>> <jfmezei.spam...@vaxination.ca> wrote:

>>> Michael Moroney wrote:
>>>> That is a nasty one, since much of what makes VMS resistant to such  =

>>>> attacks is the ability to sense a breakin attempt and deny access fro=
>> m
>>>> the breakin source even when it gets the password correct.
>>>>  Did the attempt seem to target VMS or was it a script kiddie hacking=
>>  at
>>>> a Windoze box or Unix box (accounts like administrator or root being =
>>  =

>>>> tried)

>>> Brute force. And VMS is even worse:

>>> $ telnet/port=3D110 chain
>>> %TELNET-I-TRYING, Trying ... 10.0.0.11
>>> %TELNET-I-SESSION, Session 01, host chain, port 110
>>> +OK TCPIP POP server V5.6-9, OpenVMS V8.3 Alpha at chain.vaxination.ca=
>> ,  =

>>> up sinc>
>>> USER canada
>>> -ERR No such user "canada"
>>> USER system
>>> +OK Password required for "system"
>>> PASS chocolate
>>> -ERR password supplied for "system" is incorrect.
>>> %TELNET-S-REMCLOSED, Remote connection closed
>>> -TELNET-I-SESSION, Session 01, host chain, port 110

>>> So by checking whether the USER command returns an -ERR or +OK, you ca=
>> n  =

>>> narrow down which usernames are valid, and then proceed to guess their=
>>   =

>>> passwords by brute force.

>> What happens if you disable telnet and only allow ssh?

> He is using TELNET from the source end.  The destination is POP.
> If he disables TELNET he can't get out of his box.  :-) Somehow, I
> don't think that will solve a problem with incoming POP connections.

> bill