The Curse of Telnet, an IoT Problem that Doesn't Want to Go Away

• An unsecure communication protocol proves to be a headache in today's world
• Despite its age and problems, Telnet sticks around
• The mitigation of Telnet security problems is possible with the right solution

Needlessly opened ports represent one of the most significant security problems in today's IoT ecosystem. Telnet is an unsecure communication protocol commonly used to connect to devices through an opened port and one of the most considerable headaches for device owners and security professionals alike.

The Telnet protocol has been around for a long time, and by long, we mean decades. It had a straightforward purpose; to allow users to connect to their devices through a command-line interface. It served its purpose, but its unsecure nature meant that it had to be replaced. Or at least that was the initial intention.

For the most part, the Secure Shell Protocol (SSH) took Telnet's place in remote communications, but that doesn't mean Telnet isn't still around. And this is where the problems begin. In their constant race to offer consumers new devices and fill various market niches, manufacturers take shortcuts. One of the primary shortcuts is to curtail the implementation of appropriate security policies that eventually lead to attackers compromising the hardware.

 

Telnet is just the tip of the iceberg

 

Some router manufacturers still use Telnet and leave it open, in addition to committing other security blunders, like hardcoded credentials, for example. It's gotten so bad that the pattern attackers use is becoming all too predictable: infect a device and begin to look in the same network for other devices with the Telnet protocol port open.

In some situations, the malware will look for other open ports and try some common or default passwords. If the hardware is not adequately secured and still has an unnecessarily open port, taking over is all too easy.

Telnet uses port 23 on routers, if not configured differently, but these are not the only ones to feature this particular protocol. Plenty of other IoT devices use Telnet, and what makes it dangerous is the unencrypted nature of the communication, which effectively happens in plain text. For all intents and purposes, Telnet is what we consider a legacy technology.

 

Know your environment

 

The ability to tell which devices harbor vulnerabilities in your house or business environment is crucial for security. If a router or other device is accessible via an opened port, you need to know. If only there were some kind of solution that can provide this kind of information.

As it turns out, Bitdefender Router Protection is just the right tool for this task. It's easily implemented in an ISP's router, virtually patching the router's security in any environment. That includes the ability to tell if the router has exposed ports or any other vulnerabilities.

Since we can't always trust manufacturers to be responsible with the security policies they implement in their hardware, we can only deal with the repercussions, trying to mitigate the direct effects. It will take a long time until security issues like the Telnet port disappear, and until then, we have to stay secure. Bitdefender is the only technology provider that has a full stack of solutions to protect the entire smart home environment.

 

[Interested? Get in touch]