[ Thanks to Peter N. M.
Hansteen for this link. ]
“As large parts of the Western world prepares for the
holidays, the swarm of little robots that started trying to pry
open the doors to my machines some weeks back are still at it. As
far as we can tell, the coordinated attempts started some time in
early November or perhaps late October (we don’t keep logs around
for long enough to be sure), with an alphabetic progression that
has now progressed to somewere into the os. The complete listing
from the time I started noticing up to the time I started writing
this column can be found here…“The distributed, slow bruteforcers are different. For one, the
login attempts from each host out in the cloud are spaced far
enough apart in time that intrusion attmpt detectors will not
trigger. Next, it takes a keen eye to spot the common thread in the
attempts spaced up to a number of minutes apart: a monotonously
alphabetic progression of user names, with attempts coming in from
different hosts. Some number of attemtps at a specific user name,
before the cloud moves on the next one, in alphabetic order.”