One of the problems we see when it comes to people making better choices on web security is that it easy for security companies that don’t have a clue what they are talking about to present themselves as having expertise they don’t have. For example, they can throw around technical terms that they clearly don’t understand, but that the public understandably doesn’t understand either, and it makes them sound like they actually know about security, when they don’t.
One example we keep seeing involves the term brute force attack, which refers to trying all possible password combination in attempt to login in to an account. It isn’t some obscure or exotic term, it has a Wikipedia page, but that doesn’t stop people from using it when actually referring to other types of password attacks.
Often times dictionary attacks, which involve trying to log in with a set of common passwords (things like “password”), are incorrectly identified as having been brute force attacks. The distinction isn’t just semantics, how you protect against those types of attacks is very different, so anybody dealing with web security that involves either of those, absolutely should know the difference. And again the term has a Wikipedia page, so it wouldn’t be hard to know what it is.
That brings us to the security company, Sucuri, which we have seen being quite a bad security company in many ways over the years. That clearly hasn’t changed. In a recent post describe how they did an experiment that was supposed to test how long it would take for successful brute force attacks of SSH logins:
A few weeks ago we ran an experiment to see how long it would take for some IPv4-only and IPv6-only servers to be compromised via SSH brute force attacks.
As they explain in the second paragraph of the post, their experiment involved them setting the password to “password”:
We configured five cloud servers on Linode and Digital Ocean with the root password set to “password.” The idea was to see how long it would take before the servers were hacked.
To anyone who actually know what brute force attacks and dictionary attacks are, its obvious that they don’t actually know what they are talking about since that would be a password to test for dictionary attacks, not brute force attacks, but the public is unlikely to, especially as security companies keep referring to dictionary attacks as having been brute force attacks.
If you are interested in actual security, Sucuri’s lack of basic security knowledge, would be a good reason to look elsewhere.
A Better Alternative to Sucuri
If you have a website that needs to be cleaned up from malware or another type of hack, we provide a better alternative to using Sucuri, where we actually fully and properly clean up the website.
Yes they do.
Unlike you, they have actually discovered security flaws and botnets. You’re just trolling other vendors with the hope of gaining more clients.
As we explained in the post they actually don’t know what a brute force attack is and you didn’t even try to rebut anything we said.
The other part of your comment is equally ridiculous, considering that several months ago they tried to take credit for disclosing a zero-day vulnerability we had already disclosed in the WP Mobile Detector WordPress plugin.
Your comment gets back to one of the points of the post, that is easy for security companies to present themselves as having the expertise they don’t have, as Sucuri has succeeded in doing that with you.