1

We run a small office network with Windows SBS 2011 and Draytek Vigor 3300 router. We recently had a ransomware attack in which it currently appears the payload was run on the SBS server itself.

Since no users log in to the machine, and it doesn't run email client or a web browser, the most likely loophole would appear to be some remote desktop session or other access through the VPN ports.

We had these open, NAT redirected to the server:

UDP

  • 1723
  • 500
  • 4500
  • 2883

TCP

  • 1723
  • 50
  • 3389
  • 22

Is this a reasonable attack point, or should I be looking elsewhere? As additional evidence, the attack appeared to take place out of office hours with all client pc's turned off. The only other components would be the router, switches, printers etc. With hindsight, the router and administrator passwords might have been susceptible to brute force attack - although the server was set to 30s before permitting a failed password retry, making that seem very unlikely.

  • 1
    SBS stands for Windows Small Business Server which has since been renamed to Windows Server Essentials. – Daisetsu Mar 25 at 17:38
  • While there are common port numbers associated with specific services, listing port numbers themselves isn't super useful. Many services can be configured to run on non standard ports. – Daisetsu Mar 25 at 17:41
  • 1
    Check your remote desktop settings (Local Resources tab). A user may have selected their local drive to be usable on the remote machine, or they could be sharing their clipboard. Both are ways a malicious file could reach your network. – Daisetsu Mar 25 at 17:46
3

You're over thinking how the server got infected. Instead of jumping to remote desktops or VPNs, look at what currently is open on it.

By your own admission, it has open ports and is NAT'd to the outside world, are you sure that it is patched and updated? If it doesn't run mail, why is port 50 open on it? That is a remote mail checking port. Why is SSH open on the server as well?

  • SBS is a bit of a multipurpose platform for small businesses. It's a mail server and also the VPN server, and it also provides an http webmail access via /owa which is a standard Microsoft setup - hence it's standard to have these ports open in this deployment. – samerivertwice Mar 25 at 17:42
2

RDP ports are the #1 attack vector for ransomware, so it is highly likely that a session was brute forced or pass-the-hashed. If you are using RDP, access should be limited to a whitelisted subset of IP addresses, via VPN, with 2FA to login as well.

  • Yes, this corresponds with my experience too and is what I think was the attack vector on this occasion. – samerivertwice Apr 10 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.