Given the number of attacks reported on mssql, and the data I gathered over the last weeks, I decided to have a look on it.

The Tabular Data Stream protocol, which is used by MSSQL Server, provides fields to have the client telling the server his hostname, which application is accessing the database, using which driver. As dionaea can understand the protocol, I decided to log this data as well.

fingerprints.sql

As you can see, I did not have that many hosts accessing my mssql service, 6 hosts, thats pretty much nothing.

As the authentication is more or less plaintext, it is easy to log usernames & passwords.

usernames.sql

I was surprised to see there were only two different usernames, but sa seems to be a 'good default' to use.

I've had 1796 different passwords (passwordcount.sql) which were used to login. The popularity of passwords was not surprising at all:

passwords.sql

I wanted to know which username received more love,

userlove.sql

User sa got the lead with more logins and more passwords.

The commands dionaea received were basically … a single command, for all logins.

sqlcommands.sql

I guess they stop exploitation, as dionaea is not able to parse the sql command and compile a proper reply … but as there is only this single query, maybe compile a default reply for this single query ….

I wanted to check if all hosts had similar number of passwords used:

hostslove.sql

There was one host, taking the lead, and some others doing something.

So, summarizing, it is a limited number of hosts running bruteforce attacks on a large number of hosts.

thatsit.sql

Thats it.

In case you want to check your own data, here are the queries I used. If you feel I'm wrong, post your results in the comments, you can use the dokuwiki syntax

SELECT 
	remote_host,
	mssql_fingerprint_hostname,
	mssql_fingerprint_appname,
	mssql_fingerprint_cltintname
FROM 
	mssql_fingerprints 
	NATURAL JOIN connections
WHERE
	local_port = 1433
GROUP BY
	remote_host, mssql_fingerprint_hostname, mssql_fingerprint_appname, mssql_fingerprint_cltintname;

SELECT
	COUNT(*),
	login_username
FROM
	logins 
GROUP BY
	login_username
ORDER BY
	COUNT(*) DESC;

SELECT
	COUNT(DISTINCT login_password) 
FROM
	logins;

SELECT
	COUNT(*), 
	login_password
FROM
	logins 
GROUP BY
	login_password 
ORDER BY
	COUNT(*) DESC 
LIMIT
	5;

SELECT
	COUNT(*),
	login_username,
	COUNT(DISTINCT login_password)
FROM 
	logins 
GROUP BY
	login_username 
ORDER BY 
	COUNT(*) DESC;

SELECT
	COUNT(*),
	mssql_command_cmd 
FROM
	mssql_commands 
GROUP BY
	mssql_command_cmd;

SELECT 
	remote_host,
	COUNT(DISTINCT login_password) 
FROM
	connections 
	NATURAL JOIN logins 
WHERE 
	local_port = 1433 
GROUP BY
	remote_host 
ORDER BY
	COUNT(DISTINCT login_password) DESC;

SELECT 
	strftime('%Y-%m-%d %H',connection_timestamp,'unixepoch','localtime') AS date,
	remote_host AS attacker,
	count(*) AS attacks
FROM 
	connections
WHERE
	connection_protocol = 'mssqld' AND connection_type = 'accept'
GROUP BY 
	strftime('%Y-%m-%d %H',connection_timestamp,'unixepoch','localtime'), 
	remote_host
ORDER BY 
	date ASC;