Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I use RDPGuard on my webserver. I have noticed that it blocked an IP address which seemed to originate from a Microsoft registered IP address:

Process Information:
Caller Process ID:  0xf78
Caller Process Name:    C:\Windows\System32\winlogon.exe

Network Information:
Workstation Name:   BLAH
Source Network Address: 168.62.177.31
Source Port:        36038

Looking at the rdpguard whois service I can see that this is a Microsoft IP:

WHOIS Source:      ARIN
IP Address:        168.62.177.31
Country:           USA - Washington
Network Name:      MSFT-EP
Owner Name:        Microsoft Corp
From IP:           168.61.0.0
To IP:             168.63.255.255
Allocated:         Yes
Contact Name:      Microsoft Corp
Address:           One Microsoft Way, Redmond
Email:             iprrms@microsoft.com
Abuse Email:       abuse@msn.com
Phone:             +1-425-882-8080 

http://rdpguard.com/free-whois.aspx?src=app&v=1-2-5&fam=x64&affid=self&ip=168.62.177.31

Has anybody seen this before? Does anybody know why this would have happened?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

As SteveS points out below, it is possible that this is a misbehaving Azure server. Azure is a cloud server platform that Microsoft runs. This would also mean that you should really contact the two e-mails on the reverse look-up record. Microsoft would want to know about it whether it is Azure being abused or one of the other problems I originally mentioned.

The only thing that comes to mind is that if the packet that is sent to RDP is significantly shorter than the packet that the RDP server responds with, it is possible this is a ping of death style DOS attack being carried out against Microsoft. Basically the principal is that the attacker makes a small falsified request to one server to get that server to respond to the target with a much larger amount of information. The original ping of death was setting up two servers so that they would constantly interpret the response as a request and respond, which made an infinite loop that would bring one or both victim servers down. There likely isn't a loop condition here, but it is at least one possibility.

That or Microsoft actually has a compromised system in their network and is being used as a bot, which is also entirely possible.

I'm not aware of any general, legit reason why Microsoft would be trying to connect to your RDP. I'd recommend contacting the abuse or iprrms addresses and see what they say.

share|improve this answer
2  
I don't know if the IP range fits, but it could also be coming from a Windows Azure host used for attacks/scanning. –  SteveS Jan 4 '13 at 18:06
1  
I think @SteveS has the right answer. I have an Azure server which is also in the 168.62.* range, so it's definitely possible your attacker was using an Azure server, hence the IP. –  Dana Cartwright Jan 4 '13 at 18:18
    
@SteveS - I updated my answer to include your idea and explain a little about what Azure is and what to do if that is the case. I'm guessing that is the most likely too as the other scenarios are fairly unlikely in comparison. –  AJ Henderson Jan 4 '13 at 18:51
add comment

Sometimes, whois tools do not tell you the real information of IP addresses. Most Windows servers suffers RDP brute force attacks. One of my servers gets about 10 RDP attacks every day, even it is only a test server and there is no applications run on that server. I use anti ddos guardian instead, which stops RDP attacks and slow http ddos attacks.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.