TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

Spaceballs Security: The Top Attacked Usernames and Passwords

2018-12-20 · Read original ↗

ATT&CK techniques detected

6 predictions
T1078.001Default Accounts
88%
“service of choice, but due to the lack of protocol security, applications worth securing have migrated to ssh. note the iot world is still struggling to keep up with this evolution. vendor default credentials are commonly left active because it ’ s easier for the organizations wh…”
T1133External Remote Services
70%
“published cve, their thursday night launching a phishing campaign, and their friday night taking the easy route by scanning for ssh and brute - forcing logins. if you measure success by the volume of attacks they launch, the ssh service is the biggest loser. figure 1 : top 3 atta…”
T1110Brute Force
39%
“##ity of the system. targeting ssh can provide attackers with access to commonly deployed enterprise applications, but also to seemingly innocuous iot devices like a fish tank thermometer and hvac system. as a result, every business connected to the internet needs to prioritize a…”
T1110Brute Force
34%
“inspections inside their offices to ensure employees haven ’ t connected one of these devices to the wireless network that could be acting as a network backdoor. top 20 attacked ssh passwords the top 20 attacked ssh admin passwords are a literal embarrassment to the security indu…”
T1190Exploit Public-Facing Application
33%
“published cve, their thursday night launching a phishing campaign, and their friday night taking the easy route by scanning for ssh and brute - forcing logins. if you measure success by the volume of attacks they launch, the ssh service is the biggest loser. figure 1 : top 3 atta…”
T1110Brute Force
32%
“published cve, their thursday night launching a phishing campaign, and their friday night taking the easy route by scanning for ssh and brute - forcing logins. if you measure success by the volume of attacks they launch, the ssh service is the biggest loser. figure 1 : top 3 atta…”

Summary

Expect a breach If you have basic, vendor default SSH credentials active on any system.