I just experienced a brute force attack where the attempted usernames looked pretty strange, like random bursts of characters. It got me wondering, have commonly used usernames like 'admin' become outdated to the point where attackers are now trying these nonsensical combinations? Why do they bother with this method?
4 Answers
They say there are only two hard problems in Computer Science: cache invalidation and naming things. It’s ironic since many attackers start with the numbering from 1 instead of 0, which could mess things up for them.
Could this be some kind of honeypot detection? If a system is allowing total gibberish as usernames and passwords, maybe it's a trap set up to catch miscreants?
It's possible that the attacker set things up incorrectly. Sometimes, they might end up putting the password in the username field by mistake. There are also tools that can create random combinations, which could explain those weird usernames. They might just be throwing anything they can at the wall to see what sticks!
I've seen cases where attackers actually watch security logs. They might attempt a known username and then try to log in right after with a password, which might lead to discovering new usernames.
Ha, sounds like they could be script kiddies just randomly generating those usernames without much thought!
Damn, I really need to reconsider my 'admin' usernames now. I guess they’re kind of an open invitation for these attacks! Might be time for some clever variations instead of the usual.
Just add a couple of numbers at the end or something! A little tweak can make all the difference.
Haha, love that reference! You definitely nailed it with that!