Archives for dictionary attacks

Brute force attacker ökar

Brute force attacker ökar T konsult IT säkerhet

Brute force attacker ökar

Ett av de ämnen jag tidigare skrivit mycket kring är just kring att ordboksattacker eller brute force attacker ökar och är ett verkligen svårt problem att hantera. Principen bygger alltså på att en hackare försöker gissa sig till användarnamn och lösenord. Ofta är användarnamnet t.ex. en persons e-post adress eller i Windows domäner t.ex företaget\användarnamn och med den kunskapen har ju hackaren redan hälften av inloggningen.

Resten är lösenordet och om det är något vanligt lösenord eller en vanlig variation på det så kommer det inte ta lång tid för en hackare att faktiskt ta över personens konto.

Allt det här är naturligvis helt automatiserat dvs det sitter ingen  för hand och försöker skriva in användarnamn och lösenord utan hackarna använder olika script som kan testa tusentals kombinationer av lösenord samtidigt med olika resultat. De kanske lyckas bryta sig in, låsa användarnas konton, krascha servrar för överbelastning o.s.v.

Den här artikeln på Techworld ( https://techworld.idg.se/2.2524/1.698276/olovliga-inloggningsforsok) pekar också på att just den typen av attacker ökar och med all sannolikhet kommer fortsätta göra det.

Några av problemen med dessa attacker (förutom det alldeles uppenbara att hackaren faktiskt lyckas gissa rätt och då har tillgång till ert data) är att det tar maskinresurser, fyller bandbredd och är väldigt, väldigt svåra att hantera manuellt.
Tänk t.ex. när en attack kommer från 1000 eller 10 000 datorer samtidigt,. Att manuellt stoppa det i en brandvägg är inte realistisk och i vissa system som t.ex. i Windows domäner finns oftast ingen koppling mellan händelsen inloggning och brandvägg. Jag driftar, övervakar och hjälper företag så jag ser hundratals såna här attacker varje dag som pågår.

Att i efterhand kunna se vad som hänt är värdefullt för t.ex. polisanmälningar och historik men primärt behöver attackerna stoppas, sedan analyseras men att göra det manuellt är som sagt helt orealistiskt och behöver automatiseras.

Det finns lösningar, programvaror och sätt att automatiskt hantera de här frågorna på de flesta plattformar och system men det kräver lite eftertanke och planering, enligt min mening tid som är mycket väl investerad för att skydda era system mot brute force attacker.

Vill ni veta mer om hur man kan skydda sig mot detta i Windows, Linux, WordPress,Exchange Server osv , kontakta mig här
<

Kontakta JufCorp
backup disaster recovey konituitetsplanering IT säkerhet molntjänster syspeace kontakta JufCorp

Kontakta JufCorp AB för frågor inom backup / restore , Disaster Recovery, IT säkerhet, molntjänster och frågor kring intrångssäkerhet.

Boka ett gratis möte för att se hur jag kan hjälpa er eller beställ licenser för  F Secure PSB (övervakad antivirus till fast månadskostnad) eller Syspeace ?

Om ni hellre vill ringa direkt så nås jag på 0709 666 997

[contact-form-7 id=”1633″ title=”Namnlös”]

 

Senaste uppdateringarna på JufCorps  FaceBook sida

 

2 years ago

JufCorp

"Vi har skapat ett verktyg för att skapa lokala ikoner för enheter , göra så att man högerklicka på filer/kataloger i rCloud och få ner dem direkt till den lokala enheten. De lokala enheterna heter alltid R: i Molnet och kan vara Windows, Android eller MAC. Filer hamna på lite olika ställen beroende på vilket du är uppkopplad med (Molnet känner av dynamiskt vilken enhet du är inloggad med dvs du kan vara inloggad med en Windows dator på jobbet och hemma med en Android och skicka filer till dem) [ 59 more words ]

www.jufcorp.com/wordpress/molntjansten-rcloud-office-forenklar-kopplingar-mot-lokala-enheter-med-...
...

View on Facebook

2 years ago

JufCorp

blog.redcloud.se/att-na-sina-program-i-molnet-med-en-webblasare/ #molntjänster #outsourcing #SaaS #visma ...

View on Facebook

2 years ago

JufCorp

Att använda den inbyggda Windows 10 Mail klienten mot rCloud Office för att synka e-post, lalender och kontakter. #molnet ...

View on Facebook

2 years ago

JufCorp

En videomanual för hur man installerar svenska molntjänsten rCloud Office från Red Cloud IT.

blog.redcloud.se/molntjansten-rcloud-office-pa-windows/
...

