What are spambots doing with unintelligible login attempts?

Question

After constantly being under attack in phpBB, I created a new forum by hand, which successfully prevents spam bots from registering, and I get a report for every failed login attempt, telling me the info they tried, their IP address, whether they're blacklisted, etc. Of those that are from spam bots, the login info I see from these spammers are garbled username and password, like these:

[username] => BKujXjbL
[password] => 2454HIYQYH

[username] => Antiretewssar
[password] => 4xi82JfkbS

[username] => a
[password] => CKNSC58E3U

My question is, why would spam bots try username/password combo that no humans would create? I feel trying something like smith/123456 has a much better chance of a successful login on a given site. At first I thought these are some "secret code" that can bypass the login script, but I quickly realized that there's no such thing as a login bypassing code. Or are they doing something other than cracking password?

*Update (2/10/2014) *

I've been getting around 15 failed login attempts everyday from these bots. Some of these usernames are real usernames (eg. Danielbold), some contain brand names (eg. in my case, for an originally-Australia-based winter shoes), and the rest are likely non-human usernames (eg. bnCwVFmIWbweQJr). All passwords are still unintelligible, possibly hashed passwords truncated to 10 characters. It was interesting to see an attempt to use identical username/password combo (Astectton/kea85aXe8W) on 2 separate occasions, so these combos should be from a certain database and not randomly generated on the spot. It's interesting to see that these similar attempts come in from different places: US, Canada, Netherlands, China, etc., suggesting it's a very common bot code that many hackers(?) use.

It's also really interesting that no one else has encountered the same problem.

Answer 1

These logins might be the result of spambots outwitting each other. This scenario doesn't seem that implausible to me:

1. Webmaster sets up a web forum for testing purpose
2. Webmaster forgets that he even did and lets it keep running on some forgotten webspace
3. SpambotA finds the forum, and decides to have some fun with it. It creates tons of accounts with random names and passwords and posts spam search engine optimization.
4. A critical security flaw in the forum software is discovered which allows to read usernames and passwords from the database. Webmasters are urged to install the patch ASAP, but our webmaster doesn't care.
5. SpambotB comes around, hacks the forum using that vulnerability and gets the login data
6. Not noticing that these aren't legitimate logins, SpambotB tries the same username and password combos on another forum, because people tend to use the same usernames and passwords on different websites.

Answer 2

The simple answer is that these are likely to be actual username/password combinations extracted from attacks on other sites. Password lists contain all sorts of weird and wonderful characters and words you might not expect, but the very fact they are on there usually means they are in use, or at least have been in use.

These spam bots are simply trying to brute force the user/pass space on your site, and millions of others.

Answer 3

There are so many possibilities for the random-looking passwords, any single explanation will be pure speculation. However, it's safe to assume they were most likely harvested from accounts on various compromised servers.

Based on the example passwords you listed in your original question, I'm inclined to think they are either base64-encoded hashes or machine-generated passwords.

Let's look at those passwords again:

[password] => 2454HIYQYH
[password] => 4xi82JfkbS
[password] => CKNSC58E3U

Hashes

Any respectable authentication system hashes its passwords instead of storing them in plaintext. If the "passwords" above are hashes, they are obviously not encoded in hexadecimal, because (1) they contain letters other than a-f and (2) one of them even contains mixed-case. They might be base64-encoded, and perhaps are even truncated to 10 characters. Truncating them increases the chance of a collision, but the designer of the system may have thought the truncated hash was still secure enough.

Machine-generated passwords

There are several reasons why they might be machine-generated passwords.

1. Some people use password generators (either software, or the "pound on keyboard" random password generator), and 10-character mixed-case alphanumeric characters were long considered to be secure.
2. Some companies assign passwords which cannot be changed by the user
3. Forum spam-bots may have generated the accounts (as suggested by Philipp)
4. Many websites will create a default password for you, which is reset when you activate your account.

At the moment #4 is my favorite explanation, just because I personally have registered on dozens or hundreds of sites which then e-mailed me and required me to activate my account by clicking on a link and/or logging in with a default password that was sent in the e-mail. It's highly likely that many accounts with these default passwords were either created by people who didn't activate their accounts, or they were created by 'bots which could not activate the accounts because they did not have access to the e-mail accounts they used for registration.

Random-looking usernames

If we look again at the usernames in the username-password combinations, those also look generated:

[username] => BKujXjbL
[password] => 2454HIYQYH

[username] => Antiretewssar
[password] => 4xi82JfkbS

[username] => a
[password] => CKNSC58E3U

Again, there are many possible explanations for this, but here are a few:

1. Some companies assign usernames
2. The usernames were harvested along with the associated passwords (possibly from a 'bot-infested forum database, as suggested by Philipp)
3. The usernames were harvested, but all the usernames are being tested with all the harvested passwords and perhaps with some other dictionary-based or brute-force generated passwords (though you mentioned that you haven't seen very many dictionary-based passwords)

Answer 4

I do not think it is as simple as bots attempting to log in, but bots attempting to exploit web forms in general for SEO purposes which will also catch signup/login forms.

The strings can serve as a unique identifier generated to identify the site/page the bot is attempting to exploit.

The reason for the bots using these nonsensical strings may be to query for the same values in search engines later to target which sites are going to work for SEO exploits later on without revealing their "client's website". By querying google, bing, yahoo, etc for 'BKujXjbL' would turn up if that specific target was successful or not rather than having say 'viagraiscoolyadda.com' in the logs of non-working targets.

Some may use more intelligent methods of filling out forms it encounters, matching data types such as valid emails in email fields, etc, to mask its true nature, such as real looking names, usernames, emails, etc - which could very well come from harvested or hacked databases.

I think this bot's owner will have some false positives thanks to this thread :)

https://www.google.com/search?q=BKujXjbL