Re: crack attempt?

[Katipo <katipo@weavers-web.org>]

Philippe Marzouk wrote:

> On Tue, Aug 10, 2004 at 02:33:20AM -0500, Will Trillich wrote:
>  
>
> > aha -- i think i actually attracted a script kiddie!
> >
> >
> >    
> [...]
>  
>
> > ----- End forwarded message -----
> >
> > the fact that each attempt is a few seconds from the previous
> > one (and that there were only eight tries) leads me to believe
> > this was a human, and not a 'bot of some sort.
> >
> > he even tried "guest"! (standard windows hole -- is it of likely
> > cnocern to a debian system?)
> >
> >    
>
> I have exactly the same thing in my logs since a few weeks. In general
> from IPs with no reverse DNS set.
> They test guest, test sometimes root.
> It may be some automated tools as it is always the same logins which are
> tried.
>  
I've tracked it down to a couple of bored ISP help desk staff in the past.
This seems to be the main occupation for junior crackers.
They have some spare time, so they practice.
Regards,

David.