Telnet port 23 open

I have a security question. My dsl provider gives me a modem/router to use for their service. I have tried to make my computer as secure as possible. Every time I run any kind of online security scanner it tells me everything looks great except that telnet port 23 is open. I have gone in and manually closed this port and configured my firewall to block this port yet it remains open. The only thing I can figure is that it is open on the modem so my provider can dial in to check when I am having connection problems.

My question is this...how much of a risk does this pose? I am running Win XP Pro with Norton A/V and firewall. I also have a linksys wireless router with ssid broadcast disabled, WEP encryption enabled with 128 bit encryption going, changed all the user id/passwords, MAC filter enabled and configured the router to only allow 1 connection...me.

So as I was saying...just how much of a risk is involved with my dsl modem still allowing telnet connections to itself?

Most likely your DSL modem is a bridge and not a router..a dumb device that does not need
an IP address (layer 2 device) but probably is assigned one by your ISP for management purposes. Im assuming your ISP was smart enough not to assign it a default gateway.
This way no one other than your provider who is connected on same datalink can access device. No one else on internet can, because DSL modem/bridge w/o a gateway does not know how to respond back to an address on diff subnet than itself..(TCP/IP 101)

If it is a router, thats not good. put a firewall behind it and secure yourself.
You should try and attempt to scan from the outside and see if you DSL modem responds..

Because If it does, it can be compromised (passwrd crack tool) and or brought down
(DoS attack)..

Good Luck...

As stated previously. When running online port scanners such as the ones at dslreports.com and grc.com they claim port 23 is open. I can only assume that it is the dsl modem responding since I have closed the port on my computer and configured the firewall to block it also.

My next question to you is ,
Do you have a DSL router or DSL bridge?
This depends on ISP and customers preference.

Im assuming you have residential DSL where your ISP
provides you with a DHCP dynamic address versus a static one.


I also forgot to ask you before, how did you know what IP to scan for?


Because this is the case you can easily figure out what type of DTE
device you have, check the IP configs of your PC, if it is a public address then
your DSL Modem is most likely a bridge, and if its a private address then it is a router..

If your not sure which is which, any address other than the following means it is public
10.x.x.x
172.16.x.x-172.31.x.x
192.168.x.x

P.S.
Sorry its late and havent slept for 2 days, power outage kept me busy working with clients..
the statement

"I also forgot to ask you before, how did you know what IP to scan for? "
shouldof been ate end of reply not in middle ....

It is a router, I never said it was a bridge.
My computer has a private ip address.
Yes I have a dynamic address...not static.
Some of the sites that do the port scans have tools that show the current ip address.

ipconfig just returns the private ip of my computer.

edit: I also have a couple downloaded programs that will show my current ip address.

gunit was just thinking that it might of been a bridge from the information supplied.

Since this is a router we are talking about here, and your telnet port is open, you might try to forward the port. This is if your router supports this. For an example though, you would log into your router and go the the port forwarding section from there you forward port 23 to port 23 but for the IP put in a IP that would never be assigned to one of your comptuers.

On my network I have port 113 forwarded to 192.168.1.50. I only have three computers on my network so I'll never have that IP. By doing that, if some attempts to connect to that port the packets will be dropped since there is no computer there.

Now it is 1 in the morning here so I might of gotten that wrong but maybe it will help you.

btw: If you wanto to know your IP go to www.whatismyip.com or www.ipchicken.com. Thats one of the ways.

Quote:

---

So as I was saying...just how much of a risk is involved with my dsl modem still allowing telnet connections to itself? [/B]

---

I guess it must be late. This was a security conjecture for feedback on the possible risks. I know I have a dsl router...not a bridge. I am not trying to find out my IP address. I have a very good computer/firewall/router setup that is well updated and patched. I have a wireless router between my computer and the dsl router...also as well configured as possible. (Also with a different IP than my computer or the dsl router...and no...not the standard 192.168.1... as most people use.)

I was merely wondering about the risks involved with the dsl router allowing telnet connections...such as the possibility of someone hijacking my internet connection. Any info would be appreciated.

I think I know what you are asking here....

If the port is open and listening, then yes, there is a possibility that someone can connect and gain access to the device. Most DSL modems have port 23 open for remote management by you or your ISP. Once more, the device itself probably has it's own tcp/ip stack and who knows how solid it is. Remember, stack implementations vary by manufacturer.

