SHODAN, the search engine: is it “scarry” or not?

E-Crime Expert presents to you today a search engine which is totally different (in functionality and scope) than the ones we are used to (i.e Google, Bing etc).

For us  (E-crime Expert), Shodan has a positive value as it uncovers security vulnerabilities. Used by others (i.e. cybercriminals), Shodan could have a negative side as enables access to different systems (routers, webcams, etc) which have little or no security protection.

According to the description available on their main page here, “SHODAN is a search engine that lets you find specific computers (routers, servers, etc.) using a variety of filters. Some have also described it as a public port scan directory or a search engine of banners”.

Web search engines, such as Google and Bing, are great for finding websites. Rather than to locate specific content on a particular search term, SHODAN is designed to help the user find specific nodes (desktops, servers, routers, switches, etc.) with specific content.

How to use it:

Create and login using a SHODAN account, or Login using one of several other options (Google, Twitter, Yahoo, AOL, Facebook, OpenID).

Login is not required, but country and net filters are not available unless you login.

Basic Operations:

Filters
-country: filters results by two letter country code hostname;

-filtering by country can also be accomplished by clicking on the country map (available from the drop down menu);

-mouse over a country for the number of scanned hosts for a particular country.

-filters results by specified text in the hostname or domain net;

-filter results by a specific IP range or subnet operating system;

-search for specific operating systems port: narrow the search for specific services;

After the search returns some entries (webcams located in a certain area), just click on one of those entries and you will have instant access to what that webcam records live (Fig 1).

Figure 1.

01

Examples:

Note:
E-Crime Expert will try contact all the owners of these vulnerable systems in order to report their security issues and advise how to protect their devices with appropriate passwords and security measures.

Please watch the video or read our material on how to create a stronger password.

1. Run a search for all existing default passwords, as shown in Figure 2.
Having access to the password, one could enter the router’s settings and change them or even more, use the router as a back door to access any device connected to it such as a computer, printer, etc.

Figure 2.

02

2. Once we selected a webcam, click on it and wait for the live footage to play.
What we see is an intersection which could be considered as a public space. The live feeds record everything live (Fig. 3).

Figure 3.

033. The access is granted regardless the geographical location: E-Crime Expert had access to a webcam located in Russia from a computer located in North America (Figure 4).

Figure 4.

04

4. We next tested a webcam which was recording someone’s home front steps for security reasons perhaps. But the issue here is how that camera’s angle is recording as you can also see the next neighbor’s front alley, car and probably anyone entering their house (Fig. 5).

Figure 5.

05

5. Next example is more intrusive as transmits live feeds from a restaurant where clients could be identified along with the staff members. The purpose of this camera is theft protection but due to its non-existing security measures, now anyone on the Internet could check who came at that restaurant and at what time, transforming the purpose of that camera into a monitoring one (Fig. 6).

Figure 6.

06

6. Not surprisingly, the next webcam becomes even more intrusive by showing live the staff member working in a convenience store, with a “from behind the counter” view. Anytime the staff opens the money drawer, everyone having access to this webcam (available worldwide as shown in this blog post) could approximate how much money is available there. Beside the privacy invasive aspect of the clients and also of the staff member, potentially, could also lead to robberies or similar attacks (Fig. 7).

Figure 7.

photo 07

7. Last examples is the most intrusive and concerning one as it transmits live video streaming from someone’s home. It is intrusive because most probably the guests visiting this person are not aware of the webcam, and also because the footage is now available not just to the security company in charge of protecting this home, but also to virtually anyone on the Internet. The second concerning aspect is that anyone could see what is available on the kitchen counter whether a large amount of cash or cheques or other valuable goods. This again, could lead to robberies or other violent crimes (Fig. 8).

Figure 8.

08

Conclusions:

SHODAN aggregates a significant amount of information that is not already widely available in an easy to understand format.

SHODAN collects basic information about the websites, the information “from the inside”, data covering the so-called back-end (simplified information about the type of your server software versions, and so on). On the one hand, it is therefore an excellent data base for those involved in security – but on the other, it is also a source of information for cybercriminals.

The Shodan software runs 24 hours a day. It automatically reaches out to the World Wide Web and identifies digital locators, known as internet protocol addresses, for computers and other devices. For security monitoring teams, Shodan may present some serious challenges. It is highly unlikely that security monitoring teams will ever be alerted to an attack that is using Shodan.

From a privacy perspective, there on the World Wide Web could be some available information accessible to the regular people by simply running a search, which it is not necessarily to be regarded as publically available information, such as the webcam in someone’s home, in a store, gas station etc. This is not publically available information from a legal perspective but it actually becomes available to anyone as some monitoring systems have little or no security measures. According to most international privacy legislation, a surveillance camera should be installed and used just on a legal basis and after a privacy impact assessment is done (as a best practice). That legal basis strictly refers to the purpose of why that camera is used for which definitely does not grant worldwide access to the footage, except where in question is a public space (i.e. park, street, etc).

Even though in question is a public domain under surveillance, there are cases when footage or pictures of those public spaces record more than the public space itself (i.e. Google maps litigations for capturing more than the streets, etc).

The Privacy Impact Assessment is specifically done (among others) to make sure that no unauthorized person has access to the footage recorded by a surveillance camera. Being able to publically find this footage on the Internet, is outside the Privacy and Security requirements and measures in place for a surveillance camera located either within a public space (with the potential of recording private areas as well) and or in a household which is by definition a private space. Probably some of these surveillance cameras are installed by the household owners, aiming to act as a theft protection and consequently be accessible just by the police or other law enforcement entities.

Contrary, by having access globally to this kind of footage, does not align with most of the international existing privacy legislation.

Once again, E-Crime Expert has taken this opportunity (SHODAN – search as a positive tool) to asses current privacy and security issues.

