Security

Ask something
Discussion Locked

Attacks on NT Restricted Access Folders

0 helpful
5 replies

by alysonh

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Last week, in our NT security logs, I noticed that there were repeated attempts
by a logged in user to access restricted directories on our data drive. At the
same time, I noticed that there were several login attempts from unknown users at
unknown domains.

Here is what we have:

NT Server 4.0 SP4.0
Win 95/98 Clients
Static TCP/IP network addresses
Individual ISP dial-ups into individual computers.

Here is what I know:
- After the ISP's have been disconnected, we are stillgetting repeated attempts
on the server from these users.
- All of the computers have tested negative for Viruses.
- The users that are accessing these files are not "problem" users. In fact, one
of the attempts was after everyone had gone home for the night.
- All of the computers have been patched with the latest security updates.
- The attempts run the entire shared drive, every 2 hours.

Here is what I have done to try to isolate the problem:
- I have run anti-virus software onthe pc's on the network and they show nothing
infected. (On the machines where the logins and access requests are originating
I've run thorough scans via McAfee clinic)
- I have readdressed the network with a new TCP/IP address (We use static
addressing)NOTE: Since readdressing, there doesn't seem to be anymore "alien" logins.

Here are my questions:
- Is there some kind of system problem on the server that would make it look like
a user was repeatedly attempting to access the directories?
- Is there a way that an access can be made even though the Dial-up connections
are closed?
- Is it possible that through some fluke, we are being seen as part of another
network?

I'm not sure if I am missing the obvious here somewhere. Any help would be
greatly appreciated.
Thanks!
Alyson

5 replies

by steve elky

One possible explaination is that one of your workstations has the wrong domain set on it. At one point this workstation had the correct domain set and while logged into the domain mapped a drive to your shared folder. Once the domain was changed,the workstation (being 95) would have tried to access the domain with the incorrect credentials.

If the drive was originally mapped using an IP address, when you changed the IP addresses, it would have foiled the drive map attempt. The attempt may have been made every two hours by some application that needed to use the shared drive.

Other systems, such as Linux running samba can also attach to NT shares.

Another possible reason is that the ISP dial-in may also be set to allow inboundconnections. Someone could have found your modems via a technique known as a war dialing, which just dials a range of numbers until it finds modems.

You can set the modems in the RAS server setup to be dial-out only. If you haven't set it this way, you have a grave security risk.

by zbrain75

It's just a thought, but you might try a network sniffer to sniff the ports on the machine that is being attacked. Then you can be sure of the IP address the attack is coming from. When you locate the machine the attacks are comming from, sniff its ports to determine if someone is remotely logging onto it. Also log user logons and logoffs on the machine being used for the attack.

This discussion is closed to new replies.