Possible attack on my SQL server?

Question

Checking my SQL Server log I see several entries like this:

Date: 08-11-2011 11:40:42
Source: Logon
Message: Login failed for user 'sa'. Reason: Password did not match for the login provided. [CLIENT: 56.60.156.50]
Date: 08-11-2011 11:40:42
Source: Logon
Message: Error: 18456. Severity: 14. State: 8.


Date: 08-11-2011 11:40:41
Source: Logon
Message: Login failed for user 'sa'. Reason: Password did not match for the login provided. [CLIENT: 56.60.156.50]
Date: 08-11-2011 11:40:41
Source: Logon
Message: Error: 18456. Severity: 14. State: 8.

And so on.. Is this a possible attack on my SQL Server from the Chinese???! I looked up the IP address at ip-lookup.net which stated it was Chinese.

And what to do?

• Block the IP adress in the firewall?
• Delete the user sa?

And how do I protect my web server the best?!

Thanks in advance!

Answer 1

If you have a firewall, why is the database server exposed to the internet?

• The firewall should block all access to BOTH servers apart from the ports required. Typically this would be 80 (http) and 443 (https) to the web server ONLY.
• If (and only if) an external service requires access to the SQL Server, permit access to the specific IP addresses required at the firewall. This should occur via a VPN connection, not openly exposed 1433.
• Create a new administrator account and disable the default 'sa'.
• Preferably, switch from using "mixed mode" authentication to windows accounts.

Answer 2

First thing you should do is report this to the person responsible for network and systems security at your company. If there is no such person, throw this to the network administrator. If there is no such person, call the CIO/CTO right now -- better yet, demand a face to face -- and explain the situation.

The first thing that person should do is block the IP from the firewall. This will buy you a little time, but not much, maybe minutes only. If the IP maps to a range of IPs as reported by WhoIs.net, block the entire IP range given by WhoIs. That will prevent the guy from requesting a new IP from his ISP and getting in with a new IP. For a few minutes, maybe.

Then do what Mark-Storey Smith says above.

Then either add a firewall or move the db from the DMZ. If you already have a firewall and the db is not in the DMZ, you need an immediate forensic check to see if intervening servers between you and the firewall have been compromised (most likely they have). Change ALL admin password to very long complex passwords -- sa, Windows Admin, domain admins, local admins, ALL OF THEM. Then review every server everywhere on your network and delete any admin accounts you don't recognize or any for former employees or consultants that have left the company. Then virus and malware scan everything on every server.

Then make a second pass and check all of the above again one more time.

Good luck.

Answer 3

You should not have any of your servers on the public Internet without having a firewall blocking ALL network access from the Internet to the SQL Servers. If you've got port 1433 open what other ports to do have open? My guess would be that you've got lots of ports open to the Internet and if that's the case you probably have people using your SQL Server for things that you don't want them to.

You need to bring in a professional to look at the systems and get your security fixed ASAP. God only knows if people have successfully broken into the system or not. (Yes I'm a consultant, yes I can do the work, no I'm not saying that you have to hire me.)

At the very least you need to read up on network security and database security (I even have a book on the subject) and get your systems secured.

The steps you basically need to follow at this point are...

1. Setup your firewall to block all inbound connections except those that you actually need
2. Do a VERY good virus scan of the SQL Server. If you don't already have a virus scanner installed on the SQL Server, assume that it's infected and format the machine.
3. Setup the database security following best practices: strong passwords, least permissions, etc.
4. Do a virus scan of every other server at the company. If they don't have virus scanners already installed assume they are infected and format them.

Answer 4

Block all connections to your database which don't originate from your web server(s). Really.

Answer 5

In addition to configuring the firewall to block unauthorized traffic, don't forget to add your windows account to the sysadmin role and DISABLE the SA account! Disable SQL authentication as well.