Slashdot Mirror
Someone Published a List of Telnet Credentials For Thousands of IoT Devices (bleepingcomputer.com)
An anonymous reader writes: A list of thousands of fully working Telnet credentials has been sitting online on Pastebin since June 11, credentials that can be used by botnet herders to increase the size of their DDoS cannons. The list includes an IP address, device username, and a password, and is mainly made up of default device credentials in the form of "admin:admin", "root:root", and other formats. There are 33,138 entries on the list, which recently became viral on Twitter after several high-profile security experts retweeted a link to it. During the past week, a security researcher has been working to find affected devices and notify owners or their ISPs. Following his work, only 2,174 devices still allow an attacker to log on via its Telnet port, and 1,775 of the published credentials still work. "There are devices on the list of which I never heard of," the researcher said, "and that makes the identification process much slower."
I almost always turn to google when trying to remember WTF the default settings are on a newly reset device like routers, modems, etc.
Nobody should have been using telnet for the past 15 years.
You've been warned 10000+ times, and now you're pwn3d.
all my IoT devices are on a separate LAN that is not connected to the internets, i had an extra wifi router laying around and put it to work as a LAN ONLY IoT DHCP server
Politics is Treachery, Religion is Brainwashing
Really? It has been, what 25 years since I was told by a friend that using Telnet was a bad idea, and I should start using this newfangled ssh. I resisted for a while as my server was an old 386, and pretty slow to connect over ssh. But I eventually gave in and the world became a happier safer, and more secure place.
First law of people: People are generally stupid.
Honestly if you have an IoT device with default credentials which can be reached from the internet at large, then both you and the company who made it are fucking morons.
The companies who make these things don't give a fuck about you or your security, and only gave a damn about getting half-assed product out the door.
The "internet of turds" is a pathetic joke, and the idiots who are flocking to internet connected devices who know nothing about this stuff deserve what they get. If YOU can access it from an app on your phone, some other asshole can and WILL also access it.
This is hilarious, and entirely something we've been predicting for years.
Let me know when you get over ten million. Those IoT jobs have _tiny_ processors so your botnet has to have a whole lot of them to make it worth the hassle.
Here's the link to an archived copy of that pastebin
I count 6 logins as even trying.
Let me know when you get over ten million. Those IoT jobs have _tiny_ processors so your botnet has to have a whole lot of them to make it worth the hassle.
It doesn't take much processor speed to be an effective botnet bot. The limit is the network bandwidth, which can generally be saturated with little crunch.
Also: A "small processor" by today's standards is blazingly fast compared to those of even just a few years back. Typical IoT devices have plenty of processor speed, necessary to handle their networking protocols, which they only use in bursts. The battery powered ones achieve long life by spending almost all of their time "asleep", with nothing powered up but any persistent output lines and a wristwatch-crystal "alarm clock" to wake up the CPU when it's time to do some work - or turn on the radio and see if somebody needs to talk.
But the issue is not just botnet operators adding them to their net.
Those devices are doing some mission. If they can be rooted, an attacker can also take over and disrupt whatever it is they are supposed to be doing.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Any FBI / CIA / NSA logins? with there names as the login
What business does any manufacturer have enabling or using telnet on any products!
Do a port scan with nmap for every device you have on your network? And every time you add one?
Then you can block things you don't want accessed from the Internet on your firewall/router...
People still use Telnet?
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
When people connect things to the network, we must I.D. IoT devices.
Sorry I couldn't make that funnier.
Comment removed based on user account deletion
Engineer> Hey, boss. The software for our new microwave is finally ready.
Project Manager> Well... we've just received a last-minute request. Our marketing department asked us to add remote access so that they can get valuable stats on the most commonly cooked porridge brand.
Engineer> But there's no time...
PM> You're a smart guy. Find a way.
Even devices that have mediocre security know not to use telnet. Properly installed and configured, it's still a pretty severe security hole.
This was humor. Apparently mods don't know humor, even if it's bad, from #russiabots or #trumpbots (... if there's a difference between those latter two.).