[ars]

As an experiment I put up an in-memory server at a random IP, with a root password that was in the dictionary.

It was infected within an hour, and by multiple attackers.

It also reminds me about how there was a time when it was impossible to install XP - you needed internet access to get the latest patches, but by the time you downloaded them you were already infected.

So yes, they do work.