attack on port 1433

[Midorimachi]

Im not really sure if i posted it on right section.
I need some help from you experts.

218.95.66.26 12-28-2012 07:26:51 1433
123.30.169.68 12-28-2012 08:43:34 1433
125.64.34.107 12-28-2012 10:22:15 1433
67.229.57.178 12-28-2012 10:41:37 1433
117.40.253.162 12-28-2012 23:43:39 1433
61.160.212.173 12-29-2012 01:02:58 1433
112.200.22.152 12-29-2012 10:57:06 80
69.198.80.158 12-30-2012 15:59:21 1433
176.227.212.75 12-30-2012 18:09:31 1433
118.244.130.21 12-30-2012 22:12:54 1433
210.209.120.48 12-30-2012 22:19:21 1433
219.235.8.241 12-30-2012 22:42:29 1433
219.235.8.241 12-30-2012 22:42:39 1433
111.241.56.15 12-31-2012 00:14:20 80
203.250.108.42 12-31-2012 02:15:35 1433

I found lots of logs on my anti dos and kiwi guard program.
I thought those softwares can block any small attack.
I am having trouble with my server because of this problem.
Any idea on how to block those attacks?

 

[Justice For All]

Moved to the help section, I am posting presuming you have not Googled this already, but you can

You must be registered to see links

out, somebody a while ago had a similar issue with a Ran server that never got answered so hopefully somebody if not my link can help you out.

 

[Solaire]

Port 1433 = Remote Desktop Service.

It's just a botnet scanning your Remote Desktop Service for vulnerabilities such as the one explored earlier this year and would allow them to take over your server. Servers get potscans like this all day long, not limited to SSH, Remote Desktop Service, POP3, SMTP and FTP services.

 

[Midorimachi]

Thank you for moving the thread si Just.
Is there any way to stop it?
Ive been reading many threads about this and cant find any solutions yet.

What if i change the default port? What will happen?

 

[Junkers]

Whilst my knowledge of Networking isn't excellent I'd have imagined if you changed the port then you'd stop getting the errors as only that one particular port seems to be getting targeted. Shouldn't cause any hassles changing the port unless you use RDS frequently

 

[Solaire]

Thank you for moving the thread si Just.
Is there any way to stop it?
Ive been reading many threads about this and cant find any solutions yet.

What if i change the default port? What will happen?

That'd work unless they do a wide range port scan which would cover all ports. Pick a unique port, preferably somewhere in the 20000+ range and you should get rid of those messages.

 

[Midorimachi]

Ok thank you for that advice sir. i will try to change it and see what will happen,
Too tired of restarting always my dds to fix id does not exist problem for my server since my mssql is always been off because
of that port 1433 attack

 

[Ron]

port 1433 = remote desktop service.

It's just a botnet scanning your remote desktop service for vulnerabilities such as the one explored earlier this year and would allow them to take over your server. Servers get potscans like this all day long, not limited to ssh, remote desktop service, pop3, smtp and ftp services.

mssql**.

 

[Midorimachi]

Yes its mssql . I tried to change the port, but what happened now is the accounts ingame cant connect to my db.

 

[Lapje]

gotta change the port in the source files. Look for a file with Database in the name and a variable called port. Change it from 3306 (I believe?) to your new port.

 

[Solaire]

mssql**.

Indeed, no idea how I mixed that up.

Yes its mssql . I tried to change the port, but what happened now is the accounts ingame cant connect to my db.

Add your port number using a comma. E.g.: 127.0.0.1,8999 for port 8999 (or use a : for non-ODBC connections).

 

[Midorimachi]

What if i block port 1433 using inbound and outbound firewall?

 

[Ron]

The correct way is to block on all IP addresses, then have host definitions, such as allowing port 1433 only from 127.0.0.1 and your website IP (if you have one).

 

[Midorimachi]

@sir ron, how to do that?
Inbound and outbound firewall i block all connection on port 1433 but still
the same problem

 

[MentaL]

i would simply close all third party ports and only whitelist your own.

 

[Solaire]

@sir ron, how to do that?
Inbound and outbound firewall i block all connection on port 1433 but still
the same problem

Disable all rules at Windows Firewall (except for Remote Desktop Connection of course), then add a new rule, select TCP port, enter 1433, select block all connections, add the rule, go to properties then add allowed IP addresses to the local scope and select "allow only these IP's to connect".

i would simply close all third party ports and only whitelist your own.

Windows firewall has all ports closed by default.

 

[Midorimachi]

Both Inbound and outbound sir? Ok thank you. Ill let you know if still i encounter the problem

Thanks to all your help

 

[Solaire]

Both Inbound and outbound sir? Ok thank you. Ill let you know if still i encounter the problem

Thanks to all your help

Just inbound, you don't need to block outgoing connections to port 1433.

 

[Midorimachi]

for 1 day it was working fine and now i am having the same problem again.

You must be registered to see links

 

[Solaire]

for 1 day it was working fine and now i am having the same problem again.

You must be registered to see links

Show me a printscreen of your firewall rule, preferably of all tabs.