SMTP logs reveal hack attempt

[Five_Star]

Two problems really in this post, the second is critical.
1. Every hour, something tries to login using the Administrator account. I've tracked it down to be a file server on our LAN called serverA.

Security log details

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 04/06/2008
Time: 21:26:12
User: NT AUTHORITY\SYSTEM
Computer: ServerX
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: SKINNER
Caller User Name: SKINNER$
Caller Domain: THAP
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 4428
Transited Services: -
Source Network Address: -
Source Port: -

From the SMTP log below the server starts a conversation then quits. The Caller process is inetinfo.exe
The server in question is a very simple 2k3 file server, has almost no services running on it appart from the basics, no local user accounts and i've run a full virus check and spyware check too although there is no software installed on it appart from the UPS & antivirus. It also has no ports open through the firewall.

2.Much more worrying, looking at the logs last night somebody has been tryng every password possible against the Exchange server.

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 04/06/2008
Time: 23:40:28
User: NT AUTHORITY\SYSTEM
Computer: ServerX
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: sales
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: SKINNER
Caller User Name: SKINNER$
Caller Domain: THAP
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 4428
Transited Services: -
Source Network Address: -
Source Port: -

The Exchange server has ports 25, 80 and 443 open. How are they connecting to it to attempt to hack the passwords, OWA??

The attack seems to be comming from 72.166.142.50 which traces back to a broadband supplier so I assume its a virus / bot infested zombie.

Is there anything I can do to stop this happening as it results in the Administrator account being locked out and I'd really not like to get hacked.

Screen shots below.
P.S this isn't my day job. I'm a developer but there are only 5 of us here so we all have to multi task.

 

[zetec452]

For starters I'd block the originating IP of 72.166.142.50 on your firewall.

Then perhaps send an abuse report to the ISP the IP belongs to?

 

[deadite66]

seems they've been up to a few other things.

 

[NickK]

1. block with firewall
2. Look at the domain registry - send snotty email
3. Find ISP - fire snotty abuse email
4. Get postal addresses - send legal snail mail to ISP

 

[Five_Star]

For starters I'd block the originating IP of 72.166.142.50 on your firewall.

Then perhaps send an abuse report to the ISP the IP belongs to?

I've blocked them as suggested. I assume that this is only a temporary measure as any attacker can just change to another IP? Also fired off a complaint to their ISP about abuse. Thankfully nothing bad in the logs from last night

Where did you find that incident report deadite66?

 

[Biffa]

Ditto the other suggestions, however as there seems to be a proliferation of hackbots trying all sorts of stuff against default installs its always been a good policy to rename the administrator account, not delete it but rename it, and then create a dummy "administrator" account with zero access to anything and full logging on the account.

 

[Five_Star]

Good suggestion about the domain admin account, I'll do that this afternoon. I think I'm also going to audit the workstations and remove all the local user accounts and rename the local admin account to something else too, nobody needs local PC access anyway. Its appalling really the number of unused local accounts all because the network was ran as a workgroup until recently.

Has anyone any idea on the first problem? Something from within the LAN is trying to access the Administrator account at exactly 25 minutes past the hour??

 

[Biffa]

Could be a service thats trying to logon as administrator, check the service list and see what the "Log On As" column says.

 

[Five_Star]

They are all "Local System" or "Network Service" Its such a frustrating error. It'll be interesting to see if the reported username changes once I rename the Admin account?