hackers and script kiddies, oh boy ha ha ha

Over the last 30 hours i have been watching 3 hackers/scriptkiddies trying to hack into one of my servers, between them they have made some 132,000 login attempts to the Administrator (system) account on my linux server. why did i watch them for 30 hours and not block them? i'll explain that later, first lets talk about the difference between a hacker and a scriptkiddie.

A scriptkiddie is a snotty nosed 13 year old that download Ytunnel and uses it to kick you off yahoo chat or crash your yahoo messenger. they just use a script, he is a wanna be hacker to look cool for his mates.

There are three types of hacker, the ones you never hear about until they go to jail. (real hackers), security hackers, (hackers turned good guys), and the hacker that tells you he is going to hack your hotmail or website and never does. (because he cant hack his way out of a wet paper bag with an axe)

So why didnt i block 3 scriptkiddies from trying to hack into the Administrator account on my server?

Well i know they are not Hackers because they all made one fundemental mistake, one that tells me they are scriptkiddies that have no idea what they are doing with the script they are using to try and hack the server.

Linux servers do not have a system Administrator account, only Windows machines do. so for 30 hours they tried to get into the system Administrator account that does not even excist.

if they where smart they would have used 30 seconds to do a whois to lookup the server and see what system it is and use the correct system account name to try and hack into an not waste 30 hours.

============= important you read below=============

This got me thinking, 132,000 attempts on one account name, divided by 3 people is 44,000 different passwords they each could have used, thats a lot more than the normal 2000-4000 you would see used.

if your password is easy to remember, its most likely on that list of 44,000

so the whole point of this post is to help you to learn how to make strong passwords that are easy for you to remember as most people don't know how.

you need a formulae thats easy for you to remember and one you can apply to different passwords used for different things. you do not need a mile long password to be strong.

But first a word about online MD5 hash generators and crackers.

Never ever use an online MD5 generator, all you are doing is making your strong password public and giving it to hackers.

how this con works. you think of a strong password, enter it in the online generator, you walk away with your new md5 hash, and the generator owner walks away with your strong password you entered and the hash for it, and puts it on his MD5 hash cracker site list and sells your password for $10 to whoever enters your MD5 hash. you did all the work, he keeps the cash and you get hacked and wonder how when your password was 100% strong. now you know how.

password formulae

a strong password needs to contain symbols there are 26 letters on a keyboard, and 30 symbols, i use 3 different formulae depending on where i am logging in. The 30 symbols will generate 810,000 different formulae, times them by the 44,000 passwords used by the hackers above and it makes 39 billion passwords all 90% strong or higher.

i will teach you how you can join 20,000 different websites with 20,000 different passwords and login to all 20,000 sites without forgetting a single password. How? read on

choose 4 symbols any 4 and remeber them, start your password with 2 of them. like this

$%

choose a name, not your own i'll use my dogs, Max, but wow its only 3 letters long and anyone can guess it? sure they gotta guess one of 810,000 formulae too remember.

this formulae uses 4 symbols $% at the start and #^ at the end

so start with

$%M

then use the standard @ for the a

$%M@

drop the last letter and replace with the 3rd symbol of your formulae

$%M@#

and now add the last symbol of your formulae

$%M@#^  = 95% strong from using my dogs name Max and not a mile long

any generic name used needs to have the  vowles change for symbols like a=@ e=3 i=1 o=0 u=^

so to login into 20,000 sites without having to remember the password use this.

but only the first 6 letters of the domain name. take boonex.com

it would be using this formulae

$%B00n3#^ 100% strong

expertzzz.com would be

$%Exp3r#^  100% strong

! " £ $ % ^ & * ( ) _ + - = < . , : ; @ ' ~ # [ { ] } \ | ` =30 symbols choose any 4 to make 2 pair