[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <6c2a28b5-79f3-4a48-bebb-5b35452ff40a@gmail.com>
Date: Thu, 26 Feb 2026 14:58:46 -0500
From: Demi Marie Obenour <demiobenour@...il.com>
To: oss-security@...ts.openwall.com, Florian Weimer <fweimer@...hat.com>,
Marco Moock <mm@...fdsl.de>
Subject: Re: Re: Telnetd Vulnerability Report
On 2/26/26 05:26, Florian Weimer wrote:
> * Marco Moock:
>
>> On 24.02.2026 05:05 kf503bla@...k.com kf503bla@...k.com wrote:
>>
>>> Who uses telnet anyway? It's deprecated. Everyone uses ssh for any
>>> kind of remote access.
>>
>> In certain situations telnet is still being used, because it is
>> supported on a wide range of systems, regardless of key (exchange)
>> algorithms or hash algorithms.
>
> Part of that is that the industry has moved to a threat model where it
> is considered more secure to use an unauthenticated, unencrypted channel
> rather than one that uses (for example) an HMAC based on SHA-1 for
> integrity protection.
I don't think anyone actually believes this, and it is rather obviously
not true.
What I do observe is that the community is not interested in supporting
obsolete cryptographic algorithms and obsolete security protocols.
This is only a problem because there are devices whose software cannot
be updated to support modern algorithms and protocols. Those who
own such devices, and cannot replace them, thus have a few options:
1. They can use outdated tools to interact with them.
2. They can use protocols that never ever change, which (sadly)
means unencrypted and unauthenticated ones.
3. They can obtain software that is specifically designed to
interoperate with old embedded systems.
Option 3 is clearly the most secure, but it is also the most difficult.
However, there is also the question of whether this would even help.
If the TCP/IP stack has remote code execution vulnerabilities like
URGENT/11 [1], neither SSH and TELNET are secure. Anyone who can
connect to the device can compromise it. Therefore, such devices
should be protected by a jump host or application-level firewall/proxy
that *does* receive updates. The connection between the embedded
device and the device protecting it should be physically secured.
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Download attachment "OpenPGP_0xB288B55FFF9C22C1.asc" of type "application/pgp-keys" (7141 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
