Don't use 1234 as your password

Re:Don't use 1234 as your password by kristopolous on Sunday November 17, 2013 @08:39PM (#6752009)

I found a 68K SGI Iris 2400 machine up and running in college in about 2004. It had a sticker with the hostname on it. Later on that week, I went to the department homepage, got the staff roster and tried to guess the usernames.

I telnetted to port 25 and tried RCPT TO hypothesized names, like so

    $ telnet host 25
    MAIL FROM: [email protected]
    250 Sender OK
    RCPT TO: afranks
    550 Recipient not found
    RCPT TO: arty.franks
    250 Recipient OK

...

With this list of usernames I logged into the FTP to try to guess trivial passwords:

    $ telnet host 21
    USER arty.franks
    User OK
    PASS 1234
    Login failed
    PASS password

...

Eventually I got a valid username/password combo.

Now I can just telnet <host> and log in. I got a line like this:

    Last login April 12, 1992.
    $

It had this ancient version of IRIX on it, a hard drive under 100 MB, no X, a version of egcs, some ancient version of perl, no bash, and I think 12MB of RAM?

It was fun, but I didn't know what I wanted to do with it. We executed this attack from the school library. Putz'd around a bit, in amazement of how old it was, and that it was still online, and then logged out - never to return.

https://www.youtube.com/watch?v=9EEY87HAHzk - a video of the machine

[ Parent | on HN ]

Re:Don't use 1234 as your password by lostlogin on Sunday November 17, 2013 @11:28PM (#6752534)

We had a presentation given to us by the head of school on the last day of term prior to exams. He walked to the front, turned on the projector, and while chatting entered his username and password. He didn't hit enter or tab - instead he entered his username and password in the username field. Out of an auditorium of a few hundred I did a quick scan. No one appeared to have noticed - I'd have expected a few pens to be out. There was a folder on his desktop called "moderated exam papers" or similar. It was amazing.

[ Parent | on HN ]

Re:Don't use 1234 as your password by mikeash on Sunday November 17, 2013 @08:47PM (#6752042)

If you still had access today, it would be a perfect platform for Bitcoin mining.

[ Parent | on HN ]

Re:Don't use 1234 as your password by mhurron on Sunday November 17, 2013 @10:29PM (#6752323)

Did you not see those specs? Or is it that for some strange quirk of something my Iris is a great money making machine?

[ Parent | on HN ]

Re:Don't use 1234 as your password by sp332 on Sunday November 17, 2013 @11:12PM (#6752476)

Well if you're not paying for it, it's still 100% profit :)

[ Parent | on HN ]

Re:Don't use 1234 as your password by 300bps on Sunday November 17, 2013 @11:27PM (#6752533)

What's 100% of 0?

[ Parent | on HN ]

Re:Don't use 1234 as your password by mikeash on Monday November 18, 2013 @10:04AM (#6754588)

Just a joke about the great HN Bitcoin craze in general, and the occasional crazy schemes people come up with to turn small amounts of computing power into pointlessly small amounts of Bitcoin, like the recent JavaScript miner that you hide on your site and run on visitors' computers.

[ Parent | on HN ]