View on Facebook

2 years ago

JufCorp

Finska F Secure har hittat ytterligare en kritisk sårbarhet i Intels produkter. Denna sårbarhet har inget med de nyligen publicerade #Meltdown och #Spectre utan ligger i Intel Active Management Technology (AMT). Om en angripare har fysisk tillgång till datorn kan alla säkerhetsmekanismer kringås som antivirus, diskkryptering och datorn är helt oskyddad mot angriparen som därefter fjärrstyra, avlyssna, kopiera data osv. … [ 39 more words ]

www.jufcorp.com/wordpress/f-secure-hittar-ny-kritisk-sarbarhet-i-intels-produkter-infosec/
...

View on Facebook

 

Troubleshooting Syspeace

Syspeace

syspeace – intrusion prevention for Windows serevr

 

<h2>From the  Troubleshooting Syspeace manual and a few new added entries   </h2>

So, as a general troubleshooting Syspeace  tip , check how your firewall is enabled and verify that it indeed is the correct network profile in there, or, enable the firewall for all three profiles.

The usual troubleshooting tips we give are described in the manual in the troubleshooting section

1. Make sure you’ve enabled the firewall (as described in Firewall), firewall enabled, prefferably on all profiles.

2. Make sure you’ve enabled the auditing (as described in Windows login detection prerequisites).

3. Verify that the server can reach https://s.syspeace.com/ping . (You should see a message saying Hello from Stockholm. and the local time of the server and recommended Syspeace version)

4. In some instances, when running Terminal Server or Remote Desktop Services there’s actually the scenario where the Windows server itself fails to obtain the source IP address of the login attempt (you can verify this by checking the Windows event log and look for Source Network Address: ) Sometimes, that entry is empty, thus disabling Syspeace from actually having anything to block. Syspeace will attempt to corroborate the IP address from some other logs. If it doesn’t find any, there is not much that Syspeace can do.

5. In any applicable firewall or antivirus software, allow Syspeace access to https://s.syspeace.com/ (port 443).

6. Verify any proxy settings, if applicable.

7. Some methods of Windows authentication actually attempts to log in several times. Two failures may be part of one log in attempt. Syspeace has no way of knowing how many attempts were intended and has to work with the actual failures. Due to counting failures instead of attempts, rules may be triggered seemingly ahead of time.

8. One way of quickly verifying functionality is to use a workstation (not whitelisted) and attack your server with the net use command from the command prompt. After the number of tries defined in the current rules, the workstation should be blocked from communicating with the server. Example of the command: net use * \server name or server IP addressanyshare /user:syspeacetester “anypassword”

9. If you want to submit logs to us, start Syspeace, go to Management → System settings, enable logging and start the service. The log file is created in a subfolder of the Syspeace installation folder.

10. When submitting logs,
Please create a .zip file of the logfiles, include any relevant information from Windows Eventlogs (application, system and security and when applicapble, the Syspeace eventlog ) and also create a .Zip-file of the database and email them directly to the devteam . The email address can be found in the manual

11. If your server doesn’t pick up the source IP address in your eventlog , please have a look a this blog article

12. If your database has grown above the size limit of 4 GB, in the current version ( 2.5.2) you will have to manually delete the database and set up your Syspeace again. in the upcoming version this has been fixed.

by Juha Jurvanen

#Syspeace stops due to license server inaccessable on #Windows Server 2003 #infosec

Syspeace service stops due to license server not reachable / inaccessibility on Windows Server 2003

We’ll actually update the troubleshooting section with info for Windows 2003 Servers but here’s why this can occur.

Apparently root certificates are not automatically updated on Windows Server 2003:

http://support.microsoft.com/kb/931125

> The automatic root update mechanism is enabled on Windows Server 2008 and later versions, but not on Windows Server 2003. Windows Server 2003 supports the automatic root update mechanism only partly. (This is the same as the support on Windows XP.) And because the root update package is intended for Windows XP client SKUs only, it is not intended for Windows Server SKUs. However, the root update package may be downloaded and installed on Windows Server SKUs, subject to the following restrictions.

> If you install the root update package on Windows Server SKUs, you may exceed the limit for how many root certificates that Schannel can handle when reporting the list of roots to clients in a TLS or SSL handshake, as the number of root certificates distributed in the root update package exceeds that limit. When you update root certificates, the list of trusted CAs grows significantly and may become too long. The list is then truncated and may cause problems with authorization. This behavior may also cause Schannel event ID 36885. In Windows Server 2003, the issuer list cannot be greater than 0x3000.

