Re: Re: Telnetd Vulnerability Report

[Demi Marie Obenour <demiobenour () gmail com>]

On 2/26/26 05:26, Florian Weimer wrote:
> * Marco Moock:
>
> > On 24.02.2026 05:05 kf503bla () duck com kf503bla () duck com wrote:
> >
> > > Who uses telnet anyway? It's deprecated. Everyone uses ssh for any
> > > kind of remote access.
> >
> > In certain situations telnet is still being used, because it is
> > supported on a wide range of systems, regardless of key (exchange)
> > algorithms or hash algorithms.
>
> Part of that is that the industry has moved to a threat model where it
> is considered more secure to use an unauthenticated, unencrypted channel
> rather than one that uses (for example) an HMAC based on SHA-1 for
> integrity protection.

I don't think anyone actually believes this, and it is rather obviously
not true.

What I do observe is that the community is not interested in supporting
obsolete cryptographic algorithms and obsolete security protocols.
This is only a problem because there are devices whose software cannot
be updated to support modern algorithms and protocols.  Those who
own such devices, and cannot replace them, thus have a few options:

1. They can use outdated tools to interact with them.
2. They can use protocols that never ever change, which (sadly)
   means unencrypted and unauthenticated ones.
3. They can obtain software that is specifically designed to
   interoperate with old embedded systems.

Option 3 is clearly the most secure, but it is also the most difficult.

However, there is also the question of whether this would even help.
If the TCP/IP stack has remote code execution vulnerabilities like
URGENT/11 [1], neither SSH and TELNET are secure.  Anyone who can
connect to the device can compromise it.  Therefore, such devices
should be protected by a jump host or application-level firewall/proxy
that *does* receive updates.  The connection between the embedded
device and the device protecting it should be physically secured.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

Attachment: OpenPGP_0xB288B55FFF9C22C1.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature