News Report: Hacker Publishes Credentials for 500,000 Telnet Devices

[Admin]

A hacker reportedly published the IP addresses, usernames and passwords of 500,000 devices accessed via Telnet.

Report: Hacker Publishes Credentials for 500,000 Telnet Devices : Read more

 

[Math Geek]

the fact ANYTHING still uses Telnet is the real problem here. should be completely removed from the world at this point in the tech evolution of things.

 

[bit_user]

the fact ANYTHING still uses Telnet is the real problem here. should be completely removed from the world at this point in the tech evolution of things.

I'm pretty sure most ISPs block inbound connection to that port.

 

[bit_user]

It's possible that some of the devices have changed IP addresses or account credentials by now. (Not that it would be hard to find their new IP address with a quick search.)

WTF? ...and how do you do that, Mott?

I mean, if you have their DNS names, sure. But they probably just have the bare IPs, for most of these devices. Some of them might be findable on the same subnet, but I still wouldn't call that quick.

People who rely on these so-called smart devices might want to make sure their Telnet credentials are different from the manufacturer's default

...or, don't use Telnet! Just shut it off, which most devices support.

 

[Co BIY]

Can some one take the list, remotely access all the devices and change the passwords to something secure and totally random?

seems like a fun project!

 

[Math Geek]

Can some one take the list, remotely access all the devices and change the passwords to something secure and totally random?

seems like a fun project!

that's one thing to do with it. if someone did not bother to change from the default settings, then they likely don't even use Telnet. log in, change the password and such and then you got a permanent way into whatever device it is. well, until the owner finally figures it out and turns it off or resets the device back to defaults.

i doubt many people actually use Telnet but don't know enough to know to turn it off. it should not be enabled by default on any device especially consumer products with totally clueless users hooking it up.

 

[xodz4u]

@Math Geek

Telnet doesn't have to be running on the destination server for it to be useful.

Assuming the list contains more users/pass than just telnet client (port 23) --
You download telnet then use it like this:
telnet remoteIP remotePort

So, you can use telnet on http port (80), ssh (22), or any apps commonly installed and running on ports on the remote system.

 

[bit_user]

Can some one take the list, remotely access all the devices and change the passwords to something secure and totally random?

Not legally.

Also, by doing so, you'll be breaking anything that relied on accessing those devices via the compromised account - either by telnet or a more secure means.

 

[bit_user]

that's one thing to do with it. if someone did not bother to change from the default settings,

You don't know that it's truly the default settings. It could be just an easily-guessed or common password.

 

[bit_user]

Telnet doesn't have to be running on the destination server for it to be useful.

Yes. The username/password used for telnet logins are typically the same as used for ssh. So, even if telnet were disabled, the device might still be accessible, so long as the password is not changed.

just telnet client (port 23) --
You download telnet then use it like this:
telnet remoteIP remotePort

So, you can use telnet on http port (80), ssh (22), or any apps commonly installed and running on ports on the remote system.

Um, did you ever try this?

Telnet just runs over raw TCP/IP. If you point a telnet client at a port running another protocol, it's not like it gives you a login prompt - you'll see whatever that protocol does, which most likely won't make any sense to you or be particularly useable via a telnet client.

That said, I've used a telnet client to script some simple RTSP commands against a remote serer I was testing. So, depending on the protocol, it can definitely be useful.