4 ms·
Did someone record which username/passwords those bots try? I never bothered with that.
by vbezhenar 4y ago
Did someone record which username/passwords those bots try? I never bothered with that.
- moepstar 4y agoHm, that's probably pretty run-of-the-mill default user/password combinations, unless someone specifically targets you?
- incomingpain 4y agoBack when I ran cowrie and ran statistics my data was pretty similar. Root was getting blown up in the list because of the mirai botnet.
- deleted 4y ago[deleted]
- NovemberWhiskey 4y agoLogging passwords for failed logins is an awful security anti-pattern; please don't do that.
- nousermane 4y agoHint: you'll get quite a few of real passwords with 1-letter typo, written to disk in plan text, and probably copied to 5 different places, possibly some of them external.
- tialaramex 4y agoI mean, you shouldn't, because you shouldn't have anything, anywhere, using password auth. Which doesn't mean it's OK to log passwords if you do have password auth, it means it's not OK to have password auth.
- snovv_crash 4y agoUsing passwords for SSH is also bad security.
- nibbleshifter 4y agoI used to do that on my honeypots. I'll do it again when I set up new ones, it was neat seeing a new credential pair show up from one attacker only for a while, then show up from more over time as knowledge of some appliances default creds spread across the hacker world.