They don't have a password list
One source network tried 390 distinct usernames and gave 329 of them the identical treatment: the name as the password, then the name with 1, 123, 1234 and 12345 appended. Five guesses a second apart, then it moves on. No dictionary is being carried at all — the password is derived from the account name.
They are not carrying a password list. They build one out of your username.
Guessing is usually pictured as a huge dictionary being worked through, millions of leaked passwords against every account.
This source did something much cheaper. Take the account name. Try it as the password. Then the name with a one on the end. Then one two three. Then one two three four, then one two three four five.
Five guesses, a second apart, and it moves on to the next name.
Three hundred and ninety different account names arrived from that network. Three hundred and twenty-nine of them got exactly that ladder, unchanged.
It works often enough to be worth it, because a name-shaped password is what a person picks when nobody is watching. No list to buy, no list to carry.
Key authentication ends this whole category in one move.
#linux#security#ssh#passwords#sysadmin
❯ Key authentication ends this whole category in one move.