4

I was asked by a friend, who isn't technical at all, to help her with her application.

I thought I would just being doing a little C# development and some SQL queries. Turns out it has been a lot more than that. Needless to say I've learned a lot.

I've stumbled upon the Server Logs in SSMS. To my surprise there are TONS of failed login attempts. The login attempts are primarily using the username 'sa' but there are others, for example: 'KHB', 'wwo' 'IIS' 'hpv7' 'N200user' 'kisadmin'. These usernames make no sense. I am the only one who should be logging into this database. The error is either.

Error: 18456, Severity:14, State: 8 or  Error: 18456, Severity:14, State: 5

State 8 only happens when the login attempt is for the username 'sa'.

The majority of these attempts are happening between 1am-4am.

This seems real fishy.

Any suggestions on what I should do?

  • Restrict access to your server via IP address? Do you need your SQL Server to be publicly accessible, or just available on an internal company network? – Mark Sinkinson Dec 12 '14 at 9:47
  • Is your database server locked down? is it publicly accessible? If it isn't, I would immediately find out what internal host they are coming from as you might have been compromised, or there's some very old scripts still executing :) – Ali Razeghi Apr 6 '15 at 18:46
2

Looks like somebody is really trying to hack into your SQL Server with brute force attacks. I recommend taking a look at this Whitepaper on SQL Server security, that will help you a lot.

Since most attacks happen at the same time, make sure you don't have a security scanner on your network that runs its checks at that time. Products such as Nessus can perform security scans and simulate brute force attacks on your servers in order to help you fix the security issues they find.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.