This can be resolved for Syspeace by manually installing the gd-class2-root.crt certificate from this page: https://certs.godaddy.com/anonymous/repository.pki

#infosec #security The anatomy of #hacking attacks

Various hacking attacks against servers and users

First of all, there are multiple types of hacker attacks and they all have different purposes.
There are also many different types of hackers and they all have cool names like “White hat” hackers and “Black hat” hacker.
The White Hat ones are ususally the security experts hired at a company to check and verify the IT security measures at other companies.
The Black Hat hackers are not. They’re the ones to be afraid of.
I’m neither of them. I’m simply a consultant and the best of these guys know far more about theses things than I do but still, I thought I’d run through a few common attacks targeted to accomplish various things.

There are many reasons why an attacker wants to hack you.
It could be hacktivism and political reasons or an attempt to gain access to your server to be able to use it for hacking others (basically they want access to your CPU, RAM and disk to hide stolen data and tools, mine for Bitcoins or whatever and to have an IP address to use, not leading back to their own).
There’s a few very cool and easy ways to hide files on servers that ar more or less impossible to find such as hiding a file “behind” another file and so on.

Of course in some cases it can also be about trying to steal company secrets (industrial espionage), possibly a former (or current for that matter, internal data theft and hacking is far more common than you’d expect) discontent employee looking to sabotage or looking for revenge or in some cases, just for the fun of it to see if it can be done.

The pre-run, portscan and checking out you site and server

First of all, any hacker will need to know what you’re running and what it looks like. “Know thy enemy” so to speak
Usually a portscan of your servers will reveal quite a lot of information and there are loads of tools to do this, quietly, undetected and effieciently such as nmap or even Google actually.

In order to make it a bit more difficult for them I’d suggest you have your firewall correctly configured, your servers on a DMZ and also to hide any banner revealing wehat software you’re running and what version. This can’t be done with all software I’m afraid but the ones that you can, please consider doing so.
For a hacker to know exactly what you’re running will only make his/her life much easier since all they do is to start
looking for any known vulnerabilities and so called exploits to that software and version.
Usually software developers have released a patch but ufortunately, a lot of software never gets updated in time due to the old “if it works, don’t fix it” attitude amongst a lot of server tekkies and hosting providers.

Another thing is to move all default pages and scripts (or delete them if you’re not using them) to make a bit more difficult to figure out what you’re actually running and how it is setup. Have for instance 404 error messages redirected to the startpage or Google or your worst competitor and also 403 errors ..

DoS attacks and DDoS attacks.

A DoS attack is a “Denial of Service” attack whick means that your server is in some way attacked and made to stop servicing your clients / users or customers the way it’s supposed to.
This can be accomplished in many ways. A DDoS attack is a DoS attacked but with the difference that it is a Distributed DOS attack meaning there are a lot of more computers involved in doing the attack.
These attacks often have the main purpose of taking a website down by overloading it really.
If you’ve got a webserver servicing for instance a webshop and a hackergroup for some resaon don’t like you, they’ll get a few hundred thousand computers around the world to ask for a specific document or picture on your website, thus overloading it so it can’t really service your customers since the server is busy handling the bogus requests. Worst case, an attacks such as this can actually go on for weeks and it has happened that is is aso simply an extortion. “If you pay us this and this much , your webshop will be back online again, otherwise not”. For som companies this of course could be an absolute disaster, imagine for instance aroound the Christmas sales.

Now, it might sound impossible to find a few hundred thousand computers to get such an attack underway. It’s not. They’re out there in botnets spread over VPS and physical machines and they’re for hire even. Including a trial run and with support. Brave new world ..

There are ways to handle these attacks. For instance increasing the service capacity on the server, increasing you bandwidth and also have a talk with your ISP on how to mitigate the attacks if they have solutions in place for it. You could also have for instance a powerful SNORT server in front of the firewall to get rid of some of the traffic.

If a server is poorly updated and the application/website is sensitive for instance that the hacker simply adds som code to the webaddress trying to browse the filesystem on the server then this can also render in a DOS attack or even worse, the attacker gets hold of the users and administaror/roots passwords. Once they’ve got that, your pretty much ..well. you won’t be having a good day. Basically you need to make sure your webserver is always correctly updated, and you also need to make sure that the underlying filessystem can’t be reached from the outside more than absoplutely necessary.
Make sure you checked every directory and path on the website and what actually is reachable, writeable and browsable. If you’ve got pages you don’t want indexed then hadled that in the robots.txt or have them secured behind a userlogin page.

SQL Injections and badly formated requests

If the website uses a SQL Server or has any input form to validate or gather something, please make sure that the application strips away any characters that could make your server vulnerable to SQL Injections since the SQL Serevr is usually run with administrative rights making the SQL Swerver injections being run with high priviliges and accessing the operatin system. If you don’t know how the application is written, please contact the developers of it and ask them and have them verify this.

