Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't use 1234 as your password

nortonwang.com

Post reply on HN
Print view View original

11–20 of 56 posts

Re: Don't use 1234 as your password

#11

Post by PhasmaFelis »

I'm pretty sure, based on that post, that you have a fair bit more system administration experience than I do, which makes the whole thing even more boggling.

I feel like a professional auto mechanic is telling me, all serious-like, that he just learned the hard way why you shouldn't try to drive while running alongside your car, reaching through the window to work the steering wheel, with a brick on the accelerator.

Re: Don't use 1234 as your password

#12

Post by foobarian »

gamegoblin wrote: post #7
hobs wrote: post #2

Also, fail2ban is a useful thing in this instance. But if your password is 1234... what's the deal with that?

One of the first commands I type into a new VPS: sudo apt-get install fail2ban I remember when I got my very first VPS, and within a couple of days I was getting a really long bruteforce where the attacker tried every common name "aaron, adam, alex, etc" and around 120 common passwords for each of them (fortunately my text-based password on that VPS was 41 characters). I think they tried a few thousand usernames tota…

All our workstations at school had static, publicly routable IP addresses. I never got hacked, thankfully, but I still found out about the pervasive ssh bruteforcing fairly quickly. The brute-forcing bots apparently were rate limited to once per second. Since each failed attempt gets logged to disk, this resulted in a faint, periodic "grrrt" sound. It's hard to describe how incredibly annoying this was while sitting next to the machine; certainly annoying enough to figure out what was causing it :-)

Re: Don't use 1234 as your password

#13

Post by kristopolous »

I found a 68K SGI Iris 2400 machine up and running in college in about 2004. It had a sticker with the hostname on it. Later on that week, I went to the department homepage, got the staff roster and tried to guess the usernames.

I telnetted to port 25 and tried RCPT TO hypothesized names, like so

    $ telnet host 25
    MAIL FROM: a@a.com
    250 Sender OK
    RCPT TO: afranks
    550 Recipient not found
    RCPT TO: arty.franks
    250 Recipient OK
...

With this list of usernames I logged into the FTP to try to guess trivial passwords:

    $ telnet host 21
    USER arty.franks
    User OK
    PASS 1234
    Login failed
    PASS password
...

Eventually I got a valid username/password combo.

Now I can just telnet and log in. I got a line like this:

    Last login April 12, 1992.
    $
It had this ancient version of IRIX on it, a hard drive under 100 MB, no X, a version of egcs, some ancient version of perl, no bash, and I think 12MB of RAM?

It was fun, but I didn't know what I wanted to do with it. We executed this attack from the school library. Putz'd around a bit, in amazement of how old it was, and that it was still online, and then logged out - never to return.

https://www.youtube.com/watch?v=9EEY87HAHzk - a video of the machine

Re: Don't use 1234 as your password

#14

Post by bobf »

dangrossman wrote: post #8

The very first time I tried Linux, after spending an entire day downloading Slackware, copying it to a set of install diskettes, partitioning a hard drive and installing it, I set my root password to "12345". I was around 10 at the time, 1995 plus or minus a year or two. After booting for the first time, I dialed up AOL and logged on to a Linux-topic IRC channel. I talked to the strangers there about how excited I wa…

I had a similar experience around the same age and year, except it was with FreeBSD. I got it to boot once, then tried to change the bootloader setup to allow dual booting with the existing MS-DOS 5.x installation. You can imagine how well that went, as a 10 or 11 year old with no previous FreeBSD/Linux experience. My parents were not quite so understanding about why I had broken their $3000+ computer and lost all their files. It took a few days, but I eventually managed to fix the MBR by reinstalling MS-DOS. Imagine my surprise when I booted into MS-DOS and found out that the files were still there!

Re: Don't use 1234 as your password

#15

Post by mikeash »

kristopolous wrote: post #13

I found a 68K SGI Iris 2400 machine up and running in college in about 2004. It had a sticker with the hostname on it. Later on that week, I went to the department homepage, got the staff roster and tried to guess the usernames. I telnetted to port 25 and tried RCPT TO hypothesized names, like so $ telnet host 25 MAIL FROM: a@a.com 250 Sender OK RCPT TO: afranks 550 Recipient not found RCPT TO: arty.franks 250 Recipi…

If you still had access today, it would be a perfect platform for Bitcoin mining.

Re: Don't use 1234 as your password

#20

Post by sillysaurus2 »

GhotiFish wrote: post #17
foobarian wrote: post #9

Earlier quoted context omitted.

Pardon me, but 12345 is 3 extra bits.

explain.

When the password consists of 4 characters, each being 0-9, there are 10,000 possible passwords; 14 bits are required to represent 10,000 possible combinations of anything:

  log(10000) / log(2) == 13.28771
With 5 characters, each 0-9, there are 100,000 possible combinations, and that requires 17 bits:

  log(100000) / log(2) == 16.60964
Therefore, 12345 offers 3 extra bits of security compared to 1234.
Post reply on HN