Hackers Bringing Telnet Back 238
alphadogg writes "A new report from Akamai Technologies (CT: Requires login) shows that hackers appear to be increasingly using the Telnet remote access protocol to attack corporate servers over mobile networks.
The report, which covers the third quarter of 2010, shows that 10 percent of attacks that came from mobile networks are directed at Port 23, which Telnet uses. That marks a somewhat unusual spike for the aging protocol used to log into remote servers but that has been gradually replaced by SSH."
People stopped using Telnet? (Score:5, Insightful)
I use telnet constantly. Port 110 to check for a broken email header, Port 25 to check for SMTP auth errors, Port 3200 to check for the present of a NetGen DSS unit, etc, etc... I love telnet. Simple 3-way handshake and boom, datastream.
Re:People stopped using Telnet? (Score:5, Funny)
Re:People stopped using Telnet? (Score:4, Interesting)
Lensmoor.org port 3500
Shameless plug. Fun place to hang ;)
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
bbs.iscabbs.com
Re: (Score:2)
moo.sindome.org:5555
Re: (Score:2)
revengeofthejedi.com port 9400
Ok, so I haven't played it in a few months, but I always seem to return.
Re: (Score:2)
Ah, but some of those now support SSL connections.
Re: (Score:2)
Yes, and my level 283 Ninja is a lot more fun than your level 546 Scavi. Deal with it.
Re: (Score:2)
furry.com 8888
Since 1995! Some things never change. :)
(though in reality these days the TinyMUCK server supports SSL and I definitely use it)
Re: (Score:2)
Re: (Score:2)
Re:People stopped using Telnet? (Score:5, Insightful)
I use telnet constantly. Port 110 to check for a broken email header, Port 25 to check for SMTP auth errors, Port 3200 to check for the present of a NetGen DSS unit, etc, etc... I love telnet. Simple 3-way handshake and boom, datastream.
Sure, the telnet client is useful. I use it all the time for those very same reasons.
But actually running a telnet server and allowing incoming connections on port 23? Nope. Stopped doing that for everything I could years ago, switched to SSH on everything that would support it. The things that wouldn't support it were all tucked away on our inside network. I've got nothing facing the world that'll accept connections on port 23.
Re: (Score:2)
The things that wouldn't support it were all tucked away on our inside network
I didn't read the article, but I wonder is this is exactly what it is about. The summary mentioned the use of mobile devices. I wonder if it goes like this: bring a phone to a building, manage to connect to a purely secured wireless network, find a device that has port 23 open, ..., profit!
Of course, if you van get to it from the wireless network, it is not really safely tucked away.
Re: (Score:2)
If you allow unknown machines on your wireless in your office,you're not properly secure. We have unsecured wireless in our offices, but they are all on a VLAN that can only go out to the iNet.No corporate networks are accessible. And if you need more security than that, multiple firewalls and DMZs and Intrusion Detection Systems.
Re: (Score:2)
When bring a wire and connected to your wired network. If you can have a security breach simply by someone being on the same network you have security problem.. Ohh. look: Your manager just downloaded a trojan he thought was porn == hacked.
Re:People stopped using Telnet? (Score:5, Funny)
I'm using telnet for ssh too. Doing RSA in your head is a bit tricky at first, but once you get used to it it's really convenient.
PS. For a real challenge try to PPP authenticate over dial-up using your voice.
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:3)
Of course I can. I got a captain crunch whistle embedded in my larynx.
Re: (Score:3)
Re:People stopped using Telnet? (Score:5, Informative)
So you mean telnet the program, not telnet the protocol-- what the article was about?
Re: (Score:3)
Re: (Score:2)
Port 110 to check for a broken email header, Port 25 to check for SMTP auth errors
If you're testing user accounts, or logging into your POP3 box to check those mail headers, you may want to consider not using the telnet client anymore. You're potentially compromising any accounts you log into the same as you would with telnet accounts. Your server should be configured to use TLS/SSL for clients, and you can debug them telnet-style with the s_client [openssl.org] (in the OpenSSL suite).
Re: (Score:2)
Re: (Score:2)
I use telnet constantly. Port 110 to check for a broken email header, Port 25 to check for SMTP auth errors, Port 3200 to check for the present of a NetGen DSS unit, etc, etc... I love telnet. Simple 3-way handshake and boom, datastream.
But you don't use it to telnet to port 23 and login to a system with a username and password. That appears to be what this story is about.