For any part of the website where there are input forms, makes sure that all input is validated in terms of what characters are used and how long the input is. If a website is poorly written and poorly validated, a memory buffer overloflow can ooccur which basically means that the input is so large or strangely formated that the server will stop working or even give the attacker access to the servers operatingsystem by overwriting stuff in the RAM in a way that it’s not suppoed to.

Viruses and trojans.

If an attacker has been able to lure your users to a site that contains infected code (sometimes also called drive by
hacking) and the webbrowser or plugins to it (Java, Adobe, Flash and so on) are sensitive to that particular infections you user might come down with an infected computer. Depending on what actually has been infected and why the consequnces vary of course.
I’ve heard of companies that have been affected with a virus rendering them unable to work since nobody was allowed to even plug in their computers to the work networks until they could be sure they’d got rid of it. In this case it was a lot of computers so I think it took them 3 week until people actually could start working again, 3 weeks without any work. That’s a costly thing for any company.The same standstill could also come from a ransomvirus, basically encrypting all your files and you’ll have to pay money to get the right decryption password.

The way to minimize such a horrbile standstill is to make sure that ALL of your devices connecting to the network are
properly updated with antivirus products (please do not use the free ones ..ever.) but also you need to make sure that any other software is properly updated . Java, Flash, and the operating system itself . This also goes for workstations connecting from home and so on or otherwise you might be in for a bad day. You should also be very restrictive when it comes to letting users use USB drives and stuff. They might be infected with something.

MITM – Man in the Middle, proxies and easedropping

If you’ve got a corprate network, you want to know what devices actually are on it and why. If someone for instance sets up a computer and has all of the corprate traffic routed through, all of your communicating is being copied and this can be done in various ways. The same goes actually for you if you’re using public WiFi hotspots which I would never recommend anyone really using. To intercept data isn’t very difficult unfortunately, especially if it isnät protected by valid certificates.
You need to use valid SSL certificates and there’s no reason to use anything lower that 2048 encryption.

Brute force and dictionary attacks.

I’ve written loads and loads on this earlier so I won’t linger on it. A brute force or dictionary attack is basically someone trying to get access to your server by guessing the username and correct password using a large list of common passwords or a dictionary and simply trying them one by one (well, thousands at a time really since its’s automated).
To protect your servers and user you need to have a inttrusion prevention system in place. For Windows Servers I recommend using Syspeace (and you can also use Sysepace for protecting webappliactions you’ve prtected through the Syspeace API) and on Linux servers I’d hava a look at fail2ban. You should also use and enforce complex passwords.
You should also have a very strict policy to immediately block an employees account as soon as they’re no longer with the company and you should be very careful with what user rights you grant your users since they can easily be misused. You should also have software in place for managing mobile phones and othe devices that your employees have and the ability to wipe them clean if they get stolen or if you suspect internal mischief from an employee.

On site data theft and social engineering.

Well. In a sense , it’s not hacking but it’s more fooling people. Not the intial part anyway.
Basically someone turns up, claiming to be from the phone company, a cleaning company, your IT support company or anything that makes sense and they want access to the datacenter, server room to “fix” something. This is also referred to as social enginering. First the hacker finds out as much as possible about the company they’re attacking and then use that information to gain access to workstations or servers within the company,

Once they’ve actually gained access, they’ve got USB sticks to insert into workstations or servers , either loading a software into them as trojans or keyloggers or just something that elevates rights or maybet they’re simply after just copying the data. It all depends on how much time they have and if they’re alone. In some scenarios it might even just be a trick for them to gain access to backup tapes since all the companys data is on them . They could also bribe janitors, cleaning staff and so on to steal backup tapes for them since they far too often will have access to the datcenters and they’re
not that highly paid.

There are a lot of tools that can simply put on a USB stick, boot up the server and you can reset administrator passwords, overwrite systemfiles (to plant a trojan or destroy them to render the server unbootable) , steal data and so on and a lot of them are surprisingly user friendly like for instance Hiren’s BootCD

A variation of this is of course people phoning someone up, claiiming to be from the IT departement or Microsoft or somewhere, wanting to “help you” with a problem and asking for remote access to your computer. Once they gain access, they’ll do same things. Plant a trojan or a virus or a keylogger and the basically own the computer.

To protect your companydata please always make sure you know who and why people are on site, never have anyone come near servers or workstations and if possible, disable any USB ports and always use password protected screen savers.
Every device on your network must also have a good antivirus running in case someone still manages to put an inected USB stick into the workstation. Also make sure you talk the users about the hazards of giving anyone access to their computer.

If you suspect you’ve been hacked.

