Shodan: The scariest search engine on the Internet

http://money.cnn.com/2013/04/08/technology/security/shodan/

by cpeterso • 13 years ago

504 144 13 years ago

money.cnn.com

speeder2• 13 years ago

I wonder, why noone turned off traffic lights or something like that to do mischief?

Also, why no terrorist yet used those security failures to do terror?

Once a random dude managed to log into ISS controls... Ever wondered what happens if some terrorist crash ISS into New York?

cleverjake• 13 years ago

just because there is an html page being served doesn't mean you can access the control systems.

you're also assuming no one has done it - I have no idea wether or not someone has used shodan for malicious purposes, but that certainly doesn't mean it hasn't happened.

thedrbrian• 13 years ago

No because the ISS would burn up way before it hit the ground.

chm2• 13 years ago

There would be debris hitting the Earth. It's too big to completely burn I think.

leethax0r• 13 years ago

I don't think you could crash the ISS into New York. I don't even think that's possible. It doesn't have the engines necessary to get back to the surface.

speeder2• 13 years ago

Getting down is way easier than getting up.

ISS has some engines, crashing on earth is very simple, you can just thrust in the opposite direction that you are going (thus falling into the planet, although slowly and probably astronauts can find the attacker and put it back into orbit before anything serious happens) or you can trust in a diagonal of sorts, to slow your speed AND toward the planet (if you just accelerate toward the planet is more probably that you will only create a elongated orbit, and if you insist, you will slingshot out of orbit).

GFischer• 13 years ago

At least over here, traffic lights fail and turn off on their own, no need for hackers :) . Now, fixing them (for example setting up a "green wave"... hmm that could be a more interesting use :)

http://en.wikipedia.org/wiki/Green_wave

VLM2• 13 years ago

I'd like to see the local lights reprogrammed to follow the legal guidelines instead of short yellows to maximize traffic ticket revenues.

kens2• 13 years ago

I read a novel in the late 1970s where a "hacker" breaks into a city's computer system and messes with traffic lights - does anyone remember the title? In the novel, the modified traffic light timing kills some joyriding teens who blow through an intersection counting on the light to stay green. At the climax of the book, the villain tries to kill off the protagonists by electronically locking the data center doors and triggering the CO₂ fire suppression system. Does anyone else remember this book? Was this "The Terminal Man" or am I mixing up two books?

kens2• 13 years ago

Just in case anyone ends up here, the book I was thinking of turns out to be the rather obscure novel "Intruder" by Charbonneau from 1979.

More info on the book: https://www.kirkusreviews.com/book-reviews/louis-charbonneau...

anigbrowl• 13 years ago

+1 for the System Shock reference :)

http://en.wikipedia.org/wiki/System_Shock

aidos• 13 years ago

Man, I found that game to be _very_ bad for my nerves in the 90s.

hp50g• 13 years ago

Me too. Scary game. Nothing else has come near to it.

As a tribute, my workstation and laptop are names xerxes and shodan.

gtaylor• 13 years ago

Gah, still get creeped out watching the System Shock 2 intro.

http://www.youtube.com/watch?v=MXPn6wcsUmk

Let's hope this Shodan isn't as intelligent and psycho as System Shock 2 Shodan! Oh, and no zombies.

notjustanymike• 13 years ago

"Lo- lo- lo- look at you hacker.."

I've beaten this game at least 4 times, including co-op a couple times. Such a great piece of gaming history.

mortenjorck• 13 years ago

Disappointing, though, that the CNN writer didn't manage to suss out the project's apt namesake.

barbs• 13 years ago

Gog.com recently released it for new systems: http://www.gog.com/gamecard/system_shock_2

Apparently it works well under wine, too.

eru3• 13 years ago

It sort-of worked under wine for some graphics cards.

