Subj : Synology Docker Mystic Test
To   : fusion
From : Accession
Date : Sat Feb 15 2025 09:31 am

Hey fusion!

On Sat, Feb 15 2025 05:52:12 -0600, you wrote:

 > they have an incentive not to be a denial of service because they're
 > trying to find poorly configured *nix machines with weak
 > username/password combos. also why most of them will only make one
 > connection at a time. if they manage to log in with a weak password
 > from the list they come back to use the machine they've gained access
 > to. they really don't want to be banned nor put the target machine
 > offline.

Maybe we're not referring to the same thing here..

By one connection at a time, do you mean in succession, very rapidly? As in 20+ attempts in a minute, but one connection at a time which might seem like they're all coming in at once?

I see different types of bots, I guess, and most of them don't try username/password combinations whatsoever. They basically hit as many times as they can until Synchronet temporarily bans them. Most telnet connections just sit there and don't hit a key for 20-30 seconds, but while they're sitting there another from the same IP is usually connecting again, etc..

 > but, just as an example, normally that wouldn't be a problem with
 > mystic but any unknown username and a password they attempt that
 > happens to contain a 'y' will allow them a LOT of time to run through
 > a few hundred username/password combos in the new user "full name"
 > field (which won't hangup on you no matter how many times you don't
 > include a last name. including just holding enter forever)

Wait, in the new user application it doesn't send you back to the matrix if you type in an incorrect full name? I thought it did.

 > anyways sorry for the overreaction :/

No worries, and same. I think plenty of people jump on the "it's a bug" train before actually doing any testing, so I questioned it right away. Clearly, that wasn't the case here. I sometimes get a bit defensive when people aren't around to defend themselves or their software at the moment.

Who knows, maybe he did read it. ;P

Regards,
Nick

.... He who laughs last, thinks slowest.
--- slrn/pre1.0.4-9 (Linux)
 * Origin: The Pharcyde ~ telnet://bbs.pharcyde.org (Wisconsin) (21:1/200)

.