Hacking attempt

[kathanon]

I was horrified to come in to work yesterday and on checking the security logs, find attempted logons as administrator, and then guest (which is disabled) This is the first time this has happened.

What I did was look at the firewall logs and marry up the IP addresses with the W2K server event log, look up the IP address and report the attempts to the person's ISP.

I did try changing the administrator account name, but I had crashes and server freezes so am reluctant to try again, I used the policies too. I wonder if there are any other steps I can take to harden the server.

Thanks

Kathy

 

[kathanon]

I should have added that I have accounts set to lock out after a few attempts and use complex passwords and require admin resetting of the counter. I am also wondering if there is any way I can tell if the person was successful and got into the system. I have failed logon attempts set and am assuming that as they first attempted admininstrator and then guest, that they didn't manage to gain access. It did give me a bit of a shock to see it all in the logs

Thanks

 

[hoinvip]

Hi there,

My immediate thoughts / responses to this are as follows:

1. Set logging ON for successful logons as well as failed ones. Additionally, you could rename the Admin account to something less obvious and delete / disable the guest account.

2. W2K auditing is a useful weapon in monitoring your server - you can enable disk and file access logging for sensitive information if you wish.

3. You mention that you've checked your firewall logs - can you provide some more info about what you're using? It sounds as though your firewall might not be blocking as much access as it should.

4. Depending on your organisation's size and security budget, you may wish to give some serious consideration to getting a security audit / hardening performed on your systems and investing in a stronger firewall.

Hope this helps,

HoinviP

http://www.global-net.co.uk