First of all, try to verify that you have been hacked and also try to find out when. In som cases you’ll have to revet to backups taken BEFORE you we’re hacked to be sure that you don’t restore a rootkit or something. This also means your backupplans and DRP palns need to take these scenarios into account so don’t be cheap with the number of generations you actually save. You might need something from 6 months aog.

Try to find out what happened, when it happened, how it happened and have it fixed before you allow access to the server again. There’s no sense in setting the same flawed server up again. It will only be hacked again,

Don’t be afraid to make it a matter for the police. They need to know about it and they want logfiles and any documentation you may have.

When you get the server up & running again (or prefferably before you’ve been hacked) make sure to have monitoring set up for the server. If it’s a website for instance, you want to be alerted if anything changes on in the html code for website for instance, or if the site is responding slowly (this doesn’t have mean you’ve been attacked but could point to other problems also such as diskproblems, misconfigured server settings or ..well..anything really. In any case you want to look into it.)

So , these were only a few methods and there a loads and loads more of them .

I’ve written a few other blog articles on securing servers, datacenters and on brute force prevention and here’s a few links to previous articles.

Should you need consulting or ideas on these questions or on backup/restore or on building cloud services / migrating to cloud services , I’m reachable by clicking the link below.

By Juha Jurvanen – Senior IT consultant at JufCorp

#infosec VPS and #Cloud servers used for brute force attacks and #botnets against #WinServ and #MSExchange

Syspeace - intrusion prevention for Windows servers

Syspeace website

Is your VPS used for brute force attacks?

or I could also have called this post “Do you know whom your VPS is hacking today?”

A trend that has surfaced over the years is to simply hire computer power inte the Cloud in various forms and shapes. The basic idea is to get rid of the hardware and maintenance för servers and have someone else take care of it. Also known as Infrastructure aa a Service or IaaS

The problem is often though that even if you use a hosted VPS you still have to manage it. This is something that a lot of users and companies tend to forget or neglect.

What you’ve basically done is simply get rid of the hardware hassle but you still have to take care of the Windows patching and manage security issues as with any Windows serevr (or Linux för that matter) .

There aren’t that many Cloyd services out there that actually will also manage the security and management aspects of your VPS and you really need to think these things through.

The resaon for this post is that for some time now, a VPS located at a Swedish Cloud Service provider has been trying to brute force its way into quite a few different servers with #Syspeace installed on them.
The attacks, targeted aginst RDP / Terminal Servers servers, Exchange Server and Sharepoint Servers in this case, have been blocked, traced and reported automatically but the big question is whether whoever owns/hires this VPS is actually even aware of what is going on ? Or if it’s hired especially for this purpose? This is actuallt impossible to know.

In this specific case this VPS has been going on and on for a while and it has targeted at least 5 different customers of mine with Syspeace installed and about 12 servers at least.
All attacks have been succesfully blocked, tracked and reported and eventually this VPS will end up in the Syspeace Global Blacklist (GBL) and propagated to all other Syspeace installations around the world and it will be blacklisted for all of them, thus securing them preemptively from any brute force / dictionary attacks from this VPS.

Most likely the Cloud Service Provider doesn’t know what’s going on since it’s not their responsibility really. Maybe the user / customer hirong the VPS does this on pyrpose or they have no idea that the VPS has been compromised and is used for this hacking activity. I juyt donät knoew. All I know is that it has been cinducting a lot of dicitionary attacks lately.

What I’m driving at is that if you decide to start using a hosted VPS, you still have the responsibility to manage it as any other server really.
You need to have it correctly patched, have an antivirus on it, make sure all security settings are correct and you need to monitor activity on it.

You should also ask your Cloud Service provider for intrusion prevention from Syspeace since you basically have no idea what all of the other customers VPS are really doing in your shared network since you hae no control over them.

Most Cloud Service Provers could inplement Syspeace in their various Applications portals or have a Syspeace installed in their prepared images for customers. If your providers hasn’t implemented Syspeace yet, you can simply download it yourself from http://www.syspeace.com/free-download/download-plus-getting-started-with-syspeace/

Your “neighbors” at the Cloud Service could be trying to brute force they way into your VPS and you’d probably wouldn’t have a clue if you haven’t turned on logging and installed a brute foce prevention software for Windows servers.

By Juha Jurvanen @ JufCorp

Another weekly report of prevented intrusions against #Windowsservers by #Syspeace

Reported and blocked intrusion attempts against Windows Server

This is another report generated at a single server for one week. THis isn’t actually a highly targeted server compared to a lot of the servers running Syspeace out there but it does you you an idea of how common it is with dictionary attacks and brute force attacks.
All of these attacks were succesfully blocked, tracked and reported by Syspeace.

