3 ms·
I was the victim of an SSH scan once. I set up an old box as a dev server in my apartment for a project course in college. I was in a group of about 12 students
by mrshoe 16y ago
I was the victim of an SSH scan once. I set up an old box as a dev server in my apartment for a project course in college. I was in a group of about 12 students. One of them whose username was robert set his password to robert (a brilliant move).
We only realized the machine was compromised because the interloper decided to pick two user accounts at random and delete them (another brilliant move).
Upon investigation I found that a keylogger had been installed in order to discover the root password. I inspected the output of the keylogger to trace the attacker's steps. Similar to the SSH scan in the article, the attacker had logged into his own FTP server to download various scripts and crackers. Well, the keylogger had logged his FTP password as well (whoops). Naturally I logged in and deleted absolutely everything in sight. :-P
- BrandonM 16y ago> Naturally I logged in and deleted absolutely everything in sight. :-P ...and you probably completely screwed over some hapless soul who was a victim of the same guy who cracked you. Do you think these guys put their IP address and FTP password out there for anyone to collect as evidence? Most likely, he hacked into an FTP server and hosted his malicious files there along with everything else that was already hosted there. Congratulations on breaking the law and ruining someone's day.
- 16s 16y agoMost likely the "hacker" broke into the FTP server because the admin of that server used the word "password" as his password. So natural selection took them both out. Two less idiots to deal with.
- BrandonM 16y ago> Two less idiots to deal with. That's an interesting attitude. Do you often find yourself having to "deal with" benign-but-ignorant FTP admins? Keep in mind that many people running FTP sites are not technical by trade, and you're using a rather wide brush stroke to paint a bad picture of many perfectly reasonable people. Besides, judging by the recent submission of the decompiled code from RTM's worm from 1988 (http://news.ycombinator.com/item?id=1916186 http://news.ycombinator.com/item?id=1916186), hackers are a bit more sophisticated than you imply.
- 16s 16y agoOne does not have to be "technical by trade" to know that using "password" as your password is wrong. Only idiots do that. And they do do that, otherwise the "sophisticated hackers" (I jest) would not be "cracking" all of these OpenSSH servers by guessing the passwords. The user sets passwords such as secret, letmein, abc123, etc. And then these "elite hackers" you speak of come along doing simple brute force because... wait for it... it works: http://www.dragonresearchgroup.org/insight/sshpwauth-cloud.html http://www.dragonresearchgroup.org/insight/sshpwauth-cloud.h...
- user24 16y ago> using "password" as your password is wrong. Only idiots do that and that means they deserve their files being deleted? What if that person was a non-tech savvy biologist working on cancer research? Or a college admin person and those files were the grades for the graduating year? Serves 'em right for choosing a lame password and not setting up their own RAID server, eh?
- 16s 16y agoIf you run with scissors and fall, you may impale yourself. That does not mean (as you suggest) that they "deserved" it. It's a simple fact.
- pavel_lishin 16y agoExcept in this analogy, you tripped them.
- petercooper 16y agoI don't know jot all about car repair and if I tried to enact a casual repair and burnt myself or caused some other catastrophe, it would not be unreasonable to be considered an "idiot" by a professional mechanic. The merit of the agent or situation involved (picking a cancer researcher seems like a clever and emotional rhetorical ploy) does not affect the demand for having domain knowledge when using or maintaining certain systems.
- wizard_2 16y agoTry to get the cops to care about this. Try to get campus security to care about this. Try to get your campus IT department to care about this. (They probably don't want you running servers anyway.) Law enforcement has bigger issues. In a world where HBO can send a letter to my roommate from an IP in 10 days, and the police investigating a robbery have to wait 9 months for the same thing. You did the right thing. I would have played a longer con game instead of nuking some random ftp server, he probably just set up another one.
- mrshoe 16y agoI should have mentioned that I definitely thought of this scenario before I deleted anything and confirmed, via the hostname of the server, directory names, and file names, that everything on that server was for h4x0ring (at least for that user account). I also thought of more subtle and clever ways to exact revenge, but decided I was too busy to pursue any of them. Also: Do you think these guys put their IP address and FTP password out there for anyone to collect as evidence? Yes, I do. You're giving the script kiddies far too much credit.
- BrandonM 16y agoI'm glad to hear that, thanks for clearing it up. Of course, I also intended my comment as a warning to others that the origination of hacking might not necessarily be the culprit.