In this lecture we'll discuss Shodan. In 2020 there are more than 20 billion IoT devices
connected to the Internet
and you as a security expert cannot ignore them.
We all know that Google is a search engine that finds only websites and it only scratches the surface
of what can be found on the Internet.
There are tens of billions of other devices and services that cannot be found on Google. Shodan
on the other hand is a search engine specially designed to find Internet of Things devices.
It scours the invisible parts of the Internet that most people won't ever see. On shodan
we'll find connected devices like ip or security cameras, traffic lights, video projectors, routers,
home heating systems or even SCADA systems that, for instance, control nuclear power plants and electrical
grids. Shoden is the world's first search engine for internet connected devices.
Some have described Shodan as a search engine for hackers, and have even called it "the world's
most dangerous search engine". While Shodan can potentially be used by black hat hackers,
it can also be used for good purposes like to help protect critical infrastructure, energy utilities
included. In this course we’ll take a look at shodan from an ethical hacker’s perspective.
Before continuing I want to tell you something really important: never connect to a device if you don't
have permission.
Not even if it uses a default password or if the password is written in clear text.
This is the line where you will mostly likely break the law.
Before diving deeper into Shodan I want to show you a few very interesting things that can be found
on Shodan. If you want to follow my examples
you have to create a free account on shodan.io. And to create a free account
you click on Create a free account. Although you can use it without logging in
Shodan restricts some of its capabilities, like using filters, to only logged in users.
However you only need an e-mail address and two minutes of your time to create a free account.
Note that there is also a paid account if you want to get full access to Shoden, though for most of
the searches a free account is enough.
On shodan.io
I’m searching for: axis
212 ptz network camera
and Shodan found 83 such network cameras. On the left side
we see a map that indicates where the found devices are located,
top countries and top services. If I click on an IP address I'll find more information about the device
that's running on that IP address.
We can see a map with the device location, the city, the country,
when was the device last discovered, the open ports,
in this case there are five open ports and the banners each service sent in response.
And If I want to access port 80 and click on this button I will connect to device on port 80.
My advice is not to use your real static IP address when connecting to such a device.
Use Tor or a VPN and I am presented with this log in screen.
Of course I won't go further and I strongly recommend you to do the same.
However many of these services and sites use default passwords! There are lots of resources on the Internet
that lists default username and passwords for different vendors
As long as many consumers and system administrators are careless and don't change the default passwords
hackers can easily gain access to these devices simply by using these lists to find the default admin
username and password.
You, as the owner of a device connected to the internet, have a responsibility to change the default passport
to a strong one and use the latest version of firmware. Let's try other awesome Shodan queries.
One of my favorites is webcamxp. It will search for network camera software designed for older Windows
systems.
And Shodan found 506 such cameras all over the world.
Let's try this one!
Wow.
It required no password and there is a little bird in a nest.
You can watch that bird if you like.
And this one, this requires a username and password.
And this one!
And it seems to be a surveillance camera somewhere in the Czech Republic.
It didn't require any password.
Shodan will not only find webcams but any other IoT devices.
Let's find some automatic license plate readers; and I'm searching for P372 "ANPR enabled"
these are automatic license plate readers in the United States
In order to be able to perform such a search
you should know in advance what banners a device sends back when someone connects to a specific port.
We’ll see in a short while how shodan works!
Now let’s find Prison Pay phones
or devices already logged in as root
via Telnet.
I am taking this IP address and try to connect to it using Telnet cmd.txe telnet the IP address
and port 23, the default telnet port. If I'm hitting enter I'll be connected to the device as root using
telnet.
I want to find a medical X-ray machines that use the dicomp standard for medical images and related
information; dicom server response and port:104
Very interesting!
I'm sure you realized that these 1316 machines shouldn't be on the Internet
at all.
Maybe you wonder how did I know to search for this string.
There are a lot of forums and websites that list awesome Shodan queries.
Just try a Google search!