Educause Security Discussion mailing list archives
Re: Passwords & Passphrases
From: Mike Iglesias <iglesias () UCI EDU>
Date: Mon, 19 Nov 2007 19:02:42 -0800
Bob Bayn wrote:
What finally prompted us to get off our "any 4 or more characters" butts was dictionary attacks that were hitting our proxy server and VPN server from Chinese IP addresses. Once past our firewall through proxy or VPN they are able to snoop our network from inside probing machines undetected, and do unappreciated things like download subscription databases from the library until the provider got suspicious of the traffic.
We see some of this too, but I'm pretty sure most of logins from China are using passwords captured by keyloggers, not password guessing. There's no pattern of repeated login attempts to the accounts used - they just log in, log out, and move on to the next account/password. -- Mike Iglesias Email: iglesias () uci edu University of California, Irvine phone: 949-824-6926 Network & Academic Computing Services FAX: 949-824-2069
Current thread:
- Re: Passwords & Passphrases, (continued)
- Re: Passwords & Passphrases Harold Winshel (Nov 19)
- Re: Passwords & Passphrases Steven Alexander (Nov 19)
- Re: Passwords & Passphrases Alex (Nov 19)
- Re: Passwords & Passphrases Harold Winshel (Nov 19)
- Re: Passwords & Passphrases Harold Winshel (Nov 19)
- Re: Passwords & Passphrases Peters, Kevin (Nov 19)
- Re: Passwords & Passphrases Gene Spafford (Nov 19)
- Re: Passwords & Passphrases Peters, Kevin (Nov 19)
- Re: Passwords & Passphrases Bob Bayn (Nov 19)
- Re: Passwords & Passphrases Gene Spafford (Nov 19)
- Re: Passwords & Passphrases Mike Iglesias (Nov 19)
- Re: Passwords & Passphrases Benjamin Bennett (Nov 19)
- Re: Passwords & Passphrases Eric Case (Nov 19)
- Re: Passwords & Passphrases Harold Winshel (Nov 20)
- Re: Passwords & Passphrases Gary Dobbins (Nov 20)
- Re: Passwords & Passphrases Peters, Kevin (Nov 20)
- Re: Passwords & Passphrases Mike Porter (Nov 20)
- Re: Passwords & Passphrases Willis Marti (Nov 20)
- Re: Passwords & Passphrases Bob Bayn (Nov 20)
- Re: Passwords & Passphrases Steven Carmody (Nov 20)
- Re: Passwords & Passphrases Roger Safian (Nov 20)
(Thread continues...)