If you want to see if your Windows servers, Terminal Servers, Exchange and OWA, Citrix, Sharepoint, SQL server are targeted,  simply download a fully functional 30 day trial of Syspeace and see for yourself.
You might be surprised.

Report for week 2014-02-03 – 2014-02-09

— All Week ——

IP address Times Host name and country
——————– —– ——————————-
5.141.82.190 5 ; Russian Federation (RU)
31.168.75.16 11 bzq-75-168-31-16.red.bezeqint.net; Israel (IL)
37.28.157.63 1 d157063.artnet.pl; Poland (PL)
37.49.224.172 3 static-37-49-224-172-vstarvps.estroweb.in; Netherlands (NL)
46.105.59.195 2 ; France (FR)
50.52.142.2 1 static-50-52-142-2.drhm.nc.frontiernet.net; United States (US)
54.251.246.9 2 ec2-54-251-246-9.ap-southeast-1.compute.amazonaws.com; Singapore (SG)
62.20.107.114 1 ns.sdata.se; Sweden (SE)
74.95.168.97 1 74-95-168-97-Philadelphia.hfc.comcastbusiness.net; United States (US)
77.31.241.106 1 ; Saudi Arabia (SA)
77.72.55.67 1 ; Denmark (DK)
78.40.146.2 7 spider.man.kcahost.co.uk; United Kingdom (GB)
80.25.156.62 1 62.Red-80-25-156.staticIP.rima-tde.net; Spain (ES)
80.250.173.121 1 ; Russian Federation (RU)
81.204.76.158 1 ip51cc4c9e.speed.planet.nl; Netherlands (NL)
82.166.16.190 3 82-166-16-190.barak-online.net; Israel (IL)
82.199.95.156 2 STU-09-PC; Netherlands (NL)
83.218.73.146 1 ; Sweden (SE)
85.17.24.130 3 hosted-by.leaseweb.com; Netherlands (NL)
85.30.164.153 1 host-85-30-164-153.sydskane.nu; Sweden (SE)
85.225.211.107 1 c-6bd3e155.222-6-64736c12.cust.bredbandsbolaget.se; Sweden (SE)
85.234.222.197 1 85.234.222.197.wls.11-bba11has1.adsl.dyn.edpnet.net; Belgium (BE)
90.230.83.147 1 90-230-83-147-no110.tbcn.telia.com; Sweden (SE)
109.247.81.115 1 ; Norway (NO)
117.121.25.16 1 ; China (CN)
119.146.85.18 6 ; China (CN)
132.199.96.83 1 pc1011103133.uni-regensburg.de; Germany (DE)
148.160.16.132 1 host16-132.bornet.net; Sweden (SE)
165.228.5.204 1 tayper1.lnk.telstra.net; Australia (AU)
180.96.11.24 1 ; China (CN)
185.2.155.18 10 WIN-LMHRI4L8OR1; Sweden (SE)
188.20.178.75 2 ; Austria (AT)
188.75.83.216 1 ; Iran, Islamic Republic of (IR)
194.243.151.67 2 rub067.te00.c2.interbusiness.it; Italy (IT)
195.22.37.8 1 pedro.adsllink.cz; Czech Republic (CZ)
195.47.35.37 1 195.47.35.37.adsl.nextra.cz; Czech Republic (CZ)
198.200.30.110 1 198-200-30-110.dia.static.wsisd.net; United States (US)
202.105.224.22 1 ; China (CN)
203.146.30.32 5 ; Thailand (TH)
213.96.201.224 1 224.Red-213-96-201.staticIP.rima-tde.net; Spain (ES)
213.243.63.116 1 VCENTERB; Turkey (TR)
217.15.198.140 1 ; Russian Federation (RU)
222.186.32.224 1 mail.mxhichina.com; China (CN)

Hourly breakdown (blocks per hour)
00 x5
01
02 x1
03 x4
04 x4
05 x1
06 x3
07 x3
08
09 x6
10 x2
11 x6
12 x6
13 x5
14 x4
15 x7
16 x6
17 x3
18 x5
19 x4
20 x4
21 x4
22 x3
23 x6

– 2014-02-03 —

IP address Times Host name and country
——————– —– ——————————-
5.141.82.190 1 ; Russian Federation (RU)
46.105.59.195 2 ; France (FR)
50.52.142.2 1 static-50-52-142-2.drhm.nc.frontiernet.net; United States (US)
78.40.146.2 6 spider.man.kcahost.co.uk; United Kingdom (GB)
80.250.173.121 1 ; Russian Federation (RU)
85.234.222.197 1 85.234.222.197.wls.11-bba11has1.adsl.dyn.edpnet.net; Belgium (BE)
109.247.81.115 1 ; Norway (NO)
180.96.11.24 1 ; China (CN)
194.243.151.67 2 rub067.te00.c2.interbusiness.it; Italy (IT)
213.243.63.116 1 VCENTERB; Turkey (TR)

