Feeds

MS honeypot research sheds light on brute-force hacks

An idiot's guide to stronger passwords

Beginner's guide to SSL certificates

Microsoft's honeypot-based research has highlighted common password mistakes, as well as shedding light on automated hacking techniques.

Attack data collected from an FTP-server honeypot revealed that most attacks attempted to log into administrator accounts (Administrator and the French equivalent Administrateur were by far the two most commonly attacked userIDs) using dictionary-based attacks.

Many of these brute force attacks were reckoned to originate from bot networks of compromised Windows PCs.

The most common attempted passwords in brute force attacks were (in descending order) password, 123456, #!comment:, changeme and Fuckyou. From the exercise, which lasted a year, Microsoft extrapolated general password advice for internet accounts that's just as applicable to consumers as sys-admins.

Security researchers at Microsoft recommended the use of hard to guess passwords featuring letters, numbers and symbols while noting "there are passwords in dictionaries that are even using special characters (for example #!comment: ), not only numbers and letters".

Web users would therefore be wise to choose a password featuring a combination of upper and lower case letters. Choosing longer passwords is also helpful, a blog entry on the research on Microsoft's Malware Protection Centre blog concludes.

A password-checking tool developed by Microsoft (here) allows users to check on the strength of the passwords they pick. ®

Beginner's guide to SSL certificates

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
How to simplify SSL certificate management
Simple steps to take control of SSL certificates across the enterprise, and recommendations centralizing certificate management throughout their lifecycle.