I recently (and stupidly) created a Windows SBS 2011 user whose password was the username. Multiple unauthorized people across the Internet used RDP to log in as that user. How did they find the username?
4
-
4Brute-force. They try a lot number of times including combinations like test/test or username/username. If you are connected to internet and create more or less known name with the same password it will definitely get discovered.– AriaJul 18, 2016 at 15:15
-
1Did you ever use it yourself? Could it be construed as a 'common' name?– user53693Jul 18, 2016 at 15:24
-
Also may want to rethink using the standard RDP port, if only to have two methods to avoid attackers (complex password being first and most important change). I use what I consider to be a trivially obfuscated port number and still have not had a single unauthorized login attempt in the year or so it has been online.– Jeff MedenJul 18, 2016 at 17:05
-
Windows username can be interrogated just like you interrogate a domain name for it's IP address by simply using ICMP.– OvermindJul 19, 2016 at 11:22
Add a comment
|
1 Answer
Your account may have been brute forced. This is when someone writes a script to (not manually, automatically) try all combinations of usernames/passwords up to a certain length.
For example, one alogrithm my start out with a then go through z then try aa, ba, ca, ... za, ab, ac, ..., zz for usernames length up to a certain number. Some/Most brute-forcers also check for the most common usernames such as "admin", "root", and common names.
If your username was short, it's much more vulnerable to brute-forcing, since the longer the password is, the more possibilities there are to the username of that length.
With crystal ball in hand, I predict your username was either a) really short or b) a common name.
answered Jul 18, 2016 at 15:42
-
Amazingly, RDP brute force bots tend to spend a lot of time on this (dozens of attempts per second) and they will simply not relent, ever, unless you block them via firewall. So even a somewhat obscure username/pw (as long as its still within reach of a few million attempts) is perfectly breakable Jul 18, 2016 at 17:11
-
@JeffMeden how are RDP brute force bots different from any other protocol's brute force bots? Jul 18, 2016 at 18:40
-
few other remote protocols have such weak out of the box settings for brute force resistance as RDP (until very recent versions) so other protocols typically see hits occasionally as bots come through trying the few most popular defaults, but RDP bots will rotor through thousands (millions maybe) and hit the same host for hours/days Jul 18, 2016 at 19:48
-
@JeffMeden just more proof not to trust the security of microsoft products :) Jul 18, 2016 at 20:32