Hourly breakdown (blocks per hour)
00 x2
01
02
03 x2
04
05 x1
06
07 x1
08
09 x1
10 x1
11 x1
12
13 x3
14
15 x1
16 x1
17
18
19
20 x1
21
22
23 x2

– 2014-02-04 —

IP address Times Host name and country
——————– —– ——————————-
37.49.224.172 1 static-37-49-224-172-vstarvps.estroweb.in; Netherlands (NL)
82.199.95.156 2 STU-09-PC; Netherlands (NL)
117.121.25.16 1 ; China (CN)
119.146.85.18 1 ; China (CN)
185.2.155.18 5 WIN-LMHRI4L8OR1; Sweden (SE)
188.75.83.216 1 ; Iran, Islamic Republic of (IR)

Hourly breakdown (blocks per hour)
00
01
02
03
04 x1
05
06
07
08
09 x1
10
11 x1
12
13 x1
14 x2
15 x1
16 x1
17
18 x1
19
20
21 x1
22
23 x1

– 2014-02-05 —

IP address Times Host name and country
——————– —– ——————————-
5.141.82.190 4 ; Russian Federation (RU)
37.49.224.172 2 static-37-49-224-172-vstarvps.estroweb.in; Netherlands (NL)
62.20.107.114 1 ns.sdata.se; Sweden (SE)
74.95.168.97 1 74-95-168-97-Philadelphia.hfc.comcastbusiness.net; United States (US)
80.25.156.62 1 62.Red-80-25-156.staticIP.rima-tde.net; Spain (ES)
81.204.76.158 1 ip51cc4c9e.speed.planet.nl; Netherlands (NL)
82.166.16.190 1 82-166-16-190.barak-online.net; Israel (IL)
83.218.73.146 1 ; Sweden (SE)
90.230.83.147 1 90-230-83-147-no110.tbcn.telia.com; Sweden (SE)
119.146.85.18 2 ; China (CN)
148.160.16.132 1 host16-132.bornet.net; Sweden (SE)
185.2.155.18 5 WIN-LMHRI4L8OR1; Sweden (SE)
188.20.178.75 1 ; Austria (AT)
195.22.37.8 1 pedro.adsllink.cz; Czech Republic (CZ)
195.47.35.37 1 195.47.35.37.adsl.nextra.cz; Czech Republic (CZ)
213.96.201.224 1 224.Red-213-96-201.staticIP.rima-tde.net; Spain (ES)

Hourly breakdown (blocks per hour)
00
01
02 x1
03 x1
04 x2
05
06 x2
07
08
09 x2
10
11 x1
12 x3
13
14
15 x3
16
17 x2
18 x3
19 x1
20 x1
21 x2
22 x1
23

– 2014-02-06 —

IP address Times Host name and country
——————– —– ——————————-
77.72.55.67 1 ; Denmark (DK)
85.225.211.107 1 c-6bd3e155.222-6-64736c12.cust.bredbandsbolaget.se; Sweden (SE)
119.146.85.18 2 ; China (CN)
165.228.5.204 1 tayper1.lnk.telstra.net; Australia (AU)
198.200.30.110 1 198-200-30-110.dia.static.wsisd.net; United States (US)
203.146.30.32 1 ; Thailand (TH)

Hourly breakdown (blocks per hour)
00
01
02
03
04
05
06
07
08
09 x1
10
11 x2
12 x1
13
14
15
16
17
18 x1
19 x1
20
21 x1
22
23

– 2014-02-07 —

IP address Times Host name and country
——————– —– ——————————-
31.168.75.16 5 bzq-75-168-31-16.red.bezeqint.net; Israel (IL)
85.30.164.153 1 host-85-30-164-153.sydskane.nu; Sweden (SE)
119.146.85.18 1 ; China (CN)
202.105.224.22 1 ; China (CN)
217.15.198.140 1 ; Russian Federation (RU)

Hourly breakdown (blocks per hour)
00 x2
01
02
03 x1
04
05
06
07 x1
08
09
10
11
12
13
14 x1
15 x1
16 x2
17
18
19
20
21
22
23 x1

– 2014-02-08 —

IP address Times Host name and country
——————– —– ——————————-
31.168.75.16 6 bzq-75-168-31-16.red.bezeqint.net; Israel (IL)
77.31.241.106 1 ; Saudi Arabia (SA)
82.166.16.190 1 82-166-16-190.barak-online.net; Israel (IL)
85.17.24.130 1 hosted-by.leaseweb.com; Netherlands (NL)
132.199.96.83 1 pc1011103133.uni-regensburg.de; Germany (DE)
188.20.178.75 1 ; Austria (AT)
203.146.30.32 1 ; Thailand (TH)

Hourly breakdown (blocks per hour)
00
01
02
03
04 x1
05
06 x1
07 x1
08
09
10
11
12 x2
13
14
15 x1
16 x2
17
18
19 x1
20 x1
21
22 x1
23 x1

– 2014-02-09 —

IP address Times Host name and country
——————– —– ——————————-
37.28.157.63 1 d157063.artnet.pl; Poland (PL)
54.251.246.9 2 ec2-54-251-246-9.ap-southeast-1.compute.amazonaws.com; Singapore (SG)
78.40.146.2 1 spider.man.kcahost.co.uk; United Kingdom (GB)
82.166.16.190 1 82-166-16-190.barak-online.net; Israel (IL)
85.17.24.130 2 hosted-by.leaseweb.com; Netherlands (NL)
203.146.30.32 3 ; Thailand (TH)
222.186.32.224 1 mail.mxhichina.com; China (CN)

Hourly breakdown (blocks per hour)
00 x1
01
02
03
04
05
06
07
08
09 x1
10 x1
11 x1
12
13 x1
14 x1
15
16
17 x1
18
19 x1
20 x1
21
22 x1
23 x1

Generated 2014-02-10 00:03:15 for machine ****.****.**** by Syspeace v2.3.1.0

 

By Juha Jurvanen

Syspeace - intrusion prevention for Windows servers

Syspeace website

Syspeace is now in the Microsoft Pinpoint listing

We’ve now proudly also been listed in the Microsoft Pinpoint directory.

Syspeace @ Microsoft Pinpoint

Syspeace - intrusion prevention for Windows servers

Syspeace website

A walkthrough of getting #Syspeace licenses and how it works

Getting #Syspeace licenses and how it works.

From time to time we get an email from customers that have bought their Syspeace licenses and they ask for the license key that they expect to get in an email.

Here’s a walkthrough of how #Syspeace licensing actually works.

First you install a #Syspeace trial, register a valid email address and choose a password password (this is done in the initial setup of SysPeace ).

The license key is then email to that mailaddress.
This is the key that will also become the live license when you buy the license, There is no separate license key mailed to you if you purchase licenses.

Once you purchase the license, the Syspeace client will automatically be updated upon the next contact with the license server when it requests a new token to validate the license or the next time it is restared.

If you want to extend your Syspeace license to be valid for more servers, simply login to the Syspeace licensing page and extend your license and install Syspeace on the next servers , using the same license key.

When you extend the license, you also have to ability to align license renewals to fit your needs. As an example, if you bought a Syspeace license in april for 3 #Windowsservers and two months later you install an additional server. The easiest way is to extend the running license and simply adding a fourth server. This way you don’t have to have an administrative nightmare in order to rememember various license renewals for diferent servers.

If you’ve bought your license through a reseller such they’ll manage all of the administration for you.

Have a try for yourself and download a free, fully functional trial of Syspeace and have your #Windows #Server, #Exchange and #OWA , #SQL , #Citrix , #Terminal #RD #RDweb , #Sharepoint and more automatically #intrusion protexted in a minute.

#bruteforce attacks and #dictionary attacks blocked, tracked and reported.

So far , #Syspeace has blocked 2 042 900 #intrusion attempts worldwide!

By Juha Jurvanen – Syspeace reseller at JufCorp and independent IT Consultant

Tha brand new Syspeace website – now also with worldwide hacking statistics

Finally, the new website is up!

We’ve launched our new website a few weeks back and some of the news, apart from a better design and easier naviagtion, is that we’ve also included a security status page to display statistics based on Syspeace installations that report each hacker attack around the world.

Have a look for yourself at http://www.syspeace.com/security-center/security-status/ . You might find something interesting in there.

The statistis are dfivided into to two columns. The originating country for the attack and the country from where the Syspeace installation reported the attack.

The statistiscs displayed are the last 30 days of hacking attacks and so far Syspeace has blocked more than 1.4 Million brute force and dictionary attacks against Windows server worldwide!

While you’re at the website, download a free, fully functional trial to ptotect your Windows servers, Exchange servers, Terminal / Remore Desktop Services servers, Citrix servers, Sharepoint serevrs, SQL servers and more from brute force and dictioanry attacks.

Syspeace supports Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012 and the Windows Server Small Business editions.

By Juha Jurvanen