1

We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network.

Can anybody help me how to isolate and prevent this from happening?

An account failed to log on.

Subject:

Security ID:        NULL SID
Account Name:       -
Account Domain:     -
Logon ID:       0x0

Logon Type:         3

Account For Which Logon Failed:

Security ID:        NULL SID
Account Name:       db2admin
Account Domain:     SAYNAMY-4BF9DFF

Failure Information:

Failure Reason:     Unknown user name or bad password.
Status:         0xc000006d
Sub Status:     0xc0000064

Process Information:

Caller Process ID:  0x0
Caller Process Name:    -

Network Information:

Workstation Name:   SAYNAMY-4BF9DFF
Source Network Address: 37.220.1.6
Source Port:        1046

Detailed Authentication Information:

Logon Process:      NtLmSsp 
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only):   -
Key Length:     0

1 Answer 1

2

It looks like you may be victim of either a targetted attack or a simple script kiddie attack. Basicly someone (SAYNAMY - 37.220.1.6) is trying to authenticate with known DB2 administrator username to your server. A RIPE search excerpt follows:

inetnum:        37.220.1.0 - 37.220.1.63
netname:        RSDEDI-OJEJMBME
descr:          Dedicated Server Hosting
country:        GB
remarks:        ABUSE REPORTS: [email protected]

Important questions:

  • Are you running DB2 on the affected server?
  • Can you track other requests from that IP into your network by looking at e.g. firewall logs?

If you want to FIX this issue I would simply block this IP address in the firewall and the audit failure from this IP should not arrive anymore.

To block the IP address on the servers own interface you can use windows command line like this:

netsh advfirewall firewall add rule name=[NAME HERE] dir=out interface=any 
action=block remoteip=[IP HERE]/32
3
  • The login is happening every seconds. you mean windows firewall? Yes we are running MS SQL 2008
    – Sherry
    Jul 12, 2012 at 7:32
  • Sounds like someone is bruteforcing the db2admin account. I would block the IP address effective immediately unless you know the IP adress that is causing these audit failures. You may also send an email to [email protected] about what is happening to you; you might get some support from them.
    – Chris Dale
    Jul 12, 2012 at 8:00
  • Some more details about the originating IP: iplocationtools.com/37.220.1.6.html
    – Chris Dale
    Jul 12, 2012 at 8:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .