Hack the Hackers – December 20, 2013 (read more)

I have a customer who installed a machine with the administrator/root password very weak, and left it open to the internet.  Someone guessed the password, logged in, and then helpfully ran 'screen', so I could watch what he did (presumably - he might have been smart enough to do other things, and we will format the drive, but it was neat to see all of his commands, including typos, and guessing at some commands, because he must not have been familiar with CentOS).

He had a script that he ran to check out other machines around the world, simply doing a port scan, and then using ssh to try out accounts and passwords off of a statically generated list, so if you were bad enough to have the password "root" or "toor", etc. on your root account, then you get recorded.

His script generates a text file of hacked machines, so I emailed the administrators of those machines (living in Hungary, United Arab Emirates and Germany), and let them know that they have insecured machines on their network.  But, the cool part is still to come...