A recent article on SecurityFocus analyses the patterns in recent SSH login attacks.
Most of the results of this analysis were fairly unsuprising to anyone who runs a public-facing SSH server. root
and various other system-level accounts are prime targets for attack, despite the fact that any competent sysadmin will have disabled remote logins for these accounts. I personally have seen repeated attacks looking for account names like lpd
and harrypotter
.
The analaysis of passwords used is also not suprising, with simple strings of numbers ("123456" or "11111") or letters ("password" or "admin") being common. I remember one NT system …