Hacked, now trying to disinfect

Dave Uhring <daveuhring.TakeThisOut@yahoo.com> writes:

>On Thu, 02 Aug 2007 21:02:47 +0000, Unruh wrote:

>> Dave Uhring <daveuhring.TakeThisOut@yahoo.com> writes:
>>
>>>On Thu, 02 Aug 2007 14:06:59 -0400, Randy Yates wrote:
>>
>>>> Also, it's much more likely that the username will susceptible to a
>>>> dictionary attack.
>>
>>>There is *no* dictionary attack required for the root account and the
>>>ease of cracking root's password is the same as for a user. Now how
>>>difficult is that to understand?
>>
>> Eitehr you are very confused or you express yourself badly. Dictionary
>> attacks are always the first choice of the attacker.

>I was discussing the attack against user account *names* there. No
>attack can succeed even against a user account unless the attacker can
>first guess a valid account name. The root name requires no guessing.

>In *every* attack recorded in my log the root account was attacked first.
>And no, I cannot post the log since it was rotated out long ago. In
>addition to disabling root login I also have enabled tcpwrappers on sshd
>to limit, indeed put an end to, the ssh attacks.

Well, that is not true in my logs. They try a whole bunch of user type
accounts first, and then do a determined attack on root.
tcpwrapper helps not at all if you need to log onto your system from all
over the world.



>> People tend to
>> choose words as passwords, and any cracker would be an idiot to launch a
>> full scale brute force without doing dictionary first. And users are
>> more likely to use easy words simply because they are not as security
>> concious.

>Again, the usernames must be guessed, at least those which have shells.
>After failure to attack root the typical attack goes after usual system
>accounts, which gets them nowhere without a shell. Next they go after
>common names in what one might describe as a dictionary attack against
>user account names.

Sure, And I have seen it happen in th eopposite order as well.


>Your order of attack is bass ackwards from reality.

Depends on whose bass we are talking about.


>>>Have you ever examined the logs of some of those ssh attacks?

>The question applies also to you, Bill.

Yes.

On Fri, 03 Aug 2007 01:51:31 +0000, Unruh wrote:

> Dave Uhring <daveuhring DeleteThis @yahoo.com> writes:

>>In *every* attack recorded in my log the root account was attacked
>>first. And no, I cannot post the log since it was rotated out long ago.
>>In addition to disabling root login I also have enabled tcpwrappers on
>>sshd to limit, indeed put an end to, the ssh attacks.
>
> Well, that is not true in my logs. They try a whole bunch of user type
> accounts first, and then do a determined attack on root. tcpwrapper
> helps not at all if you need to log onto your system from all over the
> world.

With your own system you can more easily enforce good passwords on
yourself. It's somewhat more difficult with a system with many users, at
least not without accusations of being a dictatorial bastard.

>>Again, the usernames must be guessed, at least those which have shells.
>>After failure to attack root the typical attack goes after usual system
>>accounts, which gets them nowhere without a shell. Next they go after
>>common names in what one might describe as a dictionary attack against
>>user account names.
>
> Sure, And I have seen it happen in th eopposite order as well.

Regardless of the order in which it occurs, an attack against a user
account, at least one with a good password is more difficult than an
attack against root. The attacker has to guess the user's name; he
already knows "root".

>>>>Have you ever examined the logs of some of those ssh attacks?
>
>>The question applies also to you, Bill.
>
> Yes.

How many times was the account 'bunruh' or whatever you use actually
guessed and attacked?