Newsgroup: comp.risks

RISKS-LIST: Risks-Forum Digest  Friday 3 August 2007  Volume 24 : Issue 77

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
  <http://catless.ncl.ac.uk/Risks/24.77.html>
The current issue can be found at
  <http://www.csl.sri.com/users/risko/risks.txt>

  Contents:
Structural problems with the I-35W bridge span (PGN)
Driver follows GPS when he should not (Erwan David)
"Meteorology Police -- you're BUSTED!" (Annie Johnson via Paul Saffo)
Hacked passport crashes RFID readers (Jeff Jonas)
IRS computer security/privacy problems (PGN)
User-hostile behavior (Steve Summit)
Location-Based Dictionary Attacks (Diomidis Spinellis)
Amazon chasing 2-cent Web services bill (Martin Redington)
Windows Live Messenger blocking even more completely innocuous text
  (Cody Boisclair)
Re: Accuracy of Hawkeye at Wimbledon (Paul Wallich)
Fraudproof voting protocols from scientists (Warren Smith)
REVIEW: "Implementing ITIL", Randy A. Steinberg (Rob Slade)
Abridged info on RISKS (comp.risks)

----------------------------------------------------------------------
[...]
------------------------------

Date: Thu, 02 Aug 2007 10:08:29 +0300
From: Diomidis Spinellis <dds@aueb.gr>
Subject: Location-Based Dictionary Attacks

I get daily security reports from the hosts I manage. Typically these
contain invalid user attempts for users like guest, www, and root.
(Although FreeBSD doesn't allow remote logins for root, I was surprised to
find out that many Linux distributions allow them.)

Today's log surprised me, because it contained only Greek names. Here is an
excerpt from the log.

Aug  1 00:19:42 istlab sshd[22137]: Invalid user achaikos from 210.17.252.20
Aug  1 00:19:45 istlab sshd[22191]: Invalid user achilleus from 210.17.252.20
Aug  1 00:19:48 istlab sshd[22218]: Invalid user actaeon from 210.17.252.20
Aug  1 00:19:51 istlab sshd[22244]: Invalid user acteon from 210.17.252.20
Aug  1 00:19:55 istlab sshd[22279]: Invalid user adelpha from 210.17.252.20
Aug  1 00:19:58 istlab sshd[22302]: Invalid user adelphe from 210.17.252.20
Aug  1 00:20:01 istlab sshd[22321]: Invalid user adelphie from 210.17.252.20
Aug  1 00:20:04 istlab sshd[22353]: Invalid user adonia from 210.17.252.20
Aug  1 00:20:08 istlab sshd[22387]: Invalid user adonis from 210.17.252.20
Aug  1 00:20:11 istlab sshd[22400]: Invalid user adrasteia from 210.17.252.20
Aug  1 00:20:14 istlab sshd[22417]: Invalid user adrastos from 210.17.252.20

The attack to this host (which is based in Athens, Greece) came from a
Hong-Kong-based machine, and the list contained many exotic Greek names
while also missing many common ones. Therefore, I doubt that this was a
local attack. A Google search revealed that the name list was obtained by
merging male Greek names and female Greek names from
http://www.20000-names.com. Most probably an attack tool contains lists of
names for specific countries (the same site also provides, African, Chinese,
English, French, German, Hebrew, Irish, Italian, Japanese, Polish, Spanish,
and Welsh names). The tool also maps the IP address of the host it attacks
to a specific country, for instance, through the geolocation data of the
IP-to-Country databases http://ip-to-country.webhosting.info/. Finally, the
attack tool uses the country-specific list for trying to log in to those
accounts. Attackers seem to be getting more sophisticated with every passing
day.

Diomidis Spinellis -     http://www.spinellis.gr

------------------------------
[...]
------------------------------

End of RISKS-FORUM Digest 24.77
************************

Unless otherwise expressly stated, all original material on this page created by Diomidis Spinellis is licensed under a Creative Commons Attribution-Share Alike 3.0 Greece License.