1

I was recently asking for the telnet client to be turned on on my Windows install. The devops guy told me it was restricted because it passed people's usernames and passwords through clear text. I assume he is referring to using it to connect to an unsecured telnet server but I won't be using it for that and instead use it just for some quick TCP checks.

I also noticed that OWASP referenced doing exactly that in their documentation.

https://www.owasp.org/index.php/Test_HTTP_Methods_(OTG-CONFIG-006)

So what am I missing, is there a security issue with the client?

JGleason
  • 113

2 Answers2

2

There are no direct security issues with just having the client installed. The problem here is the combination of the client and the user using it to access servers with unencrypted connections. It's easier to make technical limitations than alter human behaviour.

Is removing the client software the only way to mitigate this problem? Certainly not, and for example blocking unencrypted protocols on a firewall might work even better and also against running own executables or using own devices to circumvent this limitation. But still, it's a reasoned company policy, probably based on experience.

Esa Jokinen
  • 52,963
  • 3
  • 95
  • 151
0

There are ways to do basic connection checks that don't speak an unencrypted protocol: In Windows, using the command line, how do you check if a remote port is open?

Of those, I like that Test-NetConnection is included in PowerShell. nmap is more powerful but is third party.

I say this having used telnet to bang out test SMTP emails on UNIX boxes. Which is stupidly low level, but I see what is going on. Never used for login, telnet service always disabled.

John Mahowald
  • 36,071