Someone Published a List of Telnet Credentials For Thousands of IoT Devices (bleepingcomputer.com)

An anonymous reader writes: A list of thousands of fully working Telnet credentials has been sitting online on Pastebin since June 11, credentials that can be used by botnet herders to increase the size of their DDoS cannons. The list includes an IP address, device username, and a password, and is mainly made up of default device credentials in the form of "admin:admin", "root:root", and other formats. There are 33,138 entries on the list, which recently became viral on Twitter after several high-profile security experts retweeted a link to it. During the past week, a security researcher has been working to find affected devices and notify owners or their ISPs. Following his work, only 2,174 devices still allow an attacker to log on via its Telnet port, and 1,775 of the published credentials still work. "There are devices on the list of which I never heard of," the researcher said, "and that makes the identification process much slower."

Comments

Blurring part of the screenshot wont save you

[Anonymous Coward]

Here's the link to an archived copy of that pastebin

Not just botnetting.

[Ungrounded Lightning]

Let me know when you get over ten million. Those IoT jobs have _tiny_ processors so your botnet has to have a whole lot of them to make it worth the hassle.

It doesn't take much processor speed to be an effective botnet bot. The limit is the network bandwidth, which can generally be saturated with little crunch.

Also: A "small processor" by today's standards is blazingly fast compared to those of even just a few years back. Typical IoT devices have plenty of processor speed, necessary to handle their networking protocols, which they only use in bursts. The battery powered ones achieve long life by spending almost all of their time "asleep", with nothing powered up but any persistent output lines and a wristwatch-crystal "alarm clock" to wake up the CPU when it's time to do some work - or turn on the radio and see if somebody needs to talk.

But the issue is not just botnet operators adding them to their net.

Those devices are doing some mission. If they can be rooted, an attacker can also take over and disrupt whatever it is they are supposed to be doing.

Re:Telnet? this is a joke right!

[HornWumpus]

It took me 30 seconds on Google to confirm. Busybox to start.