But what if an attacker doesn't care about getting access to a
specific system? After all, trying 10,000 passwords against a
server would most likely cause a target account to be locked
out. Instead, a malicious hacker could attempt password attacks
on a large scale, using the same username and password
combination on 10,000 systems. That would result in only one
failed log-in attempt per server, but a much better chance of
successfully compromising at least one. Lately, attackers have
been using the "low and slow" tactic, employing botnets against
large numbers of servers. The technique gives them the ability
to launch large-scale attacks from multiple sources. Defending
against these SSH brute-force attacks means going back to the
basics of solid security practices. To start, utilize passwords
and passphrases that will not be easily guessed. Doing standard
"Leetspeak" -- an Internet language that substitutes letters
with ASCII characters -- will not work. Attackers now use custom
dictionaries that incorpora