Yes, I didn't put it in the article because it was getting too long otherwise, but the attacker immediately tried brute-forcing the root account, and after a handful of common passwords ("qwerty", "qwerty123", "pizza" among those) he found "password".
I was able to find all the attempts by looking at the I/O activity of the sshd process, and also the syslog activity recorded every attempt.
Doesn't your system refuse root login by ssh by default ? If I remember correctly, on ubuntu server, sshd is configured by default to not allow root login from remote addresses.
On some providers yes, in fact I explicitly enabled root SSH login for those.
Other providers (such as Digital Ocean) use the root account by default even for Ubuntu, although the password is set to a really secure and random one.
If you write ([[]] == false) you compare values of this object. Internally a [[]].toString() is called which gives an empty string (cause the first element is also an empty array) which in turn is considered false in javascript.
Otherwise [[],[]] is true cause cause [[],[]].toString() gives you this string: ",".
If you create Derivative Works, you grant to Microsoft a non-exclusive, perpetual, irrevocable, royalty-free, assignable, sublicenseable license to reproduce, distribute, publicly display, modify, use, make, have made, import, and sell such Derivative Works.
