21

After constantly being under attack in phpBB, I created a new forum by hand, which successfully prevents spam bots from registering, and I get a report for every failed login attempt, telling me the info they tried, their IP address, whether they're blacklisted, etc. Of those that are from spam bots, the login info I see from these spammers are garbled username and password, like these:

[username] => BKujXjbL
[password] => 2454HIYQYH

[username] => Antiretewssar
[password] => 4xi82JfkbS

[username] => a
[password] => CKNSC58E3U

My question is, why would spam bots try username/password combo that no humans would create? I feel trying something like smith/123456 has a much better chance of a successful login on a given site. At first I thought these are some "secret code" that can bypass the login script, but I quickly realized that there's no such thing as a login bypassing code. Or are they doing something other than cracking password?

*Update (2/10/2014) *

I've been getting around 15 failed login attempts everyday from these bots. Some of these usernames are real usernames (eg. Danielbold), some contain brand names (eg. in my case, for an originally-Australia-based winter shoes), and the rest are likely non-human usernames (eg. bnCwVFmIWbweQJr). All passwords are still unintelligible, possibly hashed passwords truncated to 10 characters. It was interesting to see an attempt to use identical username/password combo (Astectton/kea85aXe8W) on 2 separate occasions, so these combos should be from a certain database and not randomly generated on the spot. It's interesting to see that these similar attempts come in from different places: US, Canada, Netherlands, China, etc., suggesting it's a very common bot code that many hackers(?) use.

It's also really interesting that no one else has encountered the same problem.

8
  • 6
    Dear God! Look at these passwords. No human could create such a thing!
    – tylerl
    Feb 4, 2014 at 17:29
  • 1
    All the examples you've given have 10-character passwords. Is this just a coincidence, or are all of your harvested passwords the same length?
    – rob
    Feb 4, 2014 at 21:25
  • 4
    Are those the accounts they attempted to register? Perhaps they just don't have proper error handling and attempt to log into their own account they didn't actually manage to create. Feb 4, 2014 at 21:50
  • 3
    Why aren't those passwords hashed in the first place? Feb 5, 2014 at 2:59
  • 1
    To rob: yea, they seem to be all 10 characters long. To CodesInChaos, QuestionOverflow: These are from spambots, with blacklisted IPs or coming from countries that site visitors definitely don't live in. Suspicious login attempts are logged and it's easy to reverse md5().
    – Alex
    Feb 5, 2014 at 8:49

4 Answers 4

25

These logins might be the result of spambots outwitting each other. This scenario doesn't seem that implausible to me:

  1. Webmaster sets up a web forum for testing purpose
  2. Webmaster forgets that he even did and lets it keep running on some forgotten webspace
  3. SpambotA finds the forum, and decides to have some fun with it. It creates tons of accounts with random names and passwords and posts spam search engine optimization.
  4. A critical security flaw in the forum software is discovered which allows to read usernames and passwords from the database. Webmasters are urged to install the patch ASAP, but our webmaster doesn't care.
  5. SpambotB comes around, hacks the forum using that vulnerability and gets the login data
  6. Not noticing that these aren't legitimate logins, SpambotB tries the same username and password combos on another forum, because people tend to use the same usernames and passwords on different websites.
4
  • 2
    I really hope this is true. Will this feedback loop lead to Spambot sentience? ;-) Feb 5, 2014 at 10:00
  • 15
    @NeilSlater By 2047, the only internet users left will be spambots trying to sell replica watches and pills to each other.
    – Philipp
    Feb 5, 2014 at 10:10
  • Incidentally, I left a SMF forum (nothing on it, purely testing and completely forgotten) running on a free webhost some years ago. I checked about a year later for unrelated reasons, and it was completely filled with random user accounts and spam posts. Purged accounts and posts, added a basic captcha, whoops, no more spam...
    – Bob
    Feb 5, 2014 at 23:10
  • @Philipp: Discover the secret to selling crap. Other spambots hate him...
    – deed02392
    Mar 5, 2014 at 13:06
15

The simple answer is that these are likely to be actual username/password combinations extracted from attacks on other sites. Password lists contain all sorts of weird and wonderful characters and words you might not expect, but the very fact they are on there usually means they are in use, or at least have been in use.

These spam bots are simply trying to brute force the user/pass space on your site, and millions of others.

