Jump to content

Shodan (website): Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
→Recent News: Analysis published by CSO Online on Shodan.
Line 31: Line 31:


In September 2013, Shodan was referenced in a [[Forbes]] article claiming it was used in order to find the security flaws in [[In the Matter of TRENDnet, Inc.|TRENDnet]] security cameras.<ref>{{cite web|last=Hill|first=Kashmir|title=Camera Company That Let Hackers Spy On Naked Customers Ordered By FTC To Get Its Security Act Together|url=http://www.forbes.com/sites/kashmirhill/2013/09/04/camera-company-that-let-hackers-spy-on-naked-customers-ordered-by-ftc-to-get-its-security-act-together/|accessdate=2013-10-17}}</ref> The next day, Forbes followed up with a second article talking about the types of things that can be found using Shodan. This included [[Caterpillar Inc.|Caterpillar]] trucks whose onboard monitoring systems were accessible, heating and security control systems for banks, universities, and corporate giants, surveillance cameras, and fetal heart monitors.<ref>{{cite web|last=Hill|first=Kashmir|title=The Crazy Things A Savvy Shodan Searcher Can Find Exposed On The Internet|url=http://www.forbes.com/sites/kashmirhill/2013/09/05/the-crazy-things-a-savvy-shodan-searcher-can-find-exposed-on-the-internet/|accessdate=2013-10-17}}</ref>
In September 2013, Shodan was referenced in a [[Forbes]] article claiming it was used in order to find the security flaws in [[In the Matter of TRENDnet, Inc.|TRENDnet]] security cameras.<ref>{{cite web|last=Hill|first=Kashmir|title=Camera Company That Let Hackers Spy On Naked Customers Ordered By FTC To Get Its Security Act Together|url=http://www.forbes.com/sites/kashmirhill/2013/09/04/camera-company-that-let-hackers-spy-on-naked-customers-ordered-by-ftc-to-get-its-security-act-together/|accessdate=2013-10-17}}</ref> The next day, Forbes followed up with a second article talking about the types of things that can be found using Shodan. This included [[Caterpillar Inc.|Caterpillar]] trucks whose onboard monitoring systems were accessible, heating and security control systems for banks, universities, and corporate giants, surveillance cameras, and fetal heart monitors.<ref>{{cite web|last=Hill|first=Kashmir|title=The Crazy Things A Savvy Shodan Searcher Can Find Exposed On The Internet|url=http://www.forbes.com/sites/kashmirhill/2013/09/05/the-crazy-things-a-savvy-shodan-searcher-can-find-exposed-on-the-internet/|accessdate=2013-10-17}}</ref>

In January 2015, Shodan was discussed in a CSO Online article<ref>{{cite web|title=Shodan exposes IoT vulnerabilities|url=http://www.csoonline.com/article/2867407/network-security/shodan-exposes-iot-vulnerabilities.html|accessdate=2015-01-13}}</ref> addressing its pros and cons. According to one opinion, presented in the article as that of ''Hagai Bar-El'', Shodan actually gives the public a good service, although it highlights vulnerable devices. This perspective is also described in one of his essays<ref>{{cite web|title=Shodan makes us all more secure|url=https://www.hbarel.com/analysis/policy/shodan-makes-us-more-secure|accessdate=2015-01-13}}</ref>.


==Usage==
==Usage==

Revision as of 20:07, 16 January 2015

Shodan
Type of site
search engine
Available inEnglish
Created byJohn Matherly
URLwww.shodan.io
RegistrationOptional
Launched2009 (2009)
Current statusActive

Shodan is a search engine that lets the user find specific types of computers (routers, servers, etc.) connected to the internet using a variety of filters. Some have also described it as a search engine of service banners, which are meta-data the server sends back to the client.[1] This can be information about the server software, what options the service supports, a welcome message or anything else that the client can find out before interacting with the server.

Shodan collects data mostly on web servers at the moment (HTTP port 80), but there is also some data from FTP (21), SSH (22) Telnet (23), SNMP (161) and SIP (5060) services.[2]

It was launched in 2009 by computer programmer John Matherly, who, in 2003,[3] conceived the idea of searching devices linked to the Internet.[4] The name Shodan is a reference to SHODAN, a character from the System Shock video game series.[3]

Background

The website began as Matherly's pet project, based on the fact that large numbers of devices and computer systems are connected to the Internet. Shodan users are able to find systems including traffic lights, security cameras, home heating systems as well as control systems for water parks, gas stations, water plants, power grids, nuclear power plants and particle-accelerating cyclotrons;[citation needed] most have little security.[4][5] Many devices use "admin" as their user name and "1234" as their password, and the only software required to connect them is a web browser.[5]

Recent News

In May 2013, CNN Money released an article detailing how SHODAN can be used to find dangerous systems on the Internet, including traffic light controls. They show screenshots of those systems, which literally provided the warning banner "DEATH MAY OCCUR !!!" upon connecting.[6]

In September 2013, Shodan was referenced in a Forbes article claiming it was used in order to find the security flaws in TRENDnet security cameras.[7] The next day, Forbes followed up with a second article talking about the types of things that can be found using Shodan. This included Caterpillar trucks whose onboard monitoring systems were accessible, heating and security control systems for banks, universities, and corporate giants, surveillance cameras, and fetal heart monitors.[8]

In January 2015, Shodan was discussed in a CSO Online article[9] addressing its pros and cons. According to one opinion, presented in the article as that of Hagai Bar-El, Shodan actually gives the public a good service, although it highlights vulnerable devices. This perspective is also described in one of his essays[10].

