1

I have two user accounts on my PC. About 2 years ago I was doing some testing and left one of my local accounts open to RDP with no password accidentally for about a month.

A hacker got in and started screwing around before I caught him, and realized the account was open and quickly locked things down. No serious harm was done, and I removed the ability for anyone to login on the compromised account.

That PC no longer exists and the boot drive is completely different, but I have replaced it with another PC using the same user-account names (they make sense). A week ago I realized that computers in Russia, Latvia, and China were hammering my RDP port pretty hard. Most of them are trying random account names like "MARY", "ADMIN", "RYDER", etc., but disturbingly I've noticed that sometimes they are directly referencing the two user accounts on my system (although this seems to usually come from the same CIDR /16 sub blocks).

I've been banning these ranges, but I'm wondering if these account names are in some way being exposed to the outside? Is it possible they've just "wrote" down the account names they were able to see when my PC was stupidly open, and now those accounts are on a list somewhere?

I've taken other security precautions and changed my passwords, changed my RDP port, etc., so I'm not terribly concerned, but it is disconcerting.

Improve this question
2
  • 1
    Are your usernames common enough to be part of a generic dictionary? Like a person's name?
    – trallgorm
    Commented Feb 15, 2019 at 19:30
  • @trallgorm Yes they are reasonably common usernames, but these IPs I'm monitoring are only trying the two accounts (some of them bouncing between both), and no others. For example a brand new IP from Russia I hadn't spotted in the last week showed up this morning and started trying to login using the account name that hasn't been available for login in 2 years. They aren't just randomly guessing.
    – Mordred
    Commented Feb 15, 2019 at 20:09

1 Answer 1

Reset to default
1

Attackers will often aggregate useful offensive knowledge. A good example is combo listing, where cracked passwords and matching usernames are made into giant lists which are passed around.

It could be that the attacker who gained access saved your username/password combinations, or even sold them to other people. It's not too surprising that the usernames, which are now compromised information, are being targeted again.

Question for you: has your IP or domain changed since the first compromise? If not, then it's almost expected the attacker would try those same usernames against your host. If RDP has a banner which uniquely identifies your host that might be another way those usernames are being associated with your system.

Improve this answer
1
  • 1
    The IP has changed twice (including last night!), but I have a dynamic DNS entry that maps to it. Presumably that's what they're going off of rather than IP.
    – Mordred
    Commented Feb 16, 2019 at 7:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .