4 ms·
Can you please explain or provide a reference link to provide more explanation: >We see upwards of 2 million unique ipv4 sources scan us on port 23 every day.
by pritambarhate 10y ago
Can you please explain or provide a reference link to provide more explanation:
>We see upwards of 2 million unique ipv4 sources scan us on port 23 every day. These are all compromised IoT devices and routers.
What is the unique connection between port 23 and IoT devices? Genuinely Curious.
Thanks.
- justinsaccount 10y agoShitty underpowered devices that ship with telnet enabled instead of ssh.
- Spare_account 10y agoOne of the observations I read in the aftermath of the Krebsonsecurity DDOS was that the vulnerable IOT devices often permit telnet (port 23 and non-encrypted) connections. A common approach to take over one of these devices starts with brute-forcing the login prompt. Once compromised and running malware, the device proceeds to probe random IP addresses for open telnet ports to spread further. The uptick in port 23 connection attempts has coincided with the perceived spread of IOT malware.
- api 10y agoI wonder if someone should grey hat this and scan and kill vulnerable hardware.
- justinsaccount 10y agoOnce one of these botnets finds a device with admin:admin credentials the first thing it can do is change the password.