Skip to content
Neutron Computing

Insights

Script kiddies: low skill, automated, and still dangerous

"Script kiddie" is the industry's slightly unkind term for someone, often young, who runs attack tools written by others without understanding how they work. They are motivated by curiosity, boredom and bragging rights rather than money or ideology.

It would be a mistake to dismiss them.

Why low skill doesn't mean low harm

  • The tools are real. The same scanners and exploit kits are used by professional criminals; the script kiddie just points them at everything.
  • It's automated. Anything connected to the internet is scanned within minutes of going online. They don't choose you; their tool finds you.
  • Attacks can be rented. Denial-of-service-for-hire services let anyone knock a website offline for a small fee, which is why police in Europe, the US and the UK have repeatedly shut them down.
  • They can do real damage by accident. Someone who doesn't understand a tool can't control what it breaks.
  • Some of them grow into the professionals. The Mirai botnet, which knocked major websites offline in 2016, was written by three university-age students. It worked by trying factory-default passwords on internet-connected cameras and routers, and it found enormous numbers of them.

What they go after

Whatever is exposed and unpatched: remote desktop left open to the internet, routers and cameras with default passwords, old website plugins, admin pages with weak logins, test systems that someone forgot to switch off.

Effort to defend: low

This is the one attacker that basic hygiene stops almost completely:

  • Patch, especially anything reachable from the internet.
  • MFA on every remote login.
  • Don't expose services you don't need. Remote desktop should never be open to the internet; use a VPN or a secure remote-access gateway.
  • Change every default password on routers, cameras, printers and storage devices.
  • Switch off test systems and old accounts.
  • Know what you have exposed. A scan of your own public addresses shows you what they see.

The reward is bigger than it looks. The defences that stop script kiddies are the same basics that stop most opportunistic criminals, because they are using the same tools.

Sources