If you can get it to run, you should check out the Thief games as well. They use the same engine.

jstanley• 13 years ago

This is incredible! Unfortunately, Shodan itself appears to be down at the moment, presumably due to traffic from CNN. Awesome nonetheless.

tsahyt• 13 years ago

I'm giving it a shot right now. It's not down, but very slow. Site's been loading for two minutes now.

jcfrei• 13 years ago

could anyone register for a new account? all I get is a 405 not allowed.

achillean10• 13 years ago

That problem has been fixed! I made an error in configuring nginx for memcached and it ended up treating certain pages as static (which prevents them from getting POST requests).

achillean10• 13 years ago

It's fully up and running again after hours of putting out fires :)

tptacek3• 13 years ago

Eagerly awaiting the moment someone at CNN finds out about Metasploit. I'd like to think of it as a kind of "Dark Firefox".

larrys3• 13 years ago

Love this:

http://www.metasploit.com/about/penetration-testing-basics/

"You can become a penetration tester at home by testing your own server and later make a career out of it."

Sounds like the old style correspondence school ads - a bit hokey.

http://www.thefreedictionary.com/correspondence+school

I would have rewritten that as:

"Many people have actually made a career out of being a penetration tester by first testing their own home server"

tptacek3• 13 years ago

You can absolutely learn to do penetration testing on your own time with your own servers. We have a script we give people to do the same thing. If you feel like you have a knack for systems programming, being a good systems programmer is 1/2 the hard part of appsec; the other 1/2 is literally "taking pleasure in finding creative ways to break things", and you can find out if you have that personality streak in just a couple hours of trying attacks.

brightsize• 13 years ago

http://gogd.tjs-labs.com/show-picture?id=1160663127&size...

"By and large, Management agrees that there is but one adequate solution to the problem ... a solution that can be applied only by Management itself."

kmfrk2• 13 years ago

I think Firesheep is more of a "Dark Firefox".

Apocryphon• 13 years ago

"Shodan searchers have found control systems for a water park, a gas station, a hotel wine cooler and a crematorium. Cybersecurity researchers have even located command and control systems for nuclear power plants and a particle-accelerating cyclotron by using Shodan."

How can there be any conceivable reason to connect these systems to the internet? Do they WANT an attack right out of a technothriller novel or the latest James Bond film?

alecdibble• 13 years ago

Many embedded systems run Linux and are frequently attached to the netword for remote control. The root passwords aren't usually changed on these Linux boxes, so they are a wide open security hole.

Many companies pay attention to this sort of thing and make an effort to isolate these kind of devices to the local intranet. For every company that is it good about it, there are probably 10 that aren't even aware of the issue.

ari_elle2• 13 years ago

mhm sorry as i don't know so much about this, but how is this different from google?

meaning that with a specific search in google i can find for example all kinds of cameras or systems one shouldn't find, e.g.:

-) http://preview.tinyurl.com/34959u

Maybe Shodan "focuses" on that, but they can't possible index more of those things than Google already has...

Can you find one single thing over Shodan you can't with a specific Google search? (maybe you find such things more easily with Shodan...)

EDIT: More information on Shodan:

-) Defcon Presentation [pdf]

https://www.defcon.org/images/defcon-18/dc-18-presentations/...

-) Secanalysis.com

http://secanalysis.com/a-brief-analysis-of-shodan/

JoshuaRedmond beneath also provided interesting links

IheartApplesDix• 13 years ago

Crazy idea, if you don't know what you're talking about, shut the hell up.

joshgel• 13 years ago

Or ask an informed group of readers for clarification?

ari_elle2• 13 years ago

it was an honest question and i don't think your reaction is appropriate behaviour for this site.

If most think my comment is worthless, the voting system will make it enter the void. If others think it isn't it will be upvoted. That's how this site works.

Just responding with "Shut up" adds nothing to the discussion and is something i am shocked to see on this site :(

easytiger• 13 years ago

actually people have been posting google searches to find exposed home ip camera systems and the like for years.

marknutter• 13 years ago

Dude, what the heck?

btilly2• 13 years ago

I used to be able to tell people like you to go back to Reddit. Unfortunately the quality of HN has declined far enough that your content-free insulting of a decent question is not immediately recognizable as something with no place here.

