You may have seen the recent news that Telnet traffic from major US ISPs dropped precipitously around the time that a CVE against GNU Inetutils was announced. Because this report has led to intense discussion around the role of core network infrastructure providers and implications for the security of network services globally, we at Terrace felt it was important to share our results and correct the record. After analyzing both our internal and open data, we believe there are critical errors that undermine the basic findings of the report.
The original report shows the number of Telnet sessions observed from GreyNoise across many source autonomous systems (ASes) by day. Their data show a dramatic shift in observed network traffic:
a sudden, sustained collapse in global telnet traffic — not a gradual decline, not scanner attrition, not a data pipeline problem, but a step function. One hour, ~74,000 sessions. The next, ~22,000. By the following hour, we were down to ~11,000 and the floor held. (Link)
We cross-checked this data against traffic observed by Terrace, other open observation data, and measurements of underlying routing infrastructure through RIPE Atlas. In sum, our results show that there is no new filtering of Telnet being performed by core ISPs. To be clear, we successfully performed Telnet traceroutes from reportedly-affected ASes to our servers as of today at 18:47 UTC.
Naturally, seeing such a dramatic and coordinated drop in traffic (from 10s of thousands down to zero) would make you suspect that the network is the common factor. As we describe below, the fundamental flaw of this approach is that sessions can be highly correlated: thousands of scans from disparate networks can be directly tied to individual noisy actions.
At Terrace we use artificial intelligence to detect trends from our global deployment of network sensors in real-time, so when we saw this our first thought was “how could we have missed this?” We went to the data, and as far as we can tell, the answer is that we didn’t.
We cross-checked ASes reported by GreyNoise against port 23 scanning data from Terrace. Of course, we filtered these to only incoming traffic that successfully completed the three-way TCP handshake to factor out IP spoofing. Here are those results: