Brute-Forcing the World

by ChezeHead

One university I know of uses an old Burroughs mainframe for their registration computer and allows, with a username and a 4-digit PIN code, access to a person's grades, the ability to add and drop classes, financial aid information, and a student directory.

They also implemented a campus-wide POP mail server with the default passwords, changeable only through a program like Eudora, of a static four-letter combination and the PIN code, allowing a brute-force attack that takes ten minutes maximum against the majority of accounts, and then complete access to the student directory to find more usernames!

Welcome to the ancient art of brute-force hacking, the way into systems with no gaping wide backdoors such as PHF or Sendmail's finer remote hacks.  A world in which infamous Internet attacks such as the Great Worm were able to enter thousands of systems.

The concept of brute-force hacking hasn't changed much although in recent years different forms of attack have sprung up; at one time Telnet and FTP attacks were common and they are still around, but it gets really annoying when after three tries you are disconnected, and system logs can show huge attacks against usernames.

Enter the latest greatest system for delivering email, the Post Office Protocol a.k.a. popmail.  There are many systems out there yet that don't log POP attempts, and many Popmail servers don't kick you off, so you can start a script and let it go, being almost assured of eventually gaining entrance to a system.  ISP systems, as they are usually extremely lax in required passwords in an attempt to keep their customers happy, can be very easy marks.

Popmail is a very simple protocol to play with.  Just like FTP, you login with user [username] and pass [password] and, unless an encryption scheme such as APOP is used, the passwords are just sent in the clear.  Popmail servers reside normally on port 110 for the POP3 protocol, the current standard.

I won't include a script for this as that would be too easy, but it shouldn't take more than 15 minutes to write and debug a working brute-force script for Popmail, and the results can be incredible.