Attack on WebAdmin-port: many failed logins

I've seen a few similar reports on a German Sophos UTM user group on Facebook today.

It is, unfortunately, very easy to find a list of IP addresses that are listening on port 4444. Online services such as Shodan routinely scan IPv4 address space and make the results available via their website.

The primary line of defence against this kind of attack is to limit the IP addresses that are allowed to access WebAdmin. You can do this by updating the list of 'Allowed Networks' under Management > WebAdmin settings. 

Ideally you should really only allow connections to the WebAdmin from inside your network - from non-routable address ranges such as 192.168.x.x or 10.x.x.x.

If you do need to access WebAdmin from outside of the organization, you should try to narrow down the number of allowed IP addresses. If you can't create a static list of IP addresses, you could use Dynamic DNS - for example:

1. Create a dynamic DNS hostname and keep it updated with the public IP address of your admin's laptop. There are many services that allow you to do this.

2. Under Definitions & Users > Network Definitions create a 'DNS host' type entry for this dynamic DNS hostname

3. Under Management > WebAdmin Settings > General, add this new DNS host entry to the 'Allowed networks' list and remove any unneeded items.

Obviously, making sure you have a strong password for any Admin accounts is also important.

I've seen a few similar reports on a German Sophos UTM user group on Facebook today.

It is, unfortunately, very easy to find a list of IP addresses that are listening on port 4444. Online services such as Shodan routinely scan IPv4 address space and make the results available via their website.

The primary line of defence against this kind of attack is to limit the IP addresses that are allowed to access WebAdmin. You can do this by updating the list of 'Allowed Networks' under Management > WebAdmin settings. 

Ideally you should really only allow connections to the WebAdmin from inside your network - from non-routable address ranges such as 192.168.x.x or 10.x.x.x.

If you do need to access WebAdmin from outside of the organization, you should try to narrow down the number of allowed IP addresses. If you can't create a static list of IP addresses, you could use Dynamic DNS - for example:

1. Create a dynamic DNS hostname and keep it updated with the public IP address of your admin's laptop. There are many services that allow you to do this.

2. Under Definitions & Users > Network Definitions create a 'DNS host' type entry for this dynamic DNS hostname

3. Under Management > WebAdmin Settings > General, add this new DNS host entry to the 'Allowed networks' list and remove any unneeded items.

Obviously, making sure you have a strong password for any Admin accounts is also important.

Thanks. I am glad to hear it is not an attack on my clients specifically.

And thanks for your advice. I already did that right after the first warning emails.