Anyone else getting their windows login bruteforced?

[Rickster]

So im looking at my Windows event logs and i can see under security that they are trying random usernames and passwords every 2 seconds.

Its coming from 2 different IP's, what have done is blocked the IP's in windows firewall and that seems to have sorted the issue.



Here are the IP's in question, can you guys see if the IP's are attacking you too?




Is this via RDP? Because im using a random uncommon port.

 

[Sinbad]

Why tf is your windows box open to the internet?

 

[blaaislaai]

Do you perhaps have your PC connected directly to the ONT ?

 

[ArtyLoop]

Why tf is your windows box open to the internet?

This ^^^
Blocking the IPs is just going to help for now... they'll be back...

 

[ArmatageShanks]

Why tf is your windows box open to the internet?

I too want to know.

 

[Mr Scratch]

rdp bruteforce happens 24/7, and more recently some bluekeep opportunists


your box should never be exposed to the internet without some sort of whitelisting/firewall

 

[Mr Scratch]

Just install a decent freeware firewall for now and go from there.

windows has a built in firewall that does the job just fine, but more importantly why isnt this being done at the network edge

 

[DrJohnZoidberg]

Setting an uncommon port doesn't solve your problem. Don't open RDP to the internet. Use a VPN.

 

[Rickster]

Why tf is your windows box open to the internet?

Its a standard windows install with RDP enabled.

Do you perhaps have your PC connected directly to the ONT ?

No, just the router.

Setting an uncommon port doesn't solve your problem. Don't open RDP to the internet. Use a VPN.

My router doesnt have a VPN option.

 

[Prawnapple]

Setting an uncommon port doesn't solve your problem. Don't open RDP to the internet. Use a VPN.

100% this. Don't open port 3389,3390 etc or some uncommon port directly to the internet. Also don't use port 80 for anything open from the internet either.

 

[Mr Scratch]

whitelist access to that port

setup vpn on the box, like ipsec or something

vpn in, then rdp via the vpn

 

[PhireSide]

Security through obscurity (changing ports etc.) will only keep out 1% of the attacks out there. The other 99% are bots that scan for open ports. This is a VERY insecure way of accessing your home network.

Use a certificate based VPN with ipsec and use port knocking or fail2ban with jails setup to keep them from trying to bruteforce their way into your network

 

[Solarion]

Are home PC's safe from this type of attack?

I don't want to come home and find that Jamal Pravesh from Kolkata has been all over my ****.

 

[OCP]

Are home PC's safe from this type of attack?

I don't want to come home and find that Jamal Pravesh from Kolkata has been all over my ****.

That depends on your neighbours and the complexity of your WiFi password.....