Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network.

Can anybody help me how to isolate and prevent this from happening?

An account failed to log on.

Subject:

Security ID:        NULL SID
Account Name:       -
Account Domain:     -
Logon ID:       0x0

Logon Type:         3

Account For Which Logon Failed:

Security ID:        NULL SID
Account Name:       db2admin
Account Domain:     SAYNAMY-4BF9DFF

Failure Information:

Failure Reason:     Unknown user name or bad password.
Status:         0xc000006d
Sub Status:     0xc0000064

Process Information:

Caller Process ID:  0x0
Caller Process Name:    -

Network Information:

Workstation Name:   SAYNAMY-4BF9DFF
Source Network Address: 37.220.1.6
Source Port:        1046

Detailed Authentication Information:

Logon Process:      NtLmSsp 
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only):   -
Key Length:     0
share|improve this question
add comment

1 Answer

It looks like you may be victim of either a targetted attack or a simple script kiddie attack. Basicly someone (SAYNAMY - 37.220.1.6) is trying to authenticate with known DB2 administrator username to your server. A RIPE search excerpt follows:

inetnum:        37.220.1.0 - 37.220.1.63
netname:        RSDEDI-OJEJMBME
descr:          Dedicated Server Hosting
country:        GB
remarks:        ABUSE REPORTS: abuse@redstation.com

Important questions:

  • Are you running DB2 on the affected server?
  • Can you track other requests from that IP into your network by looking at e.g. firewall logs?

If you want to FIX this issue I would simply block this IP address in the firewall and the audit failure from this IP should not arrive anymore.

To block the IP address on the servers own interface you can use windows command line like this:

netsh advfirewall firewall add rule name=[NAME HERE] dir=out interface=any 
action=block remoteip=[IP HERE]/32
share|improve this answer
    
The login is happening every seconds. you mean windows firewall? Yes we are running MS SQL 2008 –  Sherry Jul 12 '12 at 7:32
    
Sounds like someone is bruteforcing the db2admin account. I would block the IP address effective immediately unless you know the IP adress that is causing these audit failures. You may also send an email to abuse@redstation.com about what is happening to you; you might get some support from them. –  Chris Andrè Dale Jul 12 '12 at 8:00
    
Some more details about the originating IP: iplocationtools.com/37.220.1.6.html –  Chris Andrè Dale Jul 12 '12 at 8:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.