RE: (atl: Legitimate uses) RE: Echo off in IO::Sockets

[Ozymandias]

There are certainly legitimate uses for a telnet client, server, or wrapper. However, that's not what this person asked for. They want a "fake telnet client" that will take the username and password, then give a false error message and log the username and password.

I have yet to hear of a single legitimate use for such a program. I can think of only one purpose; to log usernames and passwords without user knowledge. A legitimate administrator has no need for such tools; in *nix, this information can be logged, while in Windows, the administrator can determine the user passwords with ease.

So, then - under what circumstances does this become a legitimate use?

- email Ozymandias

[atl]

A legitimate use is hard to find here, I admit. The only one I can think of is to actually write this fake client so you can demonstrate the people they have a problem. But that sounds a bit far fetched, even to me.

By now, I thought our friend GoRN would have found time to post a reasonable explanation himself, which he/she didn't, so I am more willing to follow your interpretation of his/her intents. What makes me wonder is, should the intent really be to create a password stealing telnet, why not cloak this request with something harmless like "I want to write a new MUD client ..." or something like that? Would have gone through easily ...

Well, you never know. Letīs hope the admins close the security hole in the first place, 'cause our young friend is certainly not alone out there.

Andreas

[isotope]

This is probably a stretch, but it could be used as a honeypot that not only keeps a script kiddie busy, but also gives the administrator some idea of what kind of attack is being attempted (raw brute force, dictionary attack, etc). That being said, I also feel uneasy about the original question. Just my thoughts...

[Ozymandias]

I thought about that, but if it were to be used as a honeypot security system, it would be reasonable to log the hostname and username - not the password.
- email Ozymandias

[isotope]

Like I said, logging the password would give the sysadmin a better idea of what kind of attack is underway -- are the passwords just incremental alphanumerics, or a dictionary list, or a list of usernames? Does it look like the work of a well-known rootkit? Things like that...