Security hosting report for 2013-02-28

conclusion and advice

• Dovecot Invalid User Login Attempt is mostly brute force attack. But many time users have wrong email setting in mobile phone or computer. I used to block after 10 invalid login (still have on some servers with old users),  but the job to explain is taking time and user is frustrated and nobody like to pay for my extra job.
• Dovecot Authentication Success that is ok login.
• Dovecot Aborted Login may bee attempt to compromise but afraid of firewall.
• Dovecot Authentication Failed is brute force attack when email is known, but many time user with wrong password. Sometime user have two email account one is working the other one is with wrong login setting, then the connection and getting email is slow and the user may be temporary block by active response from server.

 Security conclusion and advice

 The crime on Internet is raising in hyperbolic scale. When doing attack on other sites and email account real IP are NEVER used! Now-days bad patched WordPress,  Joomla or other widely used scripts are used as proxy for attack. There are 100 000 and more old installation that can be used for massive attack initiated from very good hidden place (IP) – many time hijacked WiFi  wireless connection.

 What is brute force attack?

I take example for email but that can bee used on other thing to. If someone know you email address it is no problem to find your mail server! Just ask Google or put your email here http://mxtoolbox.com/blacklists.aspx the site is deserving credit because they are giving many good tools for free.

The bad patched widely used CMS scripts are used as bridge for automatic brute  force scripts.  The access to old CMS installation, compromised plugin or extension is easy to get “just search Google with that version”.  So called nulled scripts and free template and themes do often have hi-tech crime control panels included and users are uploading them to their server and giving full access whiteout knowing! the script is then sending email or whatever about its url location!

Ok then from this places scripts are working day and night with trying to login to your email account!  Your user name is “name” or “name@yourdomain” and most email server response with “user unknown” . There most used password is very known I think “password” is the most used password . You know how to find Just ask big brother how know everyting . 

So scripts are trying with common used password and some sensitiv script can even know when they are partial right. I think it take about 1000 try to get in to email with ordinary password and ordinary web hosting server protection, and that is usually done in less then 24 hour! 

This kind off attack when massive password tryout is used is called brute force attack

So what can person do with your email account?

Well person are not doing still automatic scripts are doing. Your email are scanned for bank account letters. Usually banks do not send password by mail (guess why . Most user do have all email online with imap so the can access from all devices and webmail (and that is not wrong to do). By knowing your domain or visiting your site your time zone is known! About 3 to 5 in the morning procedure for creating new  password is activated on your bank site. By the morning you have no money or even worse your in maximum dept on all your credits, and have new credits, it is so easy to get now days

How to protect your mail account and some website advice in importance order!

• Use strong password with at least 9 characters and strange characters like  75%U8#6fn.
• Update your operating system and email client (always up to date).
• Use good updated antivirus. Even if you are using Mac computer! Because treats are coming but like the diagram up there. 
• Ask your hosting company if they have some protection against brute force attack! It can be temporary blocking for 3 min that is enough (but that will impact on user friendliness and support request to hosting company).
• Use secure connection when ever you can (there are not many attack today, but ones they find easy way).
• Do not save password for email or ftp account in simple text file, use some program for that.
• Do not save username with password.
• Do not use illegal software or template, do not use “free” template, themes for your site. Even if you do not have business site it can be used as bridge to brute force bank accounts!
• Update your WordPress or other CMS, and plugin, etc. Most updates are security patches!

 There is lot more to add and I can for shore write better, but I am limited by my free time… hope this will help someone.