Hello and welcome to the Wednesday, June 25th, 2025 edition of the Sandinand at Storm Center's Stormcast.

My name is Johannes Ulrich, and this episode brought you by the Sans.edu credit certificate program in cyber defense operations is recorded in Stockholm, Germany.

In diaries today, I took a quick look at the history of the password brute forcing that we have

seen in our honeypots.

We collected the data starting in about 2015.

Now, my analysis, I start with 2018 data because that's where things became a bit more stable and we sort of have a consistent volume of data to look at.

And what I looked at is, first of all, do we have modern bots that are using more username password combinations to attack particular target than the older bots.

And that appears to be somewhat true.

In the beginning, meaning 2018, we had about 10 different username and password combinations

attempted by each individual source IP address.

That is now up to about 70 or so different username and passwords.

I also took a quick look at the complexity of the passwords,

and that has been relatively steady around eight characters on average.

But remember, these are default passwords that these bots usually attempt. Now, there are a couple of

default passwords that are a bit larger and more complex, but most of them are simple stuff like,

you know, admin, password and the like. So relatively short passwords, and the length does necessarily

mean that it's more difficult to guess

password if it is actually just a simple default password.

And the blog post on mobilehacker.com does describe an interesting, well, I would say, further

development of the Click Fix matter. ClickFix refers to attackers that present

users with fake CAPTCHAs and then trick them into copy pasting code into their system.

Now that usually requires opening some kind of command prompt prompt. What mobile hacker proposes here,

...