8

In the forum post in which Mirai source code was released, the author wrote

With Mirai, I usually pull max 380k bots from telnet alone. However, after the Kreb DDoS, ISPs been slowly shutting down and cleaning up their act. Today, max pull is about 300k bots, and dropping.

What measures could he have been referring to when he talked about ISPs "cleaning up their act"? My understanding is that Mirai just tries to telnet into random IPs with default credentials. What can ISPs do (and what do they actually do) to try to prevent that behavior?

  • They can do so by using routers from reputable manufacturers instead of cheap, outdated crap. – André Borie Dec 2 '16 at 10:44
6

Blocking telnet to the routers. It should be blocked anyway as one of the most basic security configurations (hence the phrase, "cleaning up their act").

Telnet used to be the standard method to get shell access on remote computers. The only problem was that there was zero security in the protocol. Then ssh was created to do the same thing, but using secure channels.

SSH is such a common and standardised tool now that there should be no reason to ever need telnet. The fact that the routers are even designed to respond to telnet requests is surprising (and troubling).

If a device uses telnet, an ISP can protect the device by simply blocking traffic to it on the standard telnet port: 23.

I doubt ISPs would do it (too resource intensive), but one could also inspect traffic to the routers to look for the default password strings and block those packets. It's more of a technique for local networks than for ISPs, but it's another route for protection.

What makes this problem so big for these routers is that both the credentials and the telnet service are hardcoded into the firmware. You can't change it and can't turn it off. The only way to protect yourself is to block traffic to the device on the port it is configured to listen to (telnet port 23).

  • Ah, so when you say "the routers" you mean the all in one gateways they give their customers? That makes sense. – Elliot Gorokhovsky Dec 4 '16 at 0:24
  • You can create vpn network and use telnet only inside it. – Khirgiy Mikhail Dec 4 '16 at 18:34
  • @KhirgiyMikhail if your destination supports telnet, sure. Not many routers support that functionality, though, and it's not something that an ISP will spend resources on as a systemic solution (when SSH also works fine). – schroeder Dec 4 '16 at 21:31
  • @schroeder yes, of course. If equipment supports telnet and ssh access then using ssh is more recommend instead telnet. But all management Interfaces we put in one VPN network or vlan. – Khirgiy Mikhail Dec 5 '16 at 4:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.