Logon failure: Hacker attack? 2

[saida]

Hi, I'm getting this event 4183 on application log generated by MSExchangeIMC:

Authentication attempt (AUTH LOGIN) from 211.158.68.216 as \asdf (or 4444444, or 333333, etc) failed: LogonUser() call failed with error: Logon failure: unknown user name or bad password.

It looks like this IP had tried for more than two hundred times yesterday to log on. Can someone suggest me what should I do with this? I feel unprotected.

 

[Spirit]

Hi I get;

Authentication attempt (AUTH LOGIN) from 211.158.32.68 as N/A\webmaster failed: LogonUser() call failed with error: Logon failure: unknown user name or bad password. Also from 211.158.71.45 and a few other IP's.

Usually late at night or at the weekend. I've checked out the machines at these addresses and believe they are nothing but zombie machines but have reported them anyway.

Basically, some one is trying to Hack into your network using the remote access services using an automated hacking tool.

Do your use RAS? If not don't worry, if you do then;

Think about your user names are they easy to guess? Like Frank, sally sue if so consider changing them to Frank.Jones or FJones or something.

Passwords. Make sure all your users that use RAS have strong passwords NOT MARCH01, MARCH05 or Frank001 and make sure you make them change your password.

Users. If its the same guy I doubt it but it will probably be the same sort of attack. Make sure your Admin level accounts are NOT admin, webmaster, support etc if they are consider changing them (remember to make a note of any services being used.).

PATCH PATCH PATCH. Run the MS Security analyser and make sure you are tight on any external facing machine.

Apart from that there really isn't anything pro-active that you can do, I currently have my firewalls just completely ignore any traffic from these address no response no nothing the packets are just dropped.

Iain

 

[saida]

Thank you Iain,
I don't use RAS, but I'll make some changes anyhow. Just reconfigured the firewall and I'm running the Security Analyser. Very helpful, thank you.