Yes the telnet binary is still very useful just not for carrying passwords though public networks.
Re:People stopped using Telnet? (Score:5, Insightful)
Re: (Score:3)
A tip for management (Score:5, Insightful)
If you manage your company or institution's IT department, please do the following:
Step 1: Turn on "telnet" on your PC. [microsoft.com] (Of course you Windows, you're management, right?)
Step 2: Try to "telnet" to your company's website, or to any other machine or service names your underlings bandy about.
Step 3: If you don't see "Connection refused" every time, FIRE EVERYONE WHO REPORTS TO YOU.
Re:A tip for management (Score:5, Funny)
Re: (Score:3)
And how do you feel about GET / HTTP/1.1?
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Sooo... port forwarding over SSH ?
Re: (Score:2)
One of the things that makes a telnet client so handy is that it'll take a datastream from just about anything. It's great for troubleshooting SMTP servers and things like that.
The point that the parent was trying to make is that there is absolutely no reason you should be running a telnet server on any public-facing server.
Telnet itself answers on port 23. You could use a telnet connection to port 80 to maybe do some troubleshooting or something... But if you just try to telnet into your company website
Re: (Score:2)
Re: (Score:2)
telnet google.com 80
Trying 72.14.204.104...
Connected to google.com.
Escape character is '^]'.
Global Thermonuclear War
HTTP/1.0 400 Bad Request
Content-Type: text/html; charset=UTF-8
Content-Length: 1350
Date: Thu, 27 Jan 2011 14:58:35 GMT
Server: GFE/2.0
But I just wanted to play a game!
Re: (Score:3)
"websites run on port 80, right?)"
If you know this, you are not an IT manager. Nice try!
Misleading headline (Score:5, Insightful)
Re: (Score:2)
Um, the reason they are using telnet is because it's trivial to hack, in other words the headline should read "hackers hacking easiest to hack service on poorly configured machines, also water is wet, details at 11"
If I had a mod point, you would have it. This is so true. The hackers can only hack what you've left connected and unsecured. What happened to the policy of closing every port, then open up the one's you actually need.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
> Um, the reason they are using telnet is because it's trivial to hack,
No, it is trivial to intercept telnet passwords (which are sent in the clear) if you have access to a channel over which someone is logging in via telnet. A telnet deamon just sitting there unused creates a vulnerability only to the extent that it is a channel for attacking bad passwords (which is surely what these kids are doing).
However, there is no good reason to run a telnet daemon these days, especially on the public Internet.
Re: (Score:3)
Interesting you should say that, because the article actually says they don't know if it's brute force login attempts or botnet traffic. A largely unused port with traffic that most people ignore makes sense to park a botnet on. It makes a lot more sense than a sudden spike in system administrator incompetence, which means most of the comments on this story are likely off the mark.
Re: (Score:2)
Actually, ice and water vapor are both pretty wet if people interact with them, as the part of them touching a person rapidly changes to the person's temperature and turns into water. And 'wet' means 'gets liquid on a person'.
So standing in steam or touching ice in normal room temperature, you'll find they are, indeed, 'wet', as they will get liquid on you.
Now, if the air temperature is too extreme it won't, if you stand in steam at 300 degrees air temp or in ice cold enough that the water on your skin re
Hackers Bringing Telnet Back? (Score:5, Insightful)
Re: (Score:3)
Probably less a case of admins "bringing it back" and more a case of admins forgetting, or being oblivious to it being there in the first place. More and more admins will have scarcely used telnet ever in their professional lives, and so will overlook its presence on their servers. Ideal for hackers.
Re: (Score:3, Insightful)
Re: (Score:2)
Or an admin that has carefully secured a Solaris 10 machine, starting with shutting down telnet and the r* daemons, fingerd and all the other cruft. But then he installs a patch cluster... ...and suddenly all that crap is running again.
Don't ask me how I know that.
Re: (Score:2)
> ...overlook its presence on their servers.
Why are there any services running on their servers that they did not explicitly configure to run?
Re: (Score:2)
Re: (Score:2)
What has happened here, is only the outdated, maintained systems are still running telnet. This corresponds to a likely weak password. And if no one is obsoleting it, then no one is really watching it either. It has now become the forgotten-about low-hanging fruit.
Re: (Score:2)
"outdated, UNmaintained systems" - FTFM
Duh (Score:2)
Get your hackin' on (Score:4, Funny)
Them other protocols don't know how to act.
