{"id":93316,"date":"2020-09-05T19:42:19","date_gmt":"2020-09-05T17:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/analiz-aktivnosti-atakuyushhih-svyazannoj-s-podborom-parolej-po-ssh"},"modified":"2020-09-05T19:42:19","modified_gmt":"2020-09-05T17:42:19","slug":"analiz-aktivnosti-atakuyushhih-svyazannoj-s-podborom-parolej-po-ssh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/analiz-aktivnosti-atakuyushhih-svyazannoj-s-podborom-parolej-po-ssh","title":{"rendered":"Analyse de l'activit\u00e9 des attaquants concernant le bruteforce des mots de passe via SSH","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Publi\u00e9<\/a><\/noindex> r\u00e9sultats de l'analyse des attaques li\u00e9es \u00e0 la tentative de piratage de mots de passe sur les serveurs via SSH. Au cours de l'exp\u00e9rience, plusieurs leurres (honeypots) ont \u00e9t\u00e9 lanc\u00e9s, se faisant passer pour un serveur OpenSSH accessible et plac\u00e9s dans divers r\u00e9seaux de fournisseurs de cloud tels que
\nGoogle Cloud, DigitalOcean et NameCheap. Au cours de trois mois, 929554 tentatives de connexion au serveur ont \u00e9t\u00e9 enregistr\u00e9es.<\/p>\n

Dans 78 % des cas, la tentative visait \u00e0 d\u00e9terminer le mot de passe de l'utilisateur root. Les mots de passe les plus fr\u00e9quemment v\u00e9rifi\u00e9s \u00e9taient \u00ab 123456 \u00bb et \u00ab password \u00bb, mais dans le top dix figurait \u00e9galement le mot de passe \u00ab J5cmmu=Kyf0-br8CsW \u00bb, probablement utilis\u00e9 par d\u00e9faut par un certain fabricant.<\/p>\n

Les identifiants et mots de passe les plus populaires :<\/p>\n

<\/p>\n

Identifiant
\n Nombre de tentatives
\n Mot de passe
\n Nombre de tentatives<\/p>\n

root
\n 729108<\/p>\n

40556<\/p>\n

admin
\n 23302
\n 123456
\n 14542<\/p>\n

user
\n 8420
\n admin
\n 7757<\/p>\n

test
\n 7547
\n 123
\n 7355<\/p>\n

oracle
\n 6211
\n 1234
\n 7099<\/p>\n

ftpuser
\n 4012
\n root
\n 6999<\/p>\n

ubuntu
\n 3657
\n password
\n 6118<\/p>\n

guest
\n 3606
\n test
\n 5671<\/p>\n

postgres
\n 3455
\n 12345
\n 5223<\/p>\n

usuario
\n 2876
\n guest
\n 4423<\/p>\n

<\/center><\/p>\n

Parmi les tentatives analys\u00e9es, 128588 paires de login-mot de passe uniques ont \u00e9t\u00e9 identifi\u00e9es, dont 38112 ont \u00e9t\u00e9 v\u00e9rifi\u00e9es 5 fois ou plus. Voici les 25 paires les plus souvent test\u00e9es :<\/p>\n

<\/p>\n

Identifiant
\n Mot de passe
\n Nombre de tentatives<\/p>\n

root
\n \u00a0
\n 37580<\/p>\n

root
\n root
\n 4213<\/p>\n

user
\n user
\n 2794<\/p>\n

root
\n 123456
\n 2569<\/p>\n

test
\n test
\n 2532<\/p>\n

admin
\n admin
\n 2531<\/p>\n

root
\n admin
\n 2185<\/p>\n

guest
\n guest
\n 2143<\/p>\n

root
\n password
\n 2128<\/p>\n

oracle
\n oracle
\n 1869<\/p>\n

ubuntu
\n ubuntu
\n 1811<\/p>\n

root
\n 1234
\n 1681<\/p>\n

root
\n 123
\n 1658<\/p>\n

postgres
\n postgres
\n 1594<\/p>\n

support
\n support
\n 1535<\/p>\n

jenkins
\n jenkins
\n 1360<\/p>\n

admin
\n password
\n 1241<\/p>\n

root
\n 12345
\n 1177<\/p>\n

, et le mot de passe est
\n ou celui que vous avez modifi\u00e9) et de continuer la configuration.
\n 1160<\/p>\n

root
\n 12345678
\n 1126<\/p>\n

root
\n 123456789
\n 1069<\/p>\n

ubnt
\n ubnt
\n 1069<\/p>\n

admin
\n 1234
\n 1012<\/p>\n

root
\n 1234567890
\n 967<\/p>\n

ec2-user
\n ec2-user
\n 963<\/p>\n

<\/center><\/p>\n

R\u00e9partition des tentatives de scan par jour de la semaine et par heure :
\n

\"Analyse<\/a><\/noindex><\/center><\/p>\n

\"Analyse<\/a><\/noindex><\/center><\/p>\n

Un total de 27448 adresses uniques ont \u00e9t\u00e9 signal\u00e9es. adresses IP<\/a>.
\nLe nombre maximum de v\u00e9rifications effectu\u00e9es \u00e0 partir d'une seule adresse IP \u00e9tait de 64969. La part des v\u00e9rifications via Tor n'\u00e9tait que de 0,8 %. 62,2 % des adresses IP impliqu\u00e9es dans la tentative \u00e9taient associ\u00e9es \u00e0 des sous-r\u00e9seaux chinois :<\/p>\n

\"Analyse<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0430\u0442\u0430\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043f\u043e\u0434\u0431\u043e\u0440\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u043f\u043e SSH. \u0412 \u0445\u043e\u0434\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430 \u0431\u044b\u043b\u043e \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u043e\u0432\u0443\u0448\u0435\u043a (honeypot), \u043f\u0440\u0438\u0442\u0432\u043e\u0440\u044f\u044e\u0449\u0438\u0445\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c OpenSSH \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0441\u0435\u0442\u044f\u0445 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a Google Cloud, DigitalOcean \u0438 NameCheap. \u0417\u0430 \u0442\u0440\u0438 \u043c\u0435\u0441\u044f\u0446\u0430 \u0431\u044b\u043b\u043e \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e 929554 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443. \u0412 78% \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u043f\u043e\u0434\u0431\u043e\u0440 \u0431\u044b\u043b \u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":93317,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-93316","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Analyse de l'activit\u00e9 des attaquants li\u00e9e \u00e0 la tentative de piratage de mots de passe via SSH | ProHoster","description":"Les r\u00e9sultats de l'analyse des attaques li\u00e9es \u00e0 la tentative de piratage de mots de passe sur les serveurs ont \u00e9t\u00e9 publi\u00e9s.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/analiz-aktivnosti-atakuyushhih-svyazannoj-s-podborom-parolej-po-ssh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043f\u043e\u0434\u0431\u043e\u0440\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u043f\u043e SSH | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0430\u0442\u0430\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043f\u043e\u0434\u0431\u043e\u0440\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/analiz-aktivnosti-atakuyushhih-svyazannoj-s-podborom-parolej-po-ssh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-05T17:42:19+00:00","article:modified_time":"2020-09-05T17:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93316","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:50:29","updated":"2026-02-08 20:40:13","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/93316","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=93316"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/93316\/revisions"}],"predecessor-version":[{"id":158013,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/93316\/revisions\/158013"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/93317"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=93316"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=93316"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=93316"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}