Follow the Access · 02 — The Brute Force: Guessing at the Speed of Machines

Follow the Access — Case 02. This register follows the intruder from the login prompt to the foothold's fate, and closes each case on what the access becomes: RANSOMED · MINED · PROXIED · HARVESTED · WIPED · RESOLD.

Case 01 tried the key the factory left in the lock. This case is about the attacker who has no key at all, and guesses. When the default password has been changed — when the owner did the one thing they were asked to do — the door is not open, but it is not necessarily strong. If the new password is weak, short, common, or reused, then a program that can try passwords fast enough will eventually find it. Brute force is the oldest attack in computing, and it is still, after fifty years, one of the most common, because it does not require intelligence, or a vulnerability, or a stolen secret. It requires only speed, and machines have speed to spare.

This is the case about guessing at the speed of machines, and again the honeypot beneath these words does not have to imagine it — it can name the tools. Its fingerprinting of the software on the far end of each connection isolates a specific cluster: Ncrack across 96 source addresses, Paramiko across 114, Hydra across 86, Medusa across 58. These are not SSH clients that a person uses to log in. They are the standard network login-cracking frameworks, built for one purpose — to throw passwords at a login prompt as fast as the network allows — and their signatures on the wire are proof that a large share of what looks like login traffic is not people logging in but programs guessing.

And the foothold that guessing produces has a distinctive fate, one that separates this case sharply from the last. The default-password box was MINED — kept and used by whoever found it. The brute-forced login is more often RESOLD. The operator running Hydra across the internet is not in the business of using the accounts he cracks; he is in the business of manufacturing them. Each working login is an item of inventory, validated and packaged and sold to someone else who will decide what it is for. This is the case where access first becomes a commodity — produced by one specialist, sold to another — and where the underground reveals itself as not a mob but a supply chain.

1. The Difference Between a Default and a Guess

Draw the line from Case 01 clearly, because the two vectors look similar at the login prompt and are different underneath. The default password is a known value: the attacker knows in advance that this model of camera ships with admin/admin, so trying it is not really guessing — it is using a key that was published. Brute force is different. Here the attacker does not know the password; he tries many, betting that one of a list of likely candidates will match. The default is a lookup. The guess is a search.

The search takes two shapes, and the distinction matters for how it evades defenses. The first is classic brute force: pick one account and try password after password against it until something works or the account locks. This is loud and easily stopped — a lockout after a few failures ends it. The second, and far more common at scale, is password spraying: pick one likely password and try it against many accounts, then move to the next password, so that no single account sees more than a handful of attempts. Spraying inverts the problem to slip under the defense. Lockout policies count failures per account; spraying keeps each account's failure count low while still testing enormous numbers of accounts. The honeypot's data shows exactly this shape — a small dictionary of passwords (root, 123456, admin, password) tried against the administrator accounts of host after host, each host seeing only a few attempts, the swarm as a whole covering vast ground.

So the mental model has to shift from a burglar working one lock to a machine testing a master set of common keys against every door on a street, then the next street, then the next city, never lingering long enough at any one door to trip an alarm. The individual account is safe if its password is not on the list. The population is not, because some passwords on the list are always in use somewhere. Brute force at scale is not an attack on a password; it is an attack on the statistics of how humans choose passwords, and those statistics have not improved in decades.

2. The Tools on the Wire

Now the evidence, because the claim that this is automated and industrial is not an inference here — it is a reading off the sensor. When a client connects over SSH, the precise way it negotiates the encrypted session leaves a fingerprint, a hash of its supported algorithms and ordering, called HASSH. Different software produces different fingerprints, and the honeypot records them for every connection. The fingerprints do not lie about what is on the other end.

What they show is tooling. A large, distinct cluster of the honeypot's attackers fingerprint as the named credential-attack frameworks: Ncrack, the login cracker from the Nmap project, on 96 addresses; Paramiko, the Python SSH library that underlies countless custom brute-force scripts, on 114; Hydra, the classic parallelized login cracker, on 86; Medusa, another, on 58. Set beside these are the general scanner libraries — libssh in several versions, Go_SSH, AsyncSSH, libssh2 — that make the bare connections and enumerate what is listening. None of these fingerprints belongs to a human sitting at a terminal. Every one of them is a program built to connect, guess, and record, at a rate no person could match.

The scale that this tooling operates at is the whole point. The honeypot classifies 3,477 of its source addresses as scanners and 1,343 as botnet nodes. These thousands of machines are not coordinating in any sophisticated way; they are each running the same simple loop — connect, try the dictionary, log the successes, move on — against every address they can reach. A single machine running Hydra can attempt thousands of logins a minute; thousands of machines running it in parallel sweep the entire exposed surface of the internet continuously. The guessing never pauses, never tires, and never gives up, because for the swarm as a whole there is always another host to try and always, somewhere, another weak password waiting to fall.

