Telnet security risk

[Jerome Draper <jdraper@xxxxxxx>]

I got this today and thought to share it.  

From :

*************************** NEWSWire/400 ***************************
A NEWS/400 Publication                   http://www.as400network.com
Issue 217                                              April 4, 2000


TECH TIP: TELNET SECURITY HOLE
http://www.as400network.com/nwn/story.cfm?ID=7051
Q. Our new network engineer used sniffer software to watch me log on 
to the AS/400. When I logged on with Client Access, he saw my user ID 
only. However, when I connected to the AS/400 via Telnet (from the 
Windows Start/Run menu), he saw my user ID and password. Is this a 
known risk?

A. You've discovered something every hacker knows: Telnet and FTP 
user IDs and passwords and, in fact, all data sent via these 
protocols, are unencrypted and thus open to snoopers. If you're 
accessing your system over the Internet, that information can be (and 
likely is) intercepted by hackers, who can then gain access to your 
computer.

If you use Telnet or FTP (or another unencrypted protocol), you 
should ensure that these methods aren't used to access sensitive 
information across the Internet.

On a LAN, it's important to use Ethernet switches, rather than hubs, 
exclusively. Doing so avoids indiscriminate broadcasting of traffic 
to all LAN nodes, thus preventing users from capturing passwords with 
a sniffer. (Sniffer programs are freely available on the Internet and 
can turn any computer -- Mac, PC, or Unix system -- into a network 
snoop tool.)
-- Mel Beckman, NEWS/400 Senior Tech Editor


Jerry Draper, Trilobyte Software Systems, since 1976
Specializing in connecting PC's, Windows, MAC's, and LAN's to the AS/400
Representing Synapse, Apple, UDS, Nlynx, Perle, Lucent, etc.
(415) 457-3431; (415) 258-1658fax; jdraper@wco.com
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---