Usage

The website crawls the Internet for publicly accessible devices, concentrating on SCADA (supervisory control and data acquisition) systems.[11] Shodan currently returns 10 results to users without an account and 50 to those with one. If users want to remove the restriction, they are required to provide a reason and pay a fee.[5] The primary users of Shodan are cybersecurity professionals, researchers and law enforcement agencies. While cybercriminals can also use the website, some typically have access to botnets that could accomplish the same task without detection.[5]

Automated Search Tools


SHODAN Diggity - Provides a free, easy-to-use scanning interface to the SHODAN search engine.

Bulk searching and processing of SHODAN queries can be performed using SHODAN Diggity[12][13] (part of SearchDiggity, Bishop Fox's free search engine attack tool suite). The free tool provides an easy-to-use scanning interface to the popular hacking search engine via the SHODAN API.[14]   

SHODAN Diggity comes equipped with convenient list of 167 search queries ready in a pre-made dictionary file, known as the SHODAN Hacking Database (SHDB).[13] This dictionary helps target various technologies including webcams, printers, VoIP devices, routers, switches, and even SCADA/Industrial Control Systems (ICS) to name just a few.


Ongoing Monitoring via RSS Feeds


SHODAN Hacking Alerts - Monitoring RSS Feeds in Reader

SHODAN Hacking Alerts - Creating RSS Feeds

SHODAN Hacking Alerts[15] are live vulnerability RSS feeds regularly pulling search results from the SHODAN search engine. Bishop Fox's free defensive tools incorporate SHODAN data into its defense alerts by utilizing the feature to turn SHODAN search results into RSS feeds by appending &feed=1 to common SHODAN query URLs. As an example: http://www.shodanhq.com/?q=Default+Password&feed=1

These free RSS alerts can be utilized to perform ongoing monitoring of SHODAN results for any new vulnerability exposures related to organizations. They are part of the free defensive tool suite of the Google Hacking Diggity Project,[16] which form a type of intrusion detection system for search engine hacking (including results from SHODAN, Google, Bing, etc.).


References

  1. ^ "SHODAN Help". SHODAN. Retrieved 21 June 2013.
  2. ^ "SHODAN FAQ". SHODAN. Retrieved 21 June 2013.
  3. ^ a b O’Harrow Jr, Robert (June 3, 2012). "Search engine exposes industrial-sized dangers". Sydney Morning Herald. Retrieved April 10, 2013.
  4. ^ a b O’Harrow Jr, Robert (June 3, 2012). "Cyber search engine Shodan exposes industrial control systems to new risks". Washington Post. Retrieved April 8, 2013.
  5. ^ a b c d Goldman, David (April 8, 2013). "Shodan: The scariest search engine on the Internet". CNN Money. Retrieved April 8, 2013.
  6. ^ Goldman, David (May 2, 2013). "Shodan finds the Internet's most dangerous spots". CNN Money. Retrieved June 21, 2013.
  7. ^ Hill, Kashmir. "Camera Company That Let Hackers Spy On Naked Customers Ordered By FTC To Get Its Security Act Together". Retrieved 2013-10-17.
  8. ^ Hill, Kashmir. "The Crazy Things A Savvy Shodan Searcher Can Find Exposed On The Internet". Retrieved 2013-10-17.
  9. ^ "Shodan exposes IoT vulnerabilities". Retrieved 2015-01-13.
  10. ^ "Shodan makes us all more secure". Retrieved 2015-01-13.
  11. ^ Brinkmann, Martin (April 9, 2013). "Shodan, a search engine for vulnerable Internet devices". ghacks.net. Retrieved April 9, 2013.
  12. ^ Brown, Francis; Ragan, Rob (29 July 2012). "Tenacious Diggity: Skinny Dippin' in a Sea of Bing". DEF CON 20.
  13. ^ a b "SHODAN Diggity". Bishop Fox. Retrieved 21 June 2013.
  14. ^ "SHODAN Developer API". SHODAN. Retrieved 21 June 2013.
  15. ^ "SHODAN Hacking Alerts". Bishop Fox. Retrieved 21 June 2013.
  16. ^ "Google Hacking Diggity Project". Bishop Fox. Retrieved 21 June 2013.
  • Shodan - Computer Search Engine - Main Site
  • SHODAN Diggity - part of SearchDiggity, the free search engine attack tool suite, which provides an easy-to-use scanning interface to the popular hacking search engine, using the SHODAN API. Allows for the quick bulk scanning and processing of results from the SHODAN search engine.
  • SHODAN Hacking Database (SHDB) - input dictionary file containing 167 queries that allow users to uncover interesting information via the SHODAN search engine. This dictionary helps target various technologies including webcams, printers, VoIP devices, routers, switches, and even SCADA/Industrial Control Systems (ICS), to name just a few.
  • DEF CON 20 (2012) – Tenacious Diggity – 29July2012 – Slides - introduction of the SHODAN Diggity tool within SearchDiggity, the free search engine attack tool suite.
  • Project SHINE (SHodan INtelligence Extraction) - A research project designed to harvest and ingest data used to correlate threats and risk associated with SCADA and control systems devices directly connected to the Internet. The project is a collaborative effort to raise public awareness of devices that can impact critical infrastructure, while demonstrating the level of magnitude of the large quantity of these devices that are publicly accessible through the Internet.
  • ip-report.it - security search engine - a free clone of Shodan
Retrieved from "https://en.wikipedia.org/w/index.php?title=Shodan_(website)&oldid=642811703"