3. The Guessers Are Guessed-At Machines

There is a detail in the honeypot data that turns this case into a loop with the last one, and it is worth pausing on, because it explains why the brute-force vector costs its operators almost nothing. Look at where the brute-force attempts come from: overwhelmingly, from the same population of scanner and botnet IPs that Case 01 described — compromised routers, cameras, cheap servers, boxes taken by default passwords or previous guesses. The machines doing the guessing are, in large part, machines that were themselves guessed into.

This is the engine that makes the whole thing self-sustaining. An attacker who wants to brute-force the internet does not need to buy servers, because he already controls a swarm of hijacked ones — and the same access that let him install a miner (Case 01) lets him install a brute-force worker. So each compromised box does double duty: it mines cryptocurrency for its captor and, in its spare cycles, guesses passwords against the next range of targets, cracking new boxes that will in turn be set to guessing. The vector funds itself, propagates itself, and grows itself, with no dedicated infrastructure and no cost to the operator beyond the electricity someone else pays for.

That recycling is why the honeypot logs the same tools, from ever-changing addresses, without end. There is no fixed set of attackers to block, because the attacking population is fluid — today's victim is tomorrow's guesser. And there is no rhythm to wait out, either: the honeypot's timeline shows brute-force tooling arriving at every hour of every day, from every populated region of the internet, with no lull the defender could hide in. The attack is not a wave that crests and recedes; it is a constant pressure, a background radiation of guessing that any exposed login absorbs from the moment it appears. Blocking the addresses that attacked yesterday accomplishes little, because they will be replaced by the addresses compromised today. The brute-force swarm is not an army with a base you can bomb; it is a contagion that turns each host it takes into a carrier. And the register's through-line begins to show itself: the disposition of one case becomes the weapon of the next. The box MINED in Case 01 is the box now brute-forcing in Case 02.

4. RESOLD — Access as a Manufactured Good

So the guessing succeeds; somewhere in the sweep, a weak password falls and the operator holds a working login. Now the register writes the disposition, and it is RESOLD — and understanding why requires seeing the underground not as a gang but as an economy with division of labor.

The operator who cracked the login is a specialist. His skill, his tooling, his whole operation is oriented toward one thing: manufacturing access at scale — running the frameworks, managing the swarm, harvesting the validated credentials that fall out. He is very good at producing working logins and not equipped, or inclined, to do anything with them. He does not know how to run a ransomware negotiation, does not want to manage a mining operation, does not care to build a proxy network. What he has is a warehouse full of a single product: verified footholds into machines all over the internet, each tagged with what it is — a corporate server here, a home router there, a cloud instance somewhere else. That inventory is worth money to people who do know what to do with it.

So he sells. This is the initial-access-broker economy, and it is real and well-documented: CrowdStrike's threat reporting describes the sharp growth of access-broker advertising and the centrality of valid-credential abuse to modern intrusions, precisely because a validated login is a liquid, sellable asset. A ransomware affiliate buys corporate footholds and turns them into extortion. A cryptojacker buys anything with a CPU. A proxy operator buys well-connected boxes to turn into exit nodes. The brute-force crew takes cash for each and never has to choose. It is the primary producer at the top of a supply chain, selling raw access to the specialists downstream who refine it into whatever crime pays best.

The sale itself is more orderly than the word underground suggests. Access is advertised on criminal forums and in closed marketplaces, listed with the details a buyer needs to price it: the country and industry of the victim, the level of privilege the login grants, the kind of system, sometimes the revenue of the organization behind it. A brute-forced credential to a random home router lists for a pittance; a validated administrator login into a mid-size company's network can fetch thousands, because the buyer downstream can turn it into a ransom worth far more. Prices are quoted, footholds are auctioned, disputes are arbitrated by forum administrators, and reputations are tracked — the machinery of a functioning market, wrapped around the single product of other people's compromised accounts. The foothold is RESOLD because, in a mature criminal economy, the person who opens the door and the person who walks through it are rarely the same, and the door itself has a listed price. Case 10 of this register will follow the broker who buys; this case follows the supplier who sells, and the sale is the disposition.

5. The Arithmetic That Makes It Work

Center the defender for a moment, because brute force provokes a fair and frustrated question: how does an attack this dumb still succeed, decades after everyone learned to use strong passwords? The answer is arithmetic, and it is worth stating plainly, because it explains both why the vector endures and where it can actually be broken.

The attacker's advantage is asymmetry. To defend against brute force, you must protect every one of your logins — every account, every server, every exposed interface — because a single weak one is a breach. To attack, the operator needs exactly one weak login anywhere in the population he is sweeping. Against a target of millions of exposed SSH, RDP, and web logins, even a very low rate of weak passwords — a fraction of a percent — yields a steady harvest, because a fraction of a percent of millions is still thousands. And the cost side of the arithmetic is nearly zero: each guess is a fraction of a second of a stolen machine's time, so the operator can afford to make billions of them. Cheap guesses times a vast target population times a small but nonzero weak-password rate equals a reliable, continuous yield. The individual with a strong password is safe; the internet as a whole always has weak ones, so the swarm always eats.