If you have any question you could contact: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.

Advertisements
  1. April 16, 2013 at 07:04

    I’m impressed, I have to admit. Seldom do I come across a blog that’s both educative
    and amusing, and without a doubt, you’ve hit the nail on the head. The issue is something too few people are speaking intelligently about. I’m very happy that I came
    across this in my search for something regarding this.

  2. April 17, 2013 at 14:51

    Hi there Dear, are you actually visiting this site
    on a regular basis, if so afterward you will definitely obtain nice knowledge.

  3. May 1, 2013 at 06:13

    Howdy very cool web site!! Guy .. Excellent .. Wonderful .
    . I will bookmark your site and take the feeds also?

    I am happy to find so many helpful information here
    in the submit, we’d like develop extra techniques in this regard, thank you for sharing. . . . . .

  4. May 2, 2013 at 18:22

    Howdy just wanted to give you a quick heads up. The text in your article seem to be running off the screen in Firefox.
    I’m not sure if this is a formatting issue or something to do with web browser compatibility but I figured I’d post
    to let you know. The design look great though!
    Hope you get the problem solved soon. Cheers

    • Dan Manolescu
      May 2, 2013 at 18:24

      Thank you so much. Really appreciate your input! We ll try to get it fixed.
      Dan.

  5. May 11, 2013 at 10:19

    With havin so much written content do you ever run into any issues of plagorism or copyright infringement?
    My website has a lot of completely unique content I’ve either created myself or outsourced but it looks like a lot of it is popping it up all over the internet without my agreement. Do you know any solutions to help reduce content from being ripped off? I’d truly appreciate it.

  6. May 14, 2013 at 18:17
  7. Pam
    May 16, 2013 at 16:18

    Do you have a spam issue on this blog; I also am a blogger, and I was curious about your situation; we have
    developed some nice procedures and we are looking to exchange
    methods with others, why not shoot me an email if interested.

  8. May 19, 2013 at 18:17

    Ahaa, its nice conversation about this article at this place at this website, I
    have read all that, so now me also commenting at this
    place.

  9. May 22, 2013 at 08:42

    Great blog! Is your theme custom made or did you download it from somewhere?

    A design like yours with a few simple tweeks would really make my blog
    shine. Please let me know where you got your design.
    Many thanks

  10. May 22, 2013 at 17:48

    Hey there! I just wanted to ask if you ever have any trouble with hackers?
    My last blog (wordpress) was hacked and I ended up losing many months of hard work due to no data
    backup. Do you have any solutions to protect against hackers?

  11. May 23, 2013 at 05:43

    I enjoy looking through an article that will make people think.
    Also, thank you for allowing me to comment!

  12. May 23, 2013 at 08:36

    Hi there everyone, it’s my first pay a visit at this website, and piece of writing is really fruitful in support of me, keep up posting such posts.

  13. May 24, 2013 at 03:32

    Magnificent beat ! I would like to apprentice while you amend your web
    site, how can i subscribe for a blog site?
    The account helped me a acceptable deal. I had been a little bit acquainted of this your broadcast
    offered bright clear idea

  14. May 24, 2013 at 10:39

    Hello! This post couldn’t be written any better! Reading through this post reminds me of my good old room mate! He always kept talking about this. I will forward this page to him. Fairly certain he will have a good read. Thanks for sharing!

  15. May 26, 2013 at 15:33

    Hi! This is my 1st comment here so I just wanted to give a quick shout out and tell you
    I genuinely enjoy reading through your articles.
    Can you suggest any other blogs/websites/forums that go over the same subjects?
    Many thanks!

  16. May 30, 2013 at 19:58

    You actually make it seem really easy with your presentation however I in finding
    this topic to be actually one thing that I think I might by no means
    understand. It seems too complicated and very extensive for me.
    I’m taking a look forward to your subsequent submit, I will attempt to get the hang of it!

  17. June 7, 2013 at 22:21

    Good web site you have here.. It’s hard to find excellent writing like yours these days. I honestly appreciate individuals like you! Take care!!

    • Dan Manolescu
      June 9, 2013 at 16:59

      Thank you! I really appreciate it!

    • Dan Manolescu
      June 9, 2013 at 17:02

      Thank you. Im trying to provide people with information that might be useful.
      Dan.

  18. June 9, 2013 at 11:23

    Thank you for another great article. The place else may just anybody get that kind of info in such an ideal approach of writing?

    I’ve a presentation subsequent week, and I’m on the search for such information.

    • Dan Manolescu
      June 9, 2013 at 17:07

      Thank you. Let me know what your presentation is about and i ll try help with more info.
      Dan.

  19. June 10, 2013 at 09:50

    I know this if off topic but I’m looking into starting my own weblog and was curious what all is required to get set up? I’m assuming having a
    blog like yours would cost a pretty penny?
    I’m not very internet savvy so I’m not 100% sure. Any tips or advice
    would be greatly appreciated. Kudos

  20. June 28, 2013 at 17:18

    I loved as much as you’ll receive carried out right here. The sketch is tasteful, your authored subject matter stylish. nonetheless, you command get bought an impatience over that you wish be delivering the following. unwell unquestionably come more formerly again as exactly the same nearly very often inside case you shield this hike.

  21. June 29, 2013 at 15:20

    Nice response in return of this difficulty with genuine arguments and telling the whole thing on the topic of that.

  22. July 25, 2013 at 09:32

    I think this is among the most vital info for me.
    And i am glad reading your article. But want to
    remark on few general things, The website style is ideal, the articles is really excellent :
    D. Good job, cheers

  23. September 27, 2013 at 22:01

    What’s up, just wanted to tell you, I liked this blog
    post. It was practical. Keep on posting!

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: