Re: EventID 529 Logged 1723 Times in one Day!

Hi David,

1723 is nothing. I have had over 12000 in a day!

I see this on my machines that run an FTP server. You will also find EventID
100 in the Event Viewer System log for corresponding dates and times. My
research has found that it is some scum sucking hacker using a script that
tries several userids and passwords to hack into your FTP since FTP does not
delay or lock out the account after so many failed attempts. Userid
Administrator is the most frequently tried. For more details on these
attempts on your server go to the following folder and check out the
logfiles there: C:\WINDOWS\system32\LogFiles\MSFTPSVC1

Here are a few things I have done to help me sleep better at night:
1. Rename the servers administrator account.
2. Insure all users that have permission to your FTP server have complex
passwords.
3. Go to http://blog.netnerds.net/index.php?s=banftpips.vbs and get
Chrissy MeMaire's script file - this will collect and ban the IP addresses
of hacks trying to get in as administrator.

If anyone uses other methods to deal with this issue please reply!

Regards,
Bs.



"Ryan" <Ryan@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:D5C7FCF6-7D7F-4559-B213-D2B8C4BF2003@xxxxxxxxxxxxxxxx
Hi David,

Logon Process: IIS
Logon Type 8: NetworkCleartext - Logon with credentials sent in the clear
text, for example logon to IIS with the basic authentication.

It looks like someone is running some scripts against your IIS. Anything
to
be found in your IIS log-files?


"David" wrote:

Forgot. No - no source IP.
--
David @ Solsletta


"Cris Hanna [SBS-MVP]" wrote:

with all those different names, appears to be a hack attack
when you look at the event do you see an IP are they consistent?

have you gone to www.grc.com and run Shields Up to see what's open?
Is port 80 open?
Is port 21 open for FTP?

Are you running Std. or Premium?
If Std. what are you doing for a firewall?
"David" <David@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:5B853CCB-3DB3-41A5-A7BB-7EA41680AB2B@xxxxxxxxxxxxxxxx
This is appearing in the logswith varying User Names:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 14/09/2007
Time: 02:18:30
User: NT AUTHORITY\SYSTEM
Computer: MAC
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: pop
Domain: MACPROSOL
Logon Type: 8
Logon Process: IIS
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: MAC
Caller User Name: MAC$
Caller Domain: MACPROSOL
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 2144
Transited Services: -
Source Network Address: -
Source Port: -

The events are logged consistently but are intermittent. Generally
occurring every 2 seconds for several hours with one user name then
ceasing
for a few hours or days before starting with another user name.
Examples of
names are: pop, dns, test123, admin, administrator.

Hack attempt and apart from turning off remote access any ideas?
--
David @ Solsletta



.

Relevant Pages

  • Re: I_USR requires Logon type 3 - Help!
    ... On IIS v5.1 (Windows XP). ... Locally" if you want that account to be impersonated by the FTP Server. ... When IUSR tries to logon to the FTP server, ...
    (microsoft.public.inetserver.iis.security)
  • Re: Locked out users still can ftp
    ... >time that IIS will cache these values is configurable. ... >>> login via ftp. ... >> think you would need to use a third party FTP server to ...
    (microsoft.public.inetserver.iis.security)
  • Re: Event Log: Failed Audit
    ... and every FTP site within my IIS -- and I'm still getting the failed ... logon attempts. ... Logon Process: IIS ... This is likely someone trying to gain access to the FTP server by trying to ...
    (microsoft.public.windows.server.general)
  • Re: Ftp server a bit more secure ?
    ... Ftp server a bit more secure? ... it sounds like you're not utilizing IIS in any manner that makes IIS ... To remove the domain user group, I set the Web designer group as ...
    (Focus-Microsoft)
  • Re: Cannot connect to FTP server
    ... Well i read the article you sent me but I am using IIS 5.1 on windows xp. ... For IIS FTP, ... Select the 'enable folder view for ftp site'. ... C:/>ftp.exe my ftp server ip address ...
    (microsoft.public.inetserver.iis.ftp)