4 ms·

The article mentions Telnet login credentials about halfway through. Is that honestly what's happening? I'd assumed it was at least SSH logins being abused on t

The article mentions Telnet login credentials about halfway through. Is that honestly what's happening? I'd assumed it was at least SSH logins being abused on the systems.

Tepix 9y ago
A typical cheap chinese webcam will have an open telnet port.
taspeotis 9y ago
There is probably a correlation between IoT devices that get pwned and IoT devices that use Telnet.
- H4CK3RM4N 9y ago
  Probably a very strong one at that.
Neliquat 9y ago
The sheer number of open telnet ports on IoT devices is staggering and embarrassing to our industury as a whole.
- louithethrid 9y ago
  Its the fact that there is no market here- people do not know and will never know what they actually buy wit a IOT Device. They can not evaluate quality, and noone is liable for the risks. I guess some citys will have to get the plague first, before the governments quarantining is accepted.
tyingq 9y ago
Here's a Jidetech Camera that serves up telnet: https://www.amazon.com/Wireless-Security-Recording-One-Key-Setting/dp/B06X41WH4V https://www.amazon.com/Wireless-Security-Recording-One-Key-S... And an article on how bad it is: http://www.networkworld.com/article/3143133/security/iot-security-camera-infected-within-98-seconds-of-plugging-it-in.html http://www.networkworld.com/article/3143133/security/iot-sec... (98 seconds to being infected after exposing it to the internet)
- ihsw2 9y ago
  Sounds like the bad old days when WinXP boxes were directly connected to the internet (as opposed to behind a router).
- mnw21cam 9y ago
  From the article you linked: > The correct mitigation, Graham said, is to “put these devices behind your firewall” because “many of the Mirai passwords can’t be changed.” No, the correct mitigation is to not have one of those devices. You don't buy a rotten apple, and then store it on your kitchen table, because "it's fine because it's sealed in a plastic bag". Richards' Laws of Data Security: 1. Don't buy a computer. 2. If you must buy a computer, don't turn it on.
0xfeba 9y ago
Oh, shield your eyes. The land of IoT is a land of infosec hell.
pdkl95 9y ago
Defcon 20 - Dan Tentler - "Drinking from the caffeine firehose we know as shodan" https://www.youtube.com/watch?v=5cWck_xcH64 https://www.youtube.com/watch?v=5cWck_xcH64 Warning - watching this may readjust your faith in humanity. Telnet is just the tip of the iceberg. edit: (15:42) "Econolite [stoplights] listening on telnet. There are intersections [with] stoplights; you can telnet into them and put them in 'test mode'[sic], and the warning says, 'Don't do this, you could kill people!'"

The article mentions Telnet login credentials about halfway through. Is that honestly what's happening? I'd assumed it was at least SSH logins being abused on the systems.

Tepix 9y ago

A typical cheap chinese webcam will have an open telnet port.

taspeotis 9y ago

There is probably a correlation between IoT devices that get pwned and IoT devices that use Telnet.

H4CK3RM4N 9y ago
Probably a very strong one at that.

Neliquat 9y ago

The sheer number of open telnet ports on IoT devices is staggering and embarrassing to our industury as a whole.

louithethrid 9y ago
Its the fact that there is no market here- people do not know and will never know what they actually buy wit a IOT Device. They can not evaluate quality, and noone is liable for the risks. I guess some citys will have to get the plague first, before the governments quarantining is accepted.

tyingq 9y ago

Here's a Jidetech Camera that serves up telnet: https://www.amazon.com/Wireless-Security-Recording-One-Key-Setting/dp/B06X41WH4V https://www.amazon.com/Wireless-Security-Recording-One-Key-S... And an article on how bad it is: http://www.networkworld.com/article/3143133/security/iot-security-camera-infected-within-98-seconds-of-plugging-it-in.html http://www.networkworld.com/article/3143133/security/iot-sec... (98 seconds to being infected after exposing it to the internet)

ihsw2 9y ago
Sounds like the bad old days when WinXP boxes were directly connected to the internet (as opposed to behind a router).
mnw21cam 9y ago
From the article you linked: > The correct mitigation, Graham said, is to “put these devices behind your firewall” because “many of the Mirai passwords can’t be changed.” No, the correct mitigation is to not have one of those devices. You don't buy a rotten apple, and then store it on your kitchen table, because "it's fine because it's sealed in a plastic bag". Richards' Laws of Data Security: 1. Don't buy a computer. 2. If you must buy a computer, don't turn it on.

0xfeba 9y ago

Oh, shield your eyes. The land of IoT is a land of infosec hell.

pdkl95 9y ago

Defcon 20 - Dan Tentler - "Drinking from the caffeine firehose we know as shodan" https://www.youtube.com/watch?v=5cWck_xcH64 https://www.youtube.com/watch?v=5cWck_xcH64 Warning - watching this may readjust your faith in humanity. Telnet is just the tip of the iceberg. edit: (15:42) "Econolite [stoplights] listening on telnet. There are intersections [with] stoplights; you can telnet into them and put them in 'test mode'[sic], and the warning says, 'Don't do this, you could kill people!'"