Getting Brute Force Attacks on MS SQL Server, Urgent Help Needed

Question

Getting Brute Force Attacks on MS SQL Server, Urgent Help Needed

Mohit Anand 1

Hi,

We have a Dedicated Godaddy Server running Windows Server 2012 accessible through remote desktop. We are getting a lot of IP brute force attacks on the server with these error codes:

Event ID: 4625, Audit Failure

Event ID: 10016,_DISTRIBUTEDCOM

These errors are getting repeated almost every second. The MS SQL is now using over 50% in CPU and RAM and the server is responding very slow.

How do I resolve this.

Please help.

Bjoern Peters 8,921 Reputation points

2022-07-18T21:24:58.383+00:00

What I do not understand... you are talking about an open RDP-Port - which is necessary to administer your GoDaddy server - so you cant close it...

So someone can access your server if he has the specific IP address and a user/password to logon... if that user he has to logon is a local administrator (or at least someone with higher rights) then he can do crazy stuff on your server... but that has nothing to do with a brute force, and I don't think that someone can redirect a communication via RDP port to start a Windows service...

And those messages from eventvwr do not really correlate with an attack or an open RDP port...

Maybe I am missing something...

2 answers

Your answer

Bjoern Peters 8,921 Reputation points

2022-07-18T21:24:58.383+00:00

What I do not understand... you are talking about an open RDP-Port - which is necessary to administer your GoDaddy server - so you cant close it...

So someone can access your server if he has the specific IP address and a user/password to logon... if that user he has to logon is a local administrator (or at least someone with higher rights) then he can do crazy stuff on your server... but that has nothing to do with a brute force, and I don't think that someone can redirect a communication via RDP port to start a Windows service...

And those messages from eventvwr do not really correlate with an attack or an open RDP port...

Maybe I am missing something...

Answer 1

Why do you think that this is an attack?

Knowing nothing about your environment and just "judging" on your screenshots...

Do you really need that SQL Service "Replay Agent"?
From everything I know this just looks like you are doing something on your server that wants to access something that is not running right now and cannot be started because of an security/permission issue.

According to this post
https://learn.microsoft.com/en-us/troubleshoot/windows-client/application-management/event-10016-logged-when-accessing-dcom
the errorid itself is nothing dangerous and on a first view "normal" (if you don't have such permissions)

your 4625 in combination with 10016 seems also to be normal because a login attempt was logged because it failed... in this scenario I would suggest it is a user that wants to start a specific service...

yes, in a compromised environment that might be an attacker, then your first point of connection should be GoDaddy and not a Microsoft Community Forum...
If it is a DDOS attack also contact GoDaddy as they are responsible for the underlying network infrastructure.

From my point of view: "Take a deeper look into your application, why and who is somebody trying to start regularly that "Distributed Replay Agent" and those permissions."

Mohit Anand 1 Reputation point

2022-07-18T23:08:25.5+00:00

Every single request is coming from different IP addresses, no0ne of them our own.

GoDaddy says they have no control over a dedicated server. It will have to be fixed by us.
Erland Sommarskog 121.4K Reputation points MVP Volunteer Moderator

2022-07-19T08:33:23.917+00:00

Every single request is coming from different IP addresses, no0ne of them our own.

Yes, that is what you can expect when expose SQL Server on the Internet. There will be lots of people knocking on the door, trying to get in.

Answer 2

Erland Sommarskog 121.4K MVP Volunteer Moderator

Exposing SQL Server on the internet is an utterly bad idea. If you need to access SQL Server remotely, set up a VPN connection. If you only need to access SQL Server from the local Godaddy server, disable TCP/IP for SQL Server Configuration Manager.

Mohit Anand 1 Reputation point

2022-07-19T13:03:43.33+00:00

What are the consequences of disabling TCP/IP? We have our websites and databases set up on the dedicated server. When we disable TCP/IP, the websites will continue to run right?
Bjoern Peters 8,921 Reputation points

2022-07-19T16:29:14.867+00:00

You are just disabling the TCP-Listener for your SQL Server not for the whole server!
SQL Server Configuration Manager - Network Protocols - Disable TCP/IP
https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/enable-or-disable-a-server-network-protocol?view=sql-server-ver16
Erland Sommarskog 121.4K Reputation points MVP Volunteer Moderator

2022-07-19T16:35:19.85+00:00

I see that there was an extraneous small word in my Answer, which I've deleted. I meant to say SQL Server Configuration Manager. That is, as Bjoern says, it's only a matter to disable TCP/IP for SQL Server.

If you have your web server running on the same machine this not an issue for you. But a consequence is that you cannot connect through SSMS or Excel from your local PCs. To do this you need to RDP into the server. If you need to do this, you should set up a VPN connection (which I kind of guess that GoDaddy may be able to help you with.)

Share via

Getting Brute Force Attacks on MS SQL Server, Urgent Help Needed

2 answers

Your answer