Recently i am facing some slow issue for my web application. And i have check my visitor report and it shows normal traffic rate as usual. And then i check my db login auditing and find below login failed logs.

Previously I have enabled remote access (Ms SQL Server > Connection > Allow remote access to this server) for personal purpose. But I have disabled remote access option at the moment but not sure whether it helps.

Does it means someone trying to hack my db? Anything else i can do in order to prevent this?


I am getting this kind of errors in random time with each time consists of 100-500 failed attempts(last for 1-2 minutes). Random time for today as below:

01/19/2014 18:41:29
01/19/2014 16:59:44
01/19/2014 15:50:56
01/19/2014 14:59:43
01/19/2014 07:02:33
01/19/2014 05:34:45
01/19/2014 01:25:49

Eg data:

01/19/2014 18:41:30,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 7.
01/19/2014 18:41:29,Logon,Unknown,Login failed for user 'hbv7'. Reason: Could not find a login matching the name provided. [CLIENT:]
01/19/2014 18:41:29,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 5.
01/19/2014 18:41:29,Logon,Unknown,Login failed for user 'sa'. Reason: An error occurred while evaluating the password. [CLIENT:]
01/19/2014 18:41:29,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 7.
01/19/2014 18:41:28,Logon,Unknown,Login failed for user 'hbv7'. Reason: Could not find a login matching the name provided. [CLIENT:]

enter image description here

Most of the errors are login failed for user 'sa'

  • 4
    Yes looks like a dictionary attack against those accounts. is a Chinese IP address BTW. – Martin Smith Jan 19 '14 at 13:40
  • woah why do you have your DB open to the public internet? Secondly, it looks like they are only use 'sa' and 'hbv7', so the question is, is there a hbv7 user? If there is then they know your user names which means your security is already some how compromised. Whether it's social engineering, disgruntled employee, stolen user name list, something. Do you have a user by that name? – Ali Razeghi Apr 27 '15 at 19:58

Some steps to reduce these vulnerabilities can be found here:

  1. Disable the login that is being attacked. In most cases, the login would be a generic sa or admin account. This will disable access to the account. However, the server may still be vulnerable to outside attacks.
  2. Change name of the account that is being attacked. For instance, change the sa account to sa_databasename in order to make it harder to guess a high level account name.
  3. Change the port from the default 1433 to a random port in order to make it less predictable to find the port that the server is listening to.
  4. Change the firewall settings to only allow know IP addresses to get through the security system.
  5. Implement a strong password policy and make sure that the passwords expire on a frequent basis.
| improve this answer | |

That looks like a brute force living attempt. As it is coming from a publicly routable IPv4 address that implies you database server is visible to the world which is generally a bad idea. Of you need remote access for any reason (and there are valid reasons to need this, of course) then you should only open access through you firewall from a specific address (the one (s) you need to access it from) instead of making it open to the world. Even better: don't make the database server accessible to the outside at all, instead setup a VPN so that you can access it as if local but the outside world knows nothing. That way to know communication is encrypted and double authenticated (SQL Server supports encryption natively if you set things up right but other databases don't and the VPN option can give secure access to many other things if needed).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.