Default Credentials / Brute Force

CWE-200 Case Study

What happens when you leave default SSH passwords

Vector: Default Credentials Impact: SYSTEM Takeover Time to Compromise: <10 minutes
// What is this?
How a default-credential management interface exposed internal data before anyone knew it was public-facing.

CWE-200 is information exposure — services that reveal more data than intended. This case study documents a default-credentials scenario where a management interface was accidentally internet-accessible with unchanged vendor credentials. The timeline covers discovery, what was accessible during the exposure window, and remediation. A common external pentest finding — organisations underestimate how much tooling ships with default auth.

PowerShell — Credential Exposure Detection
→ Blue Team 
# Stored Windows credentials
cmdkey /list

# Cached credentials setting
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" |
  Select-Object CachedLogonsCount

# Recent LSASS access
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4663} -MaxEvents 100 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match "lsass" }

# Browser password databases
Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data\*\Login Data" -Force -ErrorAction SilentlyContinue
If this flags: cmdkey shows saved credentials. CachedLogonsCount > 0 means hashes are stored. LSASS access events indicate credential dumping attempt.
← Back to Portfolio
Credential Exposure via Screenshare
Click to start
🖥️ Remote Desktop Connection
Computer: 192.168.1.50
User: CORP\\admin
Password: Summer2024!
▶
Watch the attack unfold

The Reality of Internet Exposure

The moment you expose an SSH port to the internet, you are under attack. This isn't hypothetical — this is what our scanners see every single day. Automated botnets from every corner of the globe constantly probe for default credentials.

If you leave the default password, or use a weak one, or share the same password across machines — you will be compromised within minutes.

This Is Happening Right Now

The alerts below are real. This is what SSH brute force looks like. Every server on the internet faces this 24/7.

Live Scanner Feed

22nd Survey Division • SSH Alert • Live Feed

Attack Statistics (24 Hours)

2,847
Total Attempts
412
Unique IPs
38
Countries
94%
Target: root

Where Attacks Come From

Automated botnets operate globally. These are the top sources hitting our honeypots:

🇻🇳
Vietnam
HD Technical Infrastructure
847
🇷🇺
Russia
JSC TIMEWEB
623
🇺🇸
United States
DigitalOcean, LLC
412
🇨🇳
China
Alibaba Cloud
389
🇨🇦
Canada
DigitalOcean, LLC
156
🇦🇺
Australia
DigitalOcean, LLC
98

The Kill Chain

Here's what happens when someone leaves default credentials on an exposed SSH server:

00:00:00
Server Goes Online
New VPS deployed with SSH on port 22, default password "admin123" or left unchanged.
00:00:47
First Scan
Shodan, Censys, and dozens of botnets detect the new host within a minute.
00:01:23
Brute Force Begins
Automated scripts start cycling through common username/password combinations.
00:03:41
Credentials Found
root:admin123 works. Attacker has shell access.
00:04:12
Persistence Installed
SSH key added to authorized_keys. Cron job installed. Password changed.
00:05:38
Cryptominer Deployed
XMRig installed, all CPU cores now mining Monero for the attacker.
00:08:14
Lateral Movement
Attacker scans internal network. Same password works on 3 other servers.
00:09:47
Game Over
Four servers compromised. Total time: under 10 minutes.

Why "Everyone Uses the Same Password" Kills You

One weak link compromises everything. Attackers don't stop at one server — they immediately check if the same credentials work elsewhere. Shared passwords turn one breach into total network compromise.

What Gets Stolen

Protect Yourself

  1. Disable password auth — Use SSH keys only: PasswordAuthentication no
  2. Change the port — Move SSH off 22 to reduce noise (not security, just noise)
  3. Use fail2ban — Auto-ban IPs after failed attempts
  4. Unique passwords everywhere — Never share credentials across systems
  5. Monitor your logs — Know when you're being probed

The Lesson

Default passwords are not passwords. They are open doors. The bots are scanning right now. If you're reading this and you have default credentials anywhere — go change them. Now.