Setup: 11 Windows7 Workstations, Windows 2008 SBS SP2, Cisco Router
Yesterday I RDP'ed to my long running admin session in Windows SBS 2008 to find this security alert waiting:
Clicking on "View Certificate" reveals this:
And the actual details:
Even though there are minimal references online, investigating the site's DNS reveals it's probably legit.
My main concern is why am I getting this alert since:
- No one logged on the server since the last time I did (16/01) (according to
TerminalServices-Gatewaylog - also just discovered
TerminalServices-RemoteConnectionManageris for some reason disabled)
- I am the only one using that account
- IE wasn't running and browsing history was exactly as I left it many days ago
- I can't think of anyone in my organization that would access that specific website
And the obvious one: has our server been compromised?
Some more context:
This is the second time I get an orphan certificate alert dialog when connecting to my RDP session (the server has been restared since). First time, it was for the website "sydneythomas.com" (some "jewelry store" back in October 2016, now domain parked). I reported this to the company responsible for our IT support, and their verdict was that "someone used the sidneythomas.com to test something" which is just ridiculous and completely out of context.
Upon closer examination I realized the source of the alert is Java Updater Service (
Process Explorer says
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe). Also found this superuser question (yes still shamefully on Java 7 version 21), but was unable to find the specifics of said exploit. At this point besides patching Java, I'm trying to understand the attack vector. A scan of
virustotal says it's clean and I can't see anything out of the ordinary with this file.