I consider that fact a sad commentary on how far HN has fallen.

JoshuaRedmond• 13 years ago

I'm not an expert in it by all means, but from what I've seen it is like having Google log all the http headers and servers connected to requested as well. This means that it is incredibly easy to, for example, track down certain servers with a certain exploit that you know about [1], or complete systems that shouldn't really be attached to the internet in their current state [2]. Not sure either of those are possible with Google.

[1] http://erratasec.blogspot.co.uk/2009/12/shodan-scares-me.htm...

[2] http://www.zdnet.com/blog/security/shodan-search-exposes-ins...

tlrobinson• 13 years ago

I could be wrong, but I believe Shodan actually portscans the entire internet, whereas Google only crawls known URLs. They also index HTTP headers, which Google doesn't do.

It's run by our very own achillean: https://news.ycombinator.com/threads?id=achillean

lt• 13 years ago

Sounds like they also attempt to authenticate using default user/pass combos.

pseut2• 13 years ago

Presumably Shodan ignores robots.txt, right?

vidarh• 13 years ago

A "bad" search engine should treat robots.txt pretty much in reverse: Anything disallowed should go to the top of the list of things to index.. There are sites out there that uses robots.txt rules to prevent Google from indexing things that should be password protected but isn't...

achillean10• 13 years ago

I don't crawl for URLs so it doesn't really factor into the equation for me.

rammark• 13 years ago

Here's an example from early 2012 that I don't think would have been possible with Google:

http://console-cowboys.blogspot.com/2012/01/trendnet-cameras...

nnq• 13 years ago

...followed the first link and finally learned what people use java applets for :)

djcapelis3• 13 years ago

> Can you find one single thing over Shodan you can't with a specific Google search?

The entire rest of the Internet? Google is great at crawling HTTP and HTTPS, but the Internet is more than the web.

chm2• 13 years ago

Hardware manufacturers should ship their devices with a piece of paper printed with a unique UID and password. Not "admin/1234".

The owner would have the ability to change these at will, and resets would revert to the original UID/pw combination.

Lost your piece of paper? Send the device back. No more trivial hacks.

afreak2• 13 years ago

That would make the devices more costly to produce and would raise prices. I know that ISPs do this with their devices sometimes, but some companies will cheap out and will just ship with a generic username and password since they only have to flash one single ROM image.

ippisl• 13 years ago

They can flash a single ROM image, create a random password on the device , and just by adding a led , they communicate said password to a mobile app, when needed.

r00fus• 13 years ago

It shouldn't really. I mean, it's not like devices don't come with at least 3 or 4 unique IDs for different purposes. Just using one of those for the default password or adding a new ID shouldn't be that big of a task.

I know that this is how some of the router/modem combos from french DSL providers worked - the admin and WPA passwords are two seperate UUIDs printed on the device.

bernardom• 13 years ago

My Netgear Router N600 does exactly that. There's a nice laminated sticker on the bottom with the admin password.

windexh8er2• 13 years ago

Most of those types are some sort of hash of the MAC which are quickly reversed. A quick search will contain many fruitful examples. How else do you think the default password ends up the same on a system reset?

windexh8er2• 13 years ago

Good luck with that model. There are many better ways to approach this via things like captive portal that does good enforcement of the user setting good parameters up front before just plugging and playing. The vendors should not allow any Internet access until the device is secured appropriately or the user acknowledges insecure defaults.

D9u3• 13 years ago

More sensationalistic headlines? Shodan is nothing new, and I find nothing "scary" about it.

aashaykumar92• 13 years ago

This is awesome, I never knew such a thing existed! But it's also quite alarming that so many devices are connected to the internet/computers that probably shouldn't be.

