原始出处：
http://www.livescience.com/technology/070207_hacker_attack.html
Hackers attack
computers every 39 seconds, according to new research.
The study, which investigated how exactly hackers crack
computers, confirms those regularly issued warnings about password vulnerability. Experts advise longer passwords, regularly changed and not based on users' biographies, that mix letters and numerals and are hard to guess.
“Our data provide quantifiable evidence that attacks are happening all the time to computers with
Internet connections,” study author Michel Cukier of the University of Maryland said. “The computers in our study were attacked, on average, 2,244 times a day.”
Today, hackers
briefly overwhelmed at least three computers that help manage global computer traffic.
To test how hackers break into computers, Cukier’s team set up weak security on four Linux computers connected to the
Internet and monitored hacker attacks.
Unlike the sophisticated hackers portrayed on
TV and in films, these hackers weren’t targeting specific computers.
“Most of these attacks employ automated scripts that indiscriminately seek out thousands of computers at a time, looking for vulnerabilities,” Cukier said.
The hackers used a type of software called a “dictionary script” that runs through lists of common usernames and
passwords to break into the computer.
Some of the most commonly guessed usernames in the study were “root,” “admin,” “test,” “guest,” and “user." Cukier advises against using any of these as passwords.
When guessing passwords, the software tried to reenter or guess variations of the username. Following the password with the numbers “123,” guessing “password” or “123456” were also common guesses.
The study’s findings, presented at the 37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, support the continual warnings of security experts to never use identical or related usernames and passwords.
After gaining access to the computers, hackers usually quickly changed
passwords, checked hardware and
software configurations, and downloaded, installed and ran a program.
These programs established the computer as part of a botnet, a collection of hacked computers that can be run by the hacker remotely to perpetrate fraud or
identity theft, disrupt other computer
networks, or damage computer files.
“The scripts return a list of ‘most likely prospect’ computers to the hacker, who then attempts to access and compromise as many as possible,” Cukier said. “Often they set up ‘back doors’—undetected entrances into the computer that they control—so they can create ‘botnets,’ for profit or disreputable purposes.”
To protect against hackers, security experts advise choosing longer, more difficult passwords with combinations of upper and lowercase letters.
