I have a raspberry-pi (running GNU/Linux) and I recently allowed my router to forward port 22 (ssh) to the raspberry-pi so that I could log in while away from home. 

I then noticed a bunch of apparent break-in attempts (failed root logins coming from a chinese ip address) in auth.log, and I have a couple questions about the timing of the failed root logins. 

Here's a snippet from my /var/log/auth.log file (the first number is just the line number from vi):

5966 Sep  7 11:50:19 raspberrypi sshd[13759]: Failed password for root from 122.225.103.125 port 34328 ssh2
5967 Sep  7 11:50:20 raspberrypi sshd[13755]: Failed password for root from 122.225.103.125 port 32582 ssh2
5968 Sep  7 11:50:20 raspberrypi sshd[13763]: Failed password for root from 122.225.103.125 port 35381 ssh2
5969 Sep  7 11:50:21 raspberrypi sshd[13759]: Failed password for root from 122.225.103.125 port 34328 ssh2
5970 Sep  7 11:50:22 raspberrypi sshd[13763]: Failed password for root from 122.225.103.125 port 35381 ssh2
5971 Sep  7 11:50:24 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2
5972 Sep  7 11:50:24 raspberrypi sshd[13763]: Failed password for root from 122.225.103.125 port 35381 ssh2
5973 Sep  7 11:50:25 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2
5974 Sep  7 11:50:26 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2
5975 Sep  7 11:50:26 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2
5976 Sep  7 11:50:28 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2
5977 Sep  7 11:50:28 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2
5978 Sep  7 11:50:29 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2
5979 Sep  7 11:50:31 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2
5980 Sep  7 11:50:31 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2
5981 Sep  7 11:50:31 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2
5982 Sep  7 11:50:33 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2
5983 Sep  7 11:50:33 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2
5984 Sep  7 11:50:34 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2
5985 Sep  7 11:50:35 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2
5986 Sep  7 11:50:35 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2
5987 Sep  7 11:50:36 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2
5988 Sep  7 11:50:37 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2
5989 Sep  7 11:50:38 raspberrypi sshd[13779]: Failed password for root from 122.225.103.125 port 46112 ssh2
5990 Sep  7 11:50:39 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2


And, here's a snippet from my /etc/pam.d/login file (the first number is just the line number from vi):

9 auth       optional   pam_faildelay.so  delay=3000000


As you can see the delay is set in pam.d/login to three seconds... However the failed root logins are coming at about 1 second apart. How is this possible? Is it because the logins are coming from different ports or ttys? Also, when I try to emulate this behavior myself by putting in the wrong root password, I find that after three attempts I get disconnected and this shows up in auth.log like:

231 Sep 17 11:51:57 raspberrypi sshd[17591]: Failed password for root from 192.168.42.71 port 34208 ssh2
232 Sep 17 11:52:01 raspberrypi sshd[17591]: Failed password for root from 192.168.42.71 port 34208 ssh2
233 Sep 17 11:52:04 raspberrypi sshd[17591]: Failed password for root from 192.168.42.71 port 34208 ssh2
234 Sep 17 11:52:04 raspberrypi sshd[17591]: Connection closed by 192.168.42.71 [preauth]


My three failed attempts are spaced out by at least 3 seconds (as specified in pam.d/login). How is it possible for whoever is trying to break in to make more that one attempt every three seconds and why is the connection not being closed after three failed attempts? 

Any help understanding this behavior would be greatly appreciated. Feel free to give references if you are not in the mood to type out an answer. Oh, also, if anyone has any idea as to how my ip address was targeted or if it is just random, I would be interested to hear about it.

Because there are security vulnerabilities found in software all the time.  These vulnerabilities are sometimes publicly disclosed, sometimes not.  Either way, as developers find or find out about them they patch them.  Running old versions of browsers leaves you vulnerable to malicious websites trying to infect your computer.
Below are links to web pages listing vulnerabilities that have been fixed in relatively recent versions of the 3 most popular browsers.
Microsoft Internet Explorer
Mozilla Firefox
Google Chrome
All browsers are going to have bugs, and all of them will have vulnerabilities.  But staying on top of known vulnerabilities can help prevent attackers from gaining access to your system.
Edit
Thanks to kirb for these extra links to up-to-date blogs of browser security updates
IEBlog
Google Chrome Releases