So my big question is: Is there a way to solve this 'security failure'? And if so, what is it/is it feasible? For someone with malintentions, Shodan seems to be golden.

justincormack3• 13 years ago

It used to be fairly costless to ship products without security. It still is but the more attacks there are the more incentive there is to fix stuff. But there are so many more online devices shipping...

smacktoward2• 13 years ago

Part of the problem too is that when a particular product is compromised, most people stop at "Product X sucks" and don't ask themselves if the same vulnerabilities are present in products they themselves use.

As an example, take WordPress. I talk to people all the time who say "oh, WordPress isn't secure" even though the reasons most WordPress sites get hacked are due to practices that would make you vulnerable no matter what CMS you run -- not keeping up with security patches, running unneeded services on the server, not putting the admin area behind SSL, etc. But there's lots of people who move from WP to, say, Drupal and think that's made them secure, even as they continue doing all those same practices.

dmiladinov2• 13 years ago

For similar coverage about finding barely-secured devices that shouldn't have ever even been connected to the Internet, check out the Security Now! podcast, episode 396 - The Telnet-pocalypse:

http://www.grc.com/securitynow.htm

Transcripts are available in several formats:

http://www.grc.com/sn/sn-396.htm

http://www.grc.com/sn/sn-396.txt

http://www.grc.com/sn/sn-396.pdf

rocky1138• 13 years ago

OT: CNN broke the back button in Chrome on Windows.

dsfasfasf2• 13 years ago

I could be wrong but the article reads like a paid for PR piece[1] to get publicity for this search engine.

[1] http://www.paulgraham.com/submarine.html

MWil• 13 years ago

which brings up the legal question (based on the ATT 3 year jail sentence):

When is a admin/password login not acting as a admin/password login at all?

vecinu2• 13 years ago

But he added that cybercriminals typically have access to botnets -- large collections of infected computers -- that are able to achieve the same task without detection.

What do botnets have to do with crawling the web for unsecured devices? I'm not sure I understand the correlation.

AnIrishDuck• 13 years ago

The article is full of technical misconceptions, but if I had to guess:

1) Botnets give you a ton of bandwidth to run port scans or crawling searches.

2) They also allow you to "map" port scans or searches over thousands of computers (e.g. one computer in the botnet scans one specific port times ten thousand ports), obscuring the fact that a scan is even occurring.

dmiladinov2• 13 years ago

I think it's because you can use botnets to divide up the vast IPv4 search space among the individual bots and crawl it exponentially faster.

Houshalter• 13 years ago

Exponentially?

laumars2• 13 years ago

Funny enough that question was answered in a rather public way just a few weeks ago: https://news.ycombinator.com/item?id=5404642 (Researcher sets up illegal 420,000 node botnet for IPv4 Internet map)

vecinu2• 13 years ago

I did read this article a few weeks ago but seem to have forgotten its link to my question.

Thank you for the reminder.

Nowyouknow• 13 years ago

From Wikipedia: SHODAN (Sentient Hyper-Optimized Data Access Network) is a fictional artificial intelligence and the main antagonist of the cyberpunk-horror themed action role-playing video games System Shock and System Shock 2.

http://en.wikipedia.org/wiki/SHODAN

Kinda cool they chose that name.

bifrost2• 13 years ago

They also missed ERIPP, which does something similar. This is all old news though, these things are constantly mentioned in other security reports. Even the government knows these things exist, which means that CNN is not scouping anyone :)

achillean10• 13 years ago

ERIPP is cool (I spoke to the author years ago), but to my knowledge it hasn't been updated in a while. And I cover 20+ services at the moment, so it's not just HTTP.

bifrost2• 13 years ago

ERIPP v2 coming out in a (maybe) few weeks, and even though its current data is oooooold its been written up in the last month or two.

In general, It is pretty humorous that these things still catch people by surprise :)

DangerousPie• 13 years ago

" The good news is that Shodan is almost exclusively used for good.

