On the Importance of Decent Passwords

Nothing really new here, but I thought this was interesting and maybe someone will learn from this. If you think “P@$$w0rd” is a good password, you should definitely learn from this (and change your password).

There’s a botnet that’s been particularly active recently trying to bruteforce passwords. As in, many, many times more active than the usual bruteforce activity I see on my servers. I don’t know if it’s the same botnet that Synology has been warning about lately, but either way, it’s a global botnet that is trying a lot of passwords. I’ve been watching it try to crack into my mail server for a few days now. Good practices include:

1. Using strong passwords for anything that faces the Internet
2. Using a bruteforce detection system like CSF/LFD or fail2ban to block IPs that will otherwise hammer your server all day (if you run a server)

Below is a list of about 500 passwords this botnet tried over the course of a few hours today. These attempts came from all over the world: China, Russia, Thailand, the United States, South Korea, Great Britain, Sweden, and Canada, to name a few (which is why blocking countries doesn’t help much – it’s easy to bypass those blocks with a VPN or a botnet).

None of these is anything close to any of my actual passwords (“admin”? really!?), but if you’ve ever set up a service and created a quick password resembling any of those below that you promise you’ll change later, don’t do that.

Notice that at quick glance, no password was attempted more than twice. That tells me there’s a control server somewhere telling the botnet what to do and keeping track of the results of the attempts. Otherwise I’d expect to see more duplicates if it was just hundreds of machines running a brute force script with the same internal logic.

Just keep in mind that while you’re at work, sleeping, or out having fun, there are machines all over the world quietly trying to guess your passwords, 24 hours a day. So keep them strong. I’ve worked in web development and system administration for decades, and I still know people who choose passwords like this.

Oh, and 12345? I’ve got the same combination on my luggage!