Website

“Our data provide quantifiable evidence that attacks are happening all the time to computers with Internet connections,” study author Michel Cukier of the University of Maryland said. “The computers in our study were attacked, on average, 2,244 times a day.”

Hackers briefly overwhelmed at least three computers that help manage global computer traffic on Tuesday.

To test how hackers break into computers, Cukier’s team set up weak security on four Linux computers connected to the Internet and monitored hacker attacks.

Unlike the sophisticated hackers portrayed on TV and in films, these hackers weren’t targeting specific computers.

“Most of these attacks employ automated scripts that indiscriminately seek out thousands of computers at a time, looking for vulnerabilities,” Cukier said.

The hackers used a type of software called a “dictionary script” that runs through lists of common usernames and passwords to break into the computer.

Some of the most commonly guessed usernames in the study were “root,” “admin,” “test,” “guest,” and “user." Cukier advises against using any of these as passwords.

When guessing passwords, the software tried to reenter or guess variations of the username. Following the password with the numbers “123,” guessing “password” or “123456” were also common guesses.

The study’s findings, presented at the 37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, support the continual warnings of security experts to never use identical or related usernames and passwords.

After gaining access to the computers, hackers usually quickly changed passwords, checked hardware and software configurations, and downloaded, installed and ran a program.

These programs established the computer as part of a botnet, a collection of hacked computers that can be run by the hacker remotely to perpetrate fraud or identity theft, disrupt other computer networks, or damage computer files.

“The scripts return a list of ‘most likely prospect’ computers to the hacker, who then attempts to access and compromise as many as possible,” Cukier said. “Often they set up ‘back doors’ — undetected entrances into the computer that they control — so they can create ‘botnets,’ for profit or disreputable purposes.”

To protect against hackers, security experts advise choosing longer, more difficult passwords with combinations of upper and lowercase letters.

LiveScience.com