CZ.NIC runs honeypot servers that are connected to the internet as part of its security analysis. When the organization began the honeypots, its main goal was a SSH investigation. Researchers thought the Telnet ports were going to be a more complimentary and less important protocol feature.

Apples to Oranges

CZ.NIC was surprised to discover that the traffic it drew to the Telnet honeypots was three orders of magnitude higher than the traffic drawn to SSH honeypot servers. But it’s difficult to compare Telnet and SSH, since they work so differently. The researchers described it as an “apples-to-oranges issue” on the CZ.NIC blog.

“The huge difference is obvious and is also visible in other aspects, such as in the number of unique attacker IP addresses,” the blog said.

The honeypot data illustrated a sharp increase in attacks against Telnet ports that started around the end of May 2016. The number of unique attackers increased from 40,000 IP addresses per day to around 120,000 in June. That figure deflated back to 40,000 unique attacks toward the end of August, the firm noted.

Attacking Telnet Ports Via DVR Installations

CZ.NIC scrutinized the original IP addresses involved in the attacks and determined that many were located in China, Vietnam, Taiwan, Russia, South Korea, the Philippines, Brazil, Turkey, India and the U.S., Softpedia reported.

But the researchers then went a step further: They used Shodan to find out what those attacking IP addresses resolved to. Surprisingly, the researchers found that most of the IPs came from connected devices, such as routers, CCTV cameras, DVRs and other devices that came equipped with some kind of embedded web server.

Most of the devices identified were already known to have security vulnerabilities. This is probably what the botnet organizers used to gain control of the device.

This research is consistent with the recent Level 3 report that identified the vulnerability of certain white-label DVR installations to remote threats. Over 30 percent of the Telnet attacks CZ.NIC observed originated from these devices.