Telnet is an old network protocol for remote command-line access to devices that sends everything, including usernames and passwords, as unencrypted plain text.
How Telnet works
Telnet dates back to 1969; its standard form is defined in RFC 854 (1983). A Telnet client connects to a server, usually on TCP port 23, and opens a text terminal session where the user can log in and run commands. The protocol has no encryption and no reliable way to verify the server’s identity, so anyone who can observe the traffic can read credentials and the whole session.
In the 1990s SSH was created as a secure replacement and took over remote administration of servers. Telnet nevertheless survives in routers, switches, industrial controllers, printers and cheap IoT devices, often enabled by default.
Why Telnet is a security risk
- Credential theft – passwords can be sniffed on the network or captured in a man-in-the-middle position.
- Brute-force attacks – exposed Telnet ports are constantly scanned by bots that try default and weak passwords.
- Botnets – the Mirai malware (2016) spread to hundreds of thousands of cameras and routers by logging in over Telnet with a short list of factory credentials, and then launched record-breaking DDoS attacks, including the one against DNS provider Dyn.
In 2020 a list of Telnet credentials for more than 500,000 servers, home routers and IoT devices was published on a hacking forum, showing how many devices still expose the service. Many botnets still rely on Telnet brute force for recruitment.
How to reduce the risk
- Disable Telnet and use SSH for remote administration.
- Block port 23 at the network perimeter and scan for exposed services.
- Change default passwords on all network and IoT devices.
- Where legacy equipment needs Telnet, restrict access to an isolated management network or VPN.