But the same arithmetic shows exactly where the vector dies, and this is the honest and useful part of the case. Every countermeasure works by breaking one term of the equation. Key-based SSH authentication with passwords disabled removes the guessable factor entirely — there is nothing to guess, so the swarm's dictionary is useless. Multi-factor authentication makes a guessed password insufficient — cracking it no longer opens the door. Rate-limiting and lockouts raise the cost per guess until sustained guessing is impractical. Strong or randomly-generated passwords drop the target off the dictionary. And restricting management interfaces to known source addresses removes them from the internet-wide sweep altogether, so the swarm never even sees them. None of this is exotic; all of it is standard, and all of it works. Brute force is not an unsolved problem. It is a solved problem that persists because the solutions, though free and effective, are still not applied to the vast installed base of password-only, internet-exposed logins that the honeypot watches fall every day.

6. The counter-narrative, steelmanned

The strongest objection to this case is that brute force is a solved and shrinking problem, and elevating it to a numbered case overstates a threat that modern defaults have already largely closed.

The argument runs like this. Key-based authentication, MFA, and automatic lockouts are now standard; cloud providers disable password SSH by default; managed services rate-limit logins out of the box. The weak-password internet the honeypot sees is a long tail of legacy and negligence, not the mainstream, and it is steadily being cleaned up as old devices die and secure defaults spread. Meanwhile, the objection continues, describing the tools by name — Hydra, Medusa, Ncrack — and laying out spraying tactics teaches the method as much as it warns against it, and the warning it offers ("use strong passwords, enable MFA") is advice so universal that no one who would act on it needs a dossier to hear it. On this view the case documents a dying vector with a stale lesson.

The register concedes the trend and denies the conclusion. Yes, secure defaults are spreading, and yes, the weak-password surface is smaller than it was — that is genuine progress and the case is glad of it. But "smaller than it was" is not "gone," and the sensor is unambiguous: the brute-force frameworks are on the wire right now, across hundreds of addresses, continuously, because the installed base of exposed password logins is still enormous — every unmanaged server, every self-hosted service, every legacy device, every cloud instance whose owner re-enabled password auth for convenience. A vector that is declining in percentage terms while the absolute number of targets grows is not dying; it is simply less visible to the people who already secured themselves, which is not the same as safe. On the teaching objection: the tools are public, decades old, and already in every attacker's kit; naming them educates defenders about what to expect far more than it educates attackers who wrote them. And the lesson is stale only to those who have already applied it — the point of the register is that the honeypot proves, every day, how many have not. Brute force earns its case not because it is clever but because it is relentless, and relentlessness against a vast, imperfect population is its own kind of threat.

7. Disposition — RESOLD

Case 02 followed the attacker who does not have the key and guesses — credential brute force and password spraying, run not by people but by the standard cracking frameworks the honeypot fingerprints on the wire: Ncrack, Paramiko, Hydra, Medusa, across hundreds of addresses, most of them previously-compromised boxes recycled from the mining swarm of Case 01. It works not through cleverness but through arithmetic: cheap guesses, a vast target population, and the statistical certainty that among millions of exposed logins some fraction carry weak passwords. The attacker needs only the weakest one; the defender must protect them all.

The disposition — the foothold's fate — is RESOLD. The brute-force operator is a primary producer, not an end user. He manufactures validated logins at scale and sells them as inventory into the initial-access-broker economy, where a ransomware affiliate, a cryptojacker, or a proxy operator will buy the foothold and decide what it is for. This is the case where access first becomes a commodity, produced by one specialist and refined by another, priced and listed and auctioned like any other good, and where the underground shows itself as a supply chain rather than a gang. The sale is the disposition; the box's ultimate fate is written in a later case, by a later hand.

The fix, as Section 5 showed, is not mysterious — key-based authentication, MFA, rate-limiting, strong passwords, and source-restricted management interfaces each break the arithmetic that makes guessing pay, and each is free and standard. The vector persists because the installed base of password-only, internet-exposed logins remains vast, not because the countermeasures fail. The honeypot beneath these words is being guessed at as you read this, by a tool with a name, from a machine that was itself guessed into last week. The vectors do not lie: the swarm tried the dictionary against a million doors, one opened, and the working key was carried off to be sold — not used, sold — to whoever wants what lies behind it. We do not judge. We record. We let people judge — and then, if they are wise, turn off the password and turn on the key.

Follow the Access continues. Case 02 disposition: RESOLD. Confidence: HIGH — the brute-force toolchain (Ncrack/Paramiko/Hydra/Medusa) and the spraying pattern are direct first-party honeypot fingerprint and credential evidence; the technique is catalogued as MITRE ATT&CK T1110, and the access-broker economy that makes RESOLD the rational disposition is documented by CrowdStrike's Global Threat Report. The self-funding-swarm observation (victims becoming guessers) is drawn from the honeypot's scanner/botnet classification and links directly to Case 01. The countermeasures (M1032 and standard SSH hardening) are established and effective. The access-broker buyer is developed in full in Case 10. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the guess, the guessed-at, and the market that prices the door.