> <jfmezei.spam...@vaxination.ca> wrote:

>> Michael Moroney wrote:
>>> That is a nasty one, since much of what makes VMS resistant to such  =

>>> attacks is the ability to sense a breakin attempt and deny access fro=
> m
>>> the breakin source even when it gets the password correct.
>>>  Did the attempt seem to target VMS or was it a script kiddie hacking=
>  at
>>> a Windoze box or Unix box (accounts like administrator or root being =
>  =

>>> tried)

>> Brute force. And VMS is even worse:

>> $ telnet/port=3D110 chain
>> %TELNET-I-TRYING, Trying ... 10.0.0.11
>> %TELNET-I-SESSION, Session 01, host chain, port 110
>> +OK TCPIP POP server V5.6-9, OpenVMS V8.3 Alpha at chain.vaxination.ca=
> ,  =

>> up sinc>
>> USER canada
>> -ERR No such user "canada"
>> USER system
>> +OK Password required for "system"
>> PASS chocolate
>> -ERR password supplied for "system" is incorrect.
>> %TELNET-S-REMCLOSED, Remote connection closed
>> -TELNET-I-SESSION, Session 01, host chain, port 110

>> So by checking whether the USER command returns an -ERR or +OK, you ca=
> n  =

>> narrow down which usernames are valid, and then proceed to guess their=
>   =

>> passwords by brute force.

> What happens if you disable telnet and only allow ssh?