Setup: 11 Windows7 Workstations, Windows 2008 SBS SP2, Cisco Router

Yesterday I RDP'ed to my long running admin session in Windows SBS 2008 to find this security alert waiting:

Security Alert

Clicking on "View Certificate" reveals this:

enter image description here

And the actual details:

enter image description here

Even though there are minimal references online, investigating the site's DNS reveals it's probably legit.

My main concern is why am I getting this alert since:

  1. No one logged on the server since the last time I did (16/01) (according to TerminalServices-Gateway log - also just discovered TerminalServices-RemoteConnectionManager is for some reason disabled)
  2. I am the only one using that account
  3. IE wasn't running and browsing history was exactly as I left it many days ago
  4. I can't think of anyone in my organization that would access that specific website

And the obvious one: has our server been compromised?

Some more context:

This is the second time I get an orphan certificate alert dialog when connecting to my RDP session (the server has been restared since). First time, it was for the website "sydneythomas.com" (some "jewelry store" back in October 2016, now domain parked). I reported this to the company responsible for our IT support, and their verdict was that "someone used the sidneythomas.com to test something" which is just ridiculous and completely out of context.


Upon closer examination I realized the source of the alert is Java Updater Service security alert (Process Explorer says C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe). Also found this superuser question (yes still shamefully on Java 7 version 21), but was unable to find the specifics of said exploit. At this point besides patching Java, I'm trying to understand the attack vector. A scan of jusched.exe with virustotal says it's clean and I can't see anything out of the ordinary with this file.

  • It might not really be an attack; it might be the 7u21 jusched used (possibly as a fallback?) an IP address that was assigned to Sun in 2013 but has since been reassigned to someone else. You might let Wireshark (or netsh trace if you prefer) try to catch the affected traffic and see exactly where it is being sent and if that is the correct address. – dave_thompson_085 Jan 27 '17 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.