In one sentence: Port 23 is the door for Telnet, an old way of controlling another computer from a keyboard over the network, which sends everything including passwords in plain view.

What runs on this port

Telnet lets you type commands on a remote machine as if you sat at it. The standard is RFC 854, and the IANA registry lists Telnet on TCP port 23.

It is still found on older devices. CISA’s alert names routers, network cameras and video recorders among the affected equipment, and tells defenders to watch port 2323 as well as port 23.

The SSH standard (RFC 4251) says SSH offers much higher security than older solutions such as Telnet. SSH is the modern replacement.

Why attackers look for it

A device with Telnet open usually has a login prompt, and many such devices still have the factory password. CISA’s alert on the Mirai botnet explains that the malware continuously scans the internet for vulnerable Internet of Things devices and uses a short list of 62 common default usernames and passwords.

CISA says that short list let the botnet reach hundreds of thousands of devices. The devices involved were mainly home routers, network cameras and digital video recorders. Attackers did not need a clever exploit. They logged in.

How it gets attacked

• Default and weak passwords. CISA names default credentials as the way Mirai took over devices. Default usernames and passwords for most devices can be found on the internet.
• Clear text. Telnet has no encryption, so anyone on the network path can read a session, including the password.
• Use as a stepping stone. Compromised devices were used to build botnets that launched record denial of service attacks. CISA reports that one exceeded 620 Gbps against the KrebsOnSecurity site in September 2016.
• Monitoring advice. CISA tells defenders to monitor ports 23/TCP and 2323/TCP for attempts to take control of devices using Telnet.

Who it affects and how badly

• Sole trader to 10 staff: a home or office router or camera with Telnet reachable from the internet. Worst case: it joins a botnet and your connection is slow or blocked.
• 10 to 50 staff: hospitality, retail and trades businesses with cameras, tills and routers that nobody has updated.
• 50 to 250 staff: manufacturers and construction firms with older equipment. Worst case: an attacker gets a foothold inside the network.
• Telecoms, councils and regulated firms: large numbers of network devices make one forgotten Telnet service easy to miss.

How to check whether yours is exposed

• Read your firewall rules for inbound TCP 23 and 2323.
• List every network device, camera and printer, and check whether each one has Telnet turned on in its settings.
• Check your router’s remote administration page.
• Run the free web vulnerability scan and review the external results for your own addresses. Only check addresses you own.
• Review firewall logs for inbound attempts on ports 23 and 2323.

How to secure it

1. Turn Telnet off on every device that offers it, and use SSH instead.
2. Block inbound TCP 23 and 2323 at the firewall.
3. Change every default username and password (CISA).
4. Install device security updates as soon as they are available (CISA).
5. Keep management interfaces on a separate network, not on the internet.
6. Replace devices that cannot be updated or that cannot turn Telnet off.
7. Disable Universal Plug and Play on routers unless it is needed (CISA).
8. Keep a list of devices and who owns each one.

Related terms

• port 22 ssh
• port 20 21 ftp
• brute force attack
• nmap
• exploited in the wild
• vulnerability scanning

Frequently asked questions

What is Telnet used for?
It gives a remote text login to a computer or device. RFC 854 defines it and IANA lists it on TCP port 23.

Why is Telnet unsafe?
It has no encryption, and CISA’s Mirai alert shows that default passwords on devices with Telnet were used to build large botnets.

What replaces Telnet?
SSH. RFC 4251 states it offers much higher security than older solutions such as Telnet.

Sources

• RFC 854, Telnet Protocol Specification: https://www.rfc-editor.org/rfc/rfc854.txt
• RFC 4251, The Secure Shell (SSH) Protocol Architecture: https://www.rfc-editor.org/rfc/rfc4251.txt
• CISA alert TA16-288A, Mirai and other botnets: https://www.cisa.gov/news-events/alerts/2016/10/14/heightened-ddos-threat-posed-mirai-and-other-botnets
• IANA service name and port number registry: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.