5
  • 11
    I second that. Username/password combos that "no human would create" are username/password combos that you would not create; but your fellow humans can be very creative, and will do things which you would consider very nonsensical. Or maybe most Internet users are secretly hamsters, not humans, which would actually explain a lot of things.
    – Tom Leek
    Feb 4, 2014 at 16:34
  • This answer makes sense, and I agree that they can be created by other humans, but I would imagine seeing at least 1 try with a string that has obfuscated words or a lower entropy ('a' was an exception, so i included it in my example). Also that doesn't explain why bots won't try strings that have a higher probability of getting a "hit."
    – Alex
    Feb 4, 2014 at 18:24
  • @Alex are you saying that you never see any sort of dictionary-based passwords?
    – rob
    Feb 4, 2014 at 21:20
  • 2
    @rob yup. of all 19 attempts over the past day, "ugg bailey button metallic womens gold boots" is the 1 and only dictionary-based text for a username attempt, but that's a very long username containing spaces. A new thought - could these be hashed username/password combos stored in an exploited user database?
    – Alex
    Feb 4, 2014 at 22:09
  • @Alex that's what I was going to suggest. 10 characters seems like a strange length for a hash, but either the raw passwords or the hashes could be base64-encoded. It's also possible they're machine-generated passwords.
    – rob
    Feb 4, 2014 at 22:29
12

There are so many possibilities for the random-looking passwords, any single explanation will be pure speculation. However, it's safe to assume they were most likely harvested from accounts on various compromised servers.

Based on the example passwords you listed in your original question, I'm inclined to think they are either base64-encoded hashes or machine-generated passwords.

Let's look at those passwords again:

[password] => 2454HIYQYH
[password] => 4xi82JfkbS
[password] => CKNSC58E3U

Hashes

Any respectable authentication system hashes its passwords instead of storing them in plaintext. If the "passwords" above are hashes, they are obviously not encoded in hexadecimal, because (1) they contain letters other than a-f and (2) one of them even contains mixed-case. They might be base64-encoded, and perhaps are even truncated to 10 characters. Truncating them increases the chance of a collision, but the designer of the system may have thought the truncated hash was still secure enough.

Machine-generated passwords

There are several reasons why they might be machine-generated passwords.

  1. Some people use password generators (either software, or the "pound on keyboard" random password generator), and 10-character mixed-case alphanumeric characters were long considered to be secure.
  2. Some companies assign passwords which cannot be changed by the user
  3. Forum spam-bots may have generated the accounts (as suggested by Philipp)
  4. Many websites will create a default password for you, which is reset when you activate your account.

At the moment #4 is my favorite explanation, just because I personally have registered on dozens or hundreds of sites which then e-mailed me and required me to activate my account by clicking on a link and/or logging in with a default password that was sent in the e-mail. It's highly likely that many accounts with these default passwords were either created by people who didn't activate their accounts, or they were created by 'bots which could not activate the accounts because they did not have access to the e-mail accounts they used for registration.

Random-looking usernames

If we look again at the usernames in the username-password combinations, those also look generated:

[username] => BKujXjbL
[password] => 2454HIYQYH

[username] => Antiretewssar
[password] => 4xi82JfkbS

[username] => a
[password] => CKNSC58E3U

Again, there are many possible explanations for this, but here are a few:

  1. Some companies assign usernames
  2. The usernames were harvested along with the associated passwords (possibly from a 'bot-infested forum database, as suggested by Philipp)
  3. The usernames were harvested, but all the usernames are being tested with all the harvested passwords and perhaps with some other dictionary-based or brute-force generated passwords (though you mentioned that you haven't seen very many dictionary-based passwords)
1

I do not think it is as simple as bots attempting to log in, but bots attempting to exploit web forms in general for SEO purposes which will also catch signup/login forms.

The strings can serve as a unique identifier generated to identify the site/page the bot is attempting to exploit.

The reason for the bots using these nonsensical strings may be to query for the same values in search engines later to target which sites are going to work for SEO exploits later on without revealing their "client's website". By querying google, bing, yahoo, etc for 'BKujXjbL' would turn up if that specific target was successful or not rather than having say 'viagraiscoolyadda.com' in the logs of non-working targets.

Some may use more intelligent methods of filling out forms it encounters, matching data types such as valid emails in email fields, etc, to mask its true nature, such as real looking names, usernames, emails, etc - which could very well come from harvested or hacked databases.

I think this bot's owner will have some false positives thanks to this thread :)

https://www.google.com/search?q=BKujXjbL

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .