This being more than a decade and a half ago, I doubt it was a drive-by script. I was dialed into AOL on a 4 letter screen name. I had just informed a channel of Linux users, who knew my public IP, that I had just installed Linux for the first time. The chances it wasn't someone from that IRC channel are near zero.
Yep, it was common to watch new folks join a help channel, and as soon as you saw that root@host identity, the level of shenanigans would jump through the roof.
I didn't say it wasn't. And given the malicious activity (most scripted attacks, especially today, prefer to make productive use of your system) that's a likely explanation.
But scripted or not, someone did you a favor.
For a reference point, a (very technical) friend at a large tech company had to fire up a fresh Windows VM in order to complete some Windows/IE-only internal web app form.
He was p0wned within 5 minutes. On the corporate LAN. Stats I've seen are that an unpatched WinXP box (pre-SP2) was getting p0wned within 15 seconds, on average by the mid/late oughts. Scripted attacks are that fast and easy.
Scanning an IP range for open telnet ports (n00b move #1) and attempting root logins on same (n00b move #2) with weak passwords (third strike) is pretty trivial. Could have been another AOL user, could have been someone's IRC bot / autoattack.
While not blaming the victim, you discovered (on a freshly installed, no-real-data-present-yet box, hence, very inexpensively) that You Don't Do That[tm].
So: stop crying over this and put on your Big Boy pants. That asshole did you a favor. Really.
