inside user has access ad users list (from outlook, etc.)
3. keystroke loggers and/or network sniffing
4. spyware/malware
5. mailing lists enumeration (db's, chain letters, etc)
6. search engines/unsecured pages / exposed private pages (web sites, web pages, intranets, forms, html, asp, etc)
7. ad/ldap enumeration

check out these links:


hack tools enumerate:

http://netsecurity.about.com/cs/hackertools/a/aafreeenumtool.htm

check open ports using shields up

http://www.grc.com/default.htm

quick relief computing headaches

http://www.wonderdrug.com/



miguel fra / falcon its

---

miguel fra www.falconits.com

Windows Server  >  Security