Knowing this, and that you have a linksys device behind it, I'd say that your internal network is fine because they would have to first get past the DSL modem and *then* past the linksys router. On top of that, you have a personal firewall on each PC so I'd say you've done exactly what a home user should do to stay secure.

My best guess is that someone could wipe you off the net or make your DSL modem inoperable by changing all the settings once inside. If you want me to try, go ahead and PM me and I can tell you if the device is accepting connections.

Does that answer your question?

--TH13

Yes it does, and thank you very much. I figured that I was fairly secure with my setup the way it is. I highly doubt that my isp would allow me to change the settings on the dsl router since "its their equipment."

Thanks for the help. ;)

Quote:

---

On my network I have port 113 forwarded to 192.168.1.50. I only have three computers on my network so I'll never have that IP. By doing that, if some attempts to connect to that port the packets will be dropped since there is no computer there.

---

I do this with my cisco router. I forward port 23 (which doesn't allow logins on the router) to machine 192.168.0.254 and port 80 (cisco web setup) to the same address. There will never be any machine at that address, so I don't have to worry about people trying to connect. I hope.

Does anyone know if it is possible to forge the packets to make it go to a different address? Or... is is safe to do this? Sorry to "hijack" your thread... but I think it fits in here.

Hiya Phishy....

No, this is a safe method of sending packets into limbo. You would have to trick the device into passing the packets to a different address which would mean that you would have to find a bug in the way that the device interprets and forwards traffic. Wait a minute, did you say Cisco?! Hmmmm.....LOL!! Seriously, this is ok.

:)

Ok, so if I forwarde port 23 to limbo how would this effect my isp's ability to log into the router for service? Would they still be able to log in or would they then have their connection dropped? Don't want to get myself into trouble with them. I can access the router since one of the techs told me the passwords when I called for support once.

if the router has been configured by your isp then i have serios doubts about its security. make sure the login isn't somthing simple like admin : admin or " " : admin. check for the default password of your router and make sure they changed it. your isp may be quite upstanding but you can never be sure the person that configured it was being diligent at that moment.

You may want to scan 127.0.0.1 , then scan your ip address. If it's your modem or your computer, it's both bad. You wouldn't want anyone to be able to log in to your modem and redirect all your traffic to them. Also, if it's on your computer, and you didn't already know it, then that's sure to be bad news. Certainly you'll want to find out what's listening to the port. You best tool in this case would be nmap, and it can give you a good idea of what's listening and you can choose a better course of action.


--PuRe

Quick question

What banner/reply do you get if you actually telnet to it ?

This might tell you a lot.

If I were you I would forward the port to a bogus IP. If they don't like that then they'll call you. The only thing you were doing was trying to improve your security. If they don't like it just change it back.

Just want to point out amorphous, the fact that you have your own router that you manage
behind the DSl router, hardened and secured as you stated is enough to not be concerned about what ports are open on the DSL router..

Who cares what ports are open.
Think of the DSL router as a device at the ISP/s premises and your router connected to it via an ethernet connection. What your ISP does unfortunaltely is beyond our control...

Its not your router and you do not manage it. Otherwise you would start worrying about all the other routers and their weeknesses that your ISP manages beyond the DSL router.

I guess were I'm really aiming with this is whether or not they could take over and use my connection through this service. I don't know if its possible or not... I might be being paranoid for nothing. Is it possible that if someone could telnet into my router could they then use my connection to perform some illegal activity say try and hack a government facility? If so...then who would the authorities come looking for? My isp since it is their router...or me since the hack originated from my router? Or do they have to "hack" into my computer and make my computer do the actual deed versus just using my connection?

It is a good to be concerned since the IP assigned to DSL router is designated to you
and you fear that a malicious attack from that source may point back to you..

However, lets think about what someone may be capable of doing if they were able to telnet to your DSL router (basically "sit" inside it)

From what i can see, they can only bring your DSL router "down" . See the problem here the perpetrator will encounter is that all the tools he would like to use are on his/her pc..when telnetted to your router, his command prompt is the DSL router..He is limited to commands he can initiate from router OS...

Unless someone knows of ways to compromise a server/router/etc from a DSL router,
which is running most likely static or default route back to ISP, then I do not see anything to worry about other than if your DSL router is compromised, your internet access can be rendered inactive.

Thanks. :)