Subject: [Mud] [Dumpsterfire] telnet (fwd) lefty via Dumpsterfire: [Dumpsterfire] telnet

From: Michael Richardson <[email-masked]>
Date: Tue, 21 Jan 2020 20:44:35 -0500

Subject: [Dumpsterfire] telnet
From: lefty via Dumpsterfire <[email-masked]>
To: [email-masked]
Date: Tue, 21 Jan 2020 11:40:22 -0500
List-Id: Dumpsterfire - the mailing list for IoT security and privacy failures <dumpsterfire.firemountain.net>

More than 500k telnet credentials for IoT devices leaked
https://threatpost.com/hacker-leaks-more-than-500k-telnet-credentials-for-iot-devices/152015/

Meh - a small gesture

**********************************************************************
The Dumpsterfire mailing list is hosted by firemountain.net.

To unsubscribe or change delivery options:
http://www.firemountain.net/mailman/listinfo/dumpsterfire

---

From: Eliot Lear <[email-masked]>
Date: Wed, 22 Jan 2020 19:26:48 +0100

The question is this:

Was this an example of a service that was left running or is telnet actually required for the device to be configured?

Eliot

> On 22 Jan 2020, at 02:44, Michael Richardson <[email-masked]> wrote:
> 
> 
> Date: 21 January 2020 at 17:40:22 CET
> Reply-To: lefty <[email-masked]>
> 
> 
> --
> Mud mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mud

---

From: Michael Richardson <[email-masked]>
Date: Wed, 22 Jan 2020 16:00:57 -0500

> Was this an example of a service that was left running or is telnet
    > actually required for the device to be configured?

I think there are three questions.
1) Was telnet intended to be enabled in production?  I'll bet that 95% of it
   is no.  MUD would have helped significantly, provided, i guess, that the
   device was behind something that could provide ACLs. I'll bet half the
   devices are broken home routers.
   
2) Was a credential needed to access?  Old revisions of openwrt just left a
   a root shell on a telnet port, because there wasn't code space for
   anything else, and what's the point of a default credential that everyone
   knows.

3) Assuming that the service was needed in production, and either had a
   default credential or no credential, was there even a way to change
   the credential, or turn off the service?

The article says that this is a problem in telnet, and as the one comment
says, it's nothing to do with telnet.  It is a serious limitation of
passwords.
(I remember trying to figure out if I could write an S/Key calculator for an
stack calculator... not an HP, which was too limited)

    > ----------------------------------------------------
    > Alternatives:

    > ----------------------------------------------------

-- 
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-