break-in attempt in my machine

[Karl Auer]

On Sat, 2016-09-03 at 10:13 +0100, Chris Green wrote:
> Yes, but it's 'remote' access in the sense I was meaning, you can't
> brute force a password via an ssh login.  By that I mean you can't
> brute force a password at the ssh login prompt.

Of course you can. It's just a question of bandwidth, and a login
attempt doesn't take much.

If your system doesn't resist it, I can just make ten thousand
simultaneous connections to you; each attempt takes a few seconds to
fail, but my aggregate attempt rate is still in the thousands per
second range. If I'm smart I'll do it from a botnet so that the
attempts don't all come from the same place.

If you have one of the ten thousand most common passwords, I will have
pwned you in ten seconds, at a cost of about $50. The more powerful
your system is and the more bandwidth you have the easier the attack
is. By the time the side effect - a DDoS - is noticed, you've already
lost.

Regards, K.

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Karl Auer (kauer at biplane.com.au)
http://www.biplane.com.au/kauer
http://twitter.com/kauer389

GPG fingerprint: E00D 64ED 9C6A 8605 21E0 0ED0 EE64 2BEE CBCB C38B
Old fingerprint: 3C41 82BE A9E7 99A1 B931 5AE7 7638 0147 2C3C 2AC4