I think it's special what's inside your rack.
So enable the service and I'll begin to hack.
They are forgetting something... (Score:5, Insightful)
Printers? (Score:5, Informative)
Re: (Score:2)
Re: (Score:3)
Does it even count as hacking? Running a telnet service should count as granting random people authorised access.
No more than running an FTP, SMTP, POP, IMAP or HTTP service without proper SSL/TLS/digest enhancements. All of them still industry standards, even the bare versions. But that's okay, the more ICT incompetence on this planet the more money I/we can make, right?
Re: (Score:3)
Well, to be a little more precise, FTP, SMTP, POP and IMAP don't give you command line (root) access to the computer you happen to get access too. If you break into an FTP Server, you only have access to the files that are put up on the FTP directories of that server. And possibly the right to upload new files. Which is a little less problem then having root access to the entire server. Same goes for all the other services you mention. I will have to give you this. I don't think Telnet is really that bad
Re: (Score:2)
The telnet protocol itself doesn't give you access either, that all depends on what kind of shell (if any) and privileges (if any) you attach to it.
The reason why I mentioned the other protocols is that access to the files and data available through those can be harmful enough to an organisation. Potentially more harmful than user privileges on a server with resource limits and no exploitable software installed.
Re: (Score:3)
No.
I saw the headline, and thought the story was about hackers finding some new and novel use for telnet. You know, hacking.
But it's just another article about infected Windows machines using brute force attacks on port 445 and - apparently - 23. You know, "hacking."
Here's my favorite part:
As Steve Martin once said, "I'm sorry officer, I forgot a
Re:who still uses telnet? (Score:4, Interesting)
Re: (Score:3)
I use telnet clients from time to time, in the lab. You can use it connect and send data to any old port, not just 23. I would never run the telnet daemon though, and seven times never on a box that's exposed to the public Internet.
Telnet to other ports is a GREAT way to learn how protocols work.
Here are some exercises: From a DOS prompt, try:
C:> telnet www.google.com 80
GET
GET won't be echoed, but you can see the retrieval of a web page. You can try all commands that are part of the HTTP protocol, including the exchange of cookies, posting data, etc.
Or try telnet-ing into a pop server. [santovec.us]
Re: (Score:3, Informative)
You might have better success with even a semi-valid HTTP/1.1 request such as
GET / HTTP/1.1
Host: www.google.com
Also, using telnet here is redundant. You should consider using one [sourceforge.net] of [openbsd.org] the [sourceforge.net] several [nmap.org] netcats [deepspace6.net] available [dest-unreach.org]. Some even support nice features like SSL encryption, so you can make encrypted requests to to the https port (443).
Re: (Score:2)
GET / HTTP\1.1 Host: www.google.com
Re: (Score:2)
People who don't know how to set up SSH.
Re:who still uses telnet? (Score:4, Informative)
SSH isn't always an available option.
At work our primary application is a telenet app that logs into a specific server. Of course we aren't stupid enough not to use VPN's, and packet filtering to go outside the network(or back in). We tried to upgrade to more secure connection but found the clients to be lacking about 1/2 the features found in the simple telenet client. We were told some of those features might be in the next release or two in three - five years.
Since businesses get locked into vendor lock-in pretty hard it is very tough to move out. You get stuck doing things insecurely or working around bad security because upgrading isn't possible without millions of dollars being spent uselessly(paying a vendor to bring their applications up to the year 2000 standards).
I know of one company that used Win16 subsytem as a vital part of their application up until last year. they refused to upgrade it because it worked even though in order to install the application on windows XP often required rebooting into safe mode to bypass enough security to let it install. This Application was the only way to work with their product line too with quarterly updates to the data it contained. Oh and you have to upgrade the entire application in order to update the data inside.
It is those kinds of practices that make obsolete tech like telenet still exist.
Re: (Score:2)
In addition, a lot of switches and other network equipment still don't have SSH. Even switches only a couple of years old.
Re:who still uses telnet? (Score:4, Interesting)
This is the case with certain Cisco IOS versions. It has to be a crypto version of IOS to support SSH.
Re: (Score:2)
I know it's not always a realistic option because of politics or policy, but if your switches can't do SSH, I suggest you change brands.
Re: (Score:2)
I know it's not always a realistic option because of politics or policy, but if your switches can't do SSH, I suggest you change brands.
Why? Heck, in some small companies even telnet is too sophisticated. Not everyone needs managed switches. My house lives without 'em.