Matherly, who completed Shodan more than three years ago as a pet project, has limited searches to just 10 results without an account, and 50 with an account. If you want to see everything Shodan has to offer, Matherly requires more information about what you're hoping to achieve -- and a payment. "

How does the fact that he charges for it mean that it's "almost exclusively used for good"? I would argue there is very little incentive to pay for something like this unless there is a monetary gain.

NegativeK• 13 years ago

I seem to remember Matherly saying that he charged larger institutions who need lots of data for legit research. He also (as of a year and a half ago) said that he was basically breaking even.

I guess a university security researcher is looking for monetary gain in the form of grants, though.

achillean10• 13 years ago

Actually, a lot of companies use Shodan data for research! For example, if you want a training set for your new webapp fingerprinting software then loading Shodan might be a good start. Or if you want to create whitepapers for your business, to drive sales for a specific product/ service, then Shodan can provide some empirical data to back up your claims. As was demonstrated with the Internet Census 2012, for people with bad intentions it's easier and much less attention-getting to just use a botnet (plus you don't need to go through the typical business agreements as you would with me). I hope that clarifies it a bit!

neeee• 13 years ago

http://youtu.be/5cWck_xcH64 is a really good presentation about what you can find on shodan.

IgorPartola• 13 years ago

Looks like it's down: http://imgur.com/TqeYX95

Wonder if that's just because of the publicity, or is someone DoS'ing them.

achillean10• 13 years ago

It's a variety of factors that is causing downtime at the moment. The main culprit is the network itself at the moment, and I'm still trying to put out fires to hopefully make the website a bit more stable.

tibbon• 13 years ago

Even scarier is how fast their servers fall over :)

svag• 13 years ago

A nice article regarding the deep web is this one from fravia http://search.lores.eu/deepweb_searching.htm. It's from 2008 but I guess there is still some information there that is useful and relevant with Shodan.

bobx11• 13 years ago

Authorization is hard, so why bother doing it at all?

achillean10• 13 years ago

I apologize for the downtime/ delays, this was a big surprise this morning and I clearly wasn't prepared for the full on-slaught of CNN etc. If you have any questions about Shodan I can try to answer them here.

_pctq• 13 years ago

It would kill your business eventually so it may me a naive question but : do you need volunteer work to help identify and warn those insecure networks ?

lucb1e• 13 years ago

I guess you should feel free to do so. It takes away lots of fun for highschoolers though :P

achillean10• 13 years ago

Yes, I encourage security researchers to always notify the relevant network operators/ authorities if they make an interesting discovery. And that data is always provided for free to agencies such as the CERT. At the end of the day I would like to think that Shodan helps make the Internet a safer place by having smarter people than me find critical infrastructure, and then notifying the operators so things can get fixed. There will always be security issues as long as people are deploying them, so I'm not worried about Shodan becoming obsolete.

_b8r02• 13 years ago

I've been playing with the data from the Carna botnet output[1]. Basically someone scanned a massive portion of the Internet using broken routers as bots. There's some interesting finds in the data but analysing it is quite awkward given the size. Shodan is interesting but unless you take up a subscription is pretty limited.

[1] http://internetcensus2012.bitbucket.org/paper.html

achillean10• 13 years ago

Actually, more than 90% of the website's services are completely free! There are only 2 services that I charge for: HTTPS and Telnet. All of the new stuff for the past year I've added and made available for free. And with the Developer API you can easily access the data from within your own scripts.

Oh, and I've seen this in a few locations now but: NO SUBSCRIPTION REQUIRED. All of the stuff that's sold on the website is a one-time charge. There are no subscriptions on the website :)

_b8r02• 13 years ago

That's interesting and I stand corrected, I was under the impression for some reason that subscriptions existed. As an aside, have you had a look at the Carna botnet output, and if so how does it compare to your data?

Shodan: The scariest search engine on the Internet

Related Stories