Observations from two weeks of SSH brute force attacks

Re:Observations from two weeks of SSH brute force attacks by flpmor on Thursday January 26, 2012 @08:36AM (#3514029)

I think that a more reasonable explanation could be that the attackers were careless about building the dictionary. If it's built by parsing files and you feed the wrong file or the parser does not work correctly you end up with a dictionary with lots of bogus entries. That seems a simpler explanation than:

"The best guess is that these passwords were collected from an unhashed password database, or from a trojaned SSH server or client."

"This might be due to the brute force tool not properly interpreting comments in the dictionary file, or the attacker not understanding the comment notation"

[ Parent | on HN ]

Re:Observations from two weeks of SSH brute force attacks by khafra on Thursday January 26, 2012 @08:49AM (#3514064)

Interesting idea. Assuming competence on the part of your attacker isn't as dangerous as assuming incompetence, but it can be just as mistaken.

[ Parent | on HN ]

Re:Observations from two weeks of SSH brute force attacks by flpmor on Thursday January 26, 2012 @09:07AM (#3514147)

It could be more haste than incompetence. Anyway, if you think about massive brute force attacks like this, they are 'silly' easy no-brain attacks more likely to come from script kiddies who downloaded a tool someone else wrote than real attackers.

[ Parent | on HN ]