full-disclosure - Re: SSHatter 0.6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <470962A8.5020306@kallisti.se>
Date: Mon, 08 Oct 2007 00:50:16 +0200
From: Anders B Jansson <hdw@...listi.se>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: SSHatter 0.6

phioust wrote:
> Who does a tool like this help?
> 
> I would hope that the professionals on this list would not rely on weak
> password combinations for access into systems.
Several of those professionals have to administer or otherwise deal with
systems, admins and users who are not as enlighted.

There are better tools, but don't dismiss tools based on the assumption
that people are to 'smart to fall for that'.

One of the biggest problems is that the generic admin/user isn't.

> That leads me to believe that this will only help script kiddies and
> flood my ssh logs with more root:root and mysql:mysql failed ssh attempts.
There are several good tools to get rid of that.

Just drop unwanted bruteforce scans in a nice 'block drop' hole.
You'll never see them again.
-- 
// hdw

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/