Re: (Score:2)
Re:who still uses telnet? (Score:4, Informative)
Re: (Score:3)
We were told some of those features might be in the next release or two in three - five years.
I may sound like a preacher, but that is exactly why you want to use open source software in as many aspects of your company as possible : to develop the features you lack at a given point without depending on a dozen of third parties who can't agree with each others. I know you probably aren't the one making the decision, but that is a point to regularly make : "if you had used the open alternative, we could have added this feature. Now we can't and need to wait for another company's goodwill".
Re: (Score:2, Troll)
Let's see spend $100,000 every 20 years to upgrade the software or spend $50,000 a year to pay someone to do it in house, and still get a vendor locked in solution, but only now you are the vendor.
Re:who still uses telnet? (Score:4, Insightful)
Re: (Score:2)
I have to post this anonymously for the safety of my job.
If you're worried about potentially losing your job over that type of comment, then I hope you're not posting this from work ...
Re:who still uses telnet? (Score:4, Insightful)
Re: (Score:2)
"Don't fix what ain't broke!"
The problem is often that they don't realise it's "broke (sic)". That is often the issue. When you bring in a physical item in more pieces than it's supposed to be, that's easy to tell that it's broken. When it's a stream of digital pulses, not so easy, unless your target is technologically aware, and not always even then. I still have problems convincing otherwise smart people to use placeholders in their SQL instead of concatenation.
Re: (Score:3)
I had to deal with a similar setup a few years ago. What I did was put them on their own Ethernet segment that was completely isolated from everything but one machine. Even the subnet had a separate hardware switch so there was no way (other than physical access or compromise of the telnet server) that the unencrypted traffic could be intercepted. This machine was what people telnetted into, then ssh-ed out from to do work. This way, the only real weak link were the paths from the terminals to the switc
Re:who still uses telnet? (Score:5, Informative)
Re: (Score:3)
Re: (Score:3)
Godaddy.com
ALL of their hosting has telnet and open FTP you have to specially request SSH and SFTP.
Re:who still uses telnet? (Score:4, Insightful)
That's not a good reason to use telnet. That's a good reason not to use Godaddy.
(Using dreamhost.com here, and I use ssh and rsync-over-ssh to do all of that... I wonder if sshfs would work, I imagine it would.)
Re: (Score:3)
Re: (Score:2)
My webcam used to have the telnet port open and would drop you straight into a root shell if you connected to it (no password required). Fortunately the new firmware fixed that.
Re: (Score:2)
Telnet on the server... well, I run it sandboxed to my LAN for testing BBSSH, but that's about it. However, it's probably safe to say that there are a lot of legacy devices (just just servers) which do provide access via telnet.
Re: (Score:2)
Re: (Score:2)
It's about the only way to config some old office laser printers.
Re: (Score:2)
The telnet *client* is extremely useful to talk raw protocol to a service, very good for debugging etc...
Running a telnet service on the other hand, is sadly still very common... Lots of networking equipment these days still only has telnet and no ssh support... Even where SSH support is available, sometimes only telnet is enabled by default, sometimes ssh costs extra etc... And there are plenty of people who are used to using telnet and won't consider anything else regardless of what benefits it might prov
Know your RFCs (was Re:who still uses telnet?) (Score:2)
Just to be clear, TELNET and TCP are not synonymous. The FTP command channel uses TELNET as a session protocol, transported by TCP with the server usually listening on port 21. Conversely, SMTP and HTTP are their own session protocols, probably because TELNET isn't 8-bit-clean. This is why netcat, which normally uses raw TCP sockets, has a command-line option specifically for interoperation with TELNET and TELNET-based protocols.
Best wishes,
Matthew
Re: (Score:2)
but hey, it's fun to watch on a honeypot under emulation! :-)
Re:What's the problem? (Score:4)
Right, but when you type hunter2, we just see *******.
On another note, anybody who is not currently blocking access port 23, or even worse is running a telnet server, needs to hand in their sysadmin card right now.
Re: (Score:3)
... anybody who is not currently blocking access port 23, or even worse is running a telnet server, needs to hand in their sysadmin card right now.
Ever hear the term honeypot [wikipedia.org]?
You insensitive clod! (Score:2)
Re:Good ole days (Score:5, Insightful)
If telnet reminds you of when you were young you aren't old.
Re: (Score:2)
He could very well be. Wikipedia says Telnet was under development in 1969. He could have old enough at the time to have used it.