Re: brute force

[cklaus () ISS NET (Christopher Klaus)]

> Pop3 isn't the only thing with that problem.  Stock rexec, for example, never
> logs anything and is another good way to hammer on password guesses from the
> outside.  [See "rservice.c" to make this easier...]  Several other daemons,
> particularly the vendor-supplied variety, are similarly lame.  That's what tcp
> wrappers and logdaemon are for..

Here are several services we bruteforce attack:

telnetd
rexecd
ftpd
rshd
pop3
filesharing

If you automate a bruteforce attack and do simultaneous connections to speed
up the attack, they are all vulnerable to denial of service if inetd quits
listening to a port.

You might think that with today's password cracking programs and all, a
remote bruteforce attack would be futile.  But suprisingly (or maybe not)
how many machines are wide open with default accounts and accounts gathered
from finger/rusers.

Telnetd,rexecd,rshd,rlogind should all be turned off and replaced with
a tool like ssh.   But even ssh can be bruteforced, it is just a LOT more
time consuming since it only allows 1 try per connection and there is
quite a bit of time consumed generating the random keys for transferring.

Bruteforce for Filesharing for Win95 is probably the most
efficent attack in that no logging is done and you can do about
200 password attempts a second remotely.

You can try to bruteforce your own machine with our software at:

        http://www.iss.net/