The Search Engine More Dangerous Than Google 210
mallyn writes "This is an article about a search engine that is designed to look for devices on the net that are not really intended to be viewed and used by the general public. Devices include pool filters, skating rink cooling system, and other goodies. 'Shodan runs 24/7 and collects information on about 500 million connected devices and services each month. It's stunning what can be found with a simple search on Shodan. Countless traffic lights, security cameras, home automation devices and heating systems are connected to the Internet and easy to spot. Shodan searchers have found control systems for a water park, a gas station, a hotel wine cooler and a crematorium. Cybersecurity researchers have even located command and control systems for nuclear power plants and a particle-accelerating cyclotron by using Shodan. ... A quick search for "default password" reveals countless printers, servers and system control devices that use "admin" as their user name and "1234" as their password. Many more connected systems require no credentials at all — all you need is a Web browser to connect to them.'"
dangerous? (Score:4, Insightful)
Is google dangerous? Sure, it can be used to do bad things. But that's like saying we've discovered a liquid more dangerous than water.
Re:dangerous? (Score:5, Funny)
Re:dangerous? (Score:5, Funny)
Dinitrous Monoxide however is quite a laughing matter.
Re: (Score:2)
damn it. i laughed.
Re: (Score:3)
Dihydrogen Monoxide is no laughing matter.
Neither is hydrogen hydroxide
What is wrong with you mods!? (Score:2, Insightful)
He states, and I quote:
no laughing matter.
And you go ahead and mod him "Funny"
Re: (Score:3)
Re: (Score:2)
Re:dangerous? (Score:4, Insightful)
Google isn't dangerous. People being asinine with computers is dangerous, as any search engine can clearly indicate.
Re: (Score:2)
Is shodanhq.com dangerous?
I just tried to establish an account and got this warning:
403 Forbidden
Access was denied to this resource.
Cross-site request forgery detected, request denied.
Obligatory (Score:2, Funny)
L-L-Look at you, hacker: a pathetic creature of meat and bone, panting and sweating as you run through my corridors.
Re: (Score:2)
Re: (Score:2)
astounding that defaults are not tougher (Score:2, Insightful)
I mean, how hard is it to ship new devices with something tougher than admin and 1234?
Re:astounding that defaults are not tougher (Score:5, Funny)
I mean, how hard is it to ship new devices with something tougher than admin and 1234?
they should at least change the account name from "admin" to "luggage"....
Re: (Score:2, Interesting)
They could keep "admin" but print a unique password on the router.
Re: (Score:2, Interesting)
They could keep "admin" but print a unique password on the router.
Admin and Root are so commonly used across so many different hardware platforms and software applications that it's best to default to something else and immediately treat any login attempt by either as a hostile intrusion attempt.
But as for why hardware ships with such easy defaults, it's because it's a default and as such, you should assume that damn near anybody on the planet who wants it, will get it eventually. So unless you're going to ship a different login/pw with every last unit, there's not really
Re: (Score:3)
Some companies do this.
I was pleasantly surprised to see a Century Link DSL modem/wifi router come preconfigured with a WPA2, and a random passwords. Both the admin password and the WPA2 password were printed on the sticker on the bottom.
If Century Link can do it, anyone should be able to.
Re: (Score:2)
ATT Uverse does this. The default password is a string of numbers, printed on a sticker on the side of the box.
Re: (Score:3)
That would require the consumer to spend more than $9.95 on the router, and we can't have that. This is ENTIRELY the consumers fault.
Re: (Score:2)
The serial number would work, as long as the device never publishes it to the outside world.
Re: (Score:2)
A few cheap Belkin routers that I bought for my family do just this.
They have a sticker on the bottom with a (hopefully) unique username and password.
Re: (Score:2)
Already done on my Belkin.
Problem is that if you just hit SUBMIT the router inputs the default password for you, no typing required, and you're in.
What shit fucking security. I'll never touch another Belkin product.
Re:astounding that defaults are not tougher (Score:5, Insightful)
Using a complex default will fool people into thinking the default is secure, and more people will fail to change it. If you're using the same default for every device, it doesn't matter what you use, it's not secure and needs to be changed.
Now they could issue a different default for every device, but that would require printing a unique card for each device, which is significantly more effort than just telling users to change the default login.
Re:astounding that defaults are not tougher (Score:5, Insightful)
The fact of the matter is that a lot of these devices are going to be things which are infrequently accessed, so even if you file the credentials away in a "safe, secure" location by the time you need them again you may have forgotten where that was.
Re: (Score:3)
Re: (Score:3)
I have a new netgear router, the username and password was printed on the bottom along with the serial number (which I assume is unique). If they can do this, then making a random default password of 2 or 3 words concatenated together (as is the case with the netgear password) can't be too hard.
In the case of a truly lost password, like the serial number sticker was damaged or stupidly removed for "safekeeping", then you could always re-flash the firmware with an update, last I remember you only need physic
Re: (Score:3)
For network devices, what about some compromise that combined some part of the serial number and last 3 bytes of the MAC address? Most devices have the serial number machine readable and presumably the MAC address is as well.
This would make guessing far more complicated, especially if there was some effort made in production to "randomize" serial number and MAC address relationships so they didn't march in linear lockstep.
These values should be easily found on the equipment if there was any question as to
Re: (Score:2)
Re: (Score:2)
Most of the broadband modem/router devices I see now have a little sticker with unique information like the SSID, MAC address, and WPA key printed on them. You could usefully improve things just by making the default router password be the WPA key. People you've given the WPA key to would then also be able to reconfigure the router in the default config, but that's basically how it works now. When I visit someone non-technical and they invite me to read the WPA key from the router, invariably once I'm on
Re: (Score:2)
Now they could issue a different default for every device, but that would require printing a unique card for each device, which is significantly more effort than just telling users to change the default login.
They already print (and track) a different physical serial number for each device, that's how they manage warranties. It can't be that hard to do the same using electronic hardware and computers. Sounds a lot easier, actually.
Re: (Score:2)
Now they could issue a different default for every device, but that would require printing a unique card for each device...
As noted by others, lot of consumer devices that people buy for their homes or offices do that. However, things like traffic light, pool water system or nuclear power plant control systems are supposed to be installed by some sort of qualified technician, and they should know better than to leave the default login and password in place.
Re: (Score:3)
All the companies using non-trivial "default" passwords use unique passwords anyway.
It's actually, from my limited, anecdotal experience, pretty effective. The people that don't know to change the password are the same ones that just look up the password on the bottom of the router -- the one or two times (ever) they need it. For the cost of a single sticker, you can force them to (once) use an arbitrarily secure password.
Re: (Score:2)
My WiFi router, now about 10 years old, does have a default password and a reset button to reset the device to that password.
However the only way to access that router's inernals is to be on the LAN side (either WiFi or cable), then point a browser to 192.168.123.254, and enter the password. To get the router to connect via WiFi, you must first connect by cable, to even enable WiFi.
Can't do much better than that. It's secure out of hte box: physical local connection needed to do anything to the device, afte
Re: (Score:2, Insightful)
Instead of making the manufacturers print a unique card for each device, how about people change their credentials and print their own cards?.
That happens to be the way it's done already. Ask Shodan how well it's working out.
Re:astounding that defaults are not tougher (Score:5, Funny)
I mean, how hard is it to ship new devices with something tougher than admin and 1234?
We tried using "12345" as the default but that turned out to be a bad idea, too.
Re: (Score:2)
Re:astounding that defaults are not tougher (Score:4, Insightful)
So the person setting it up is lulled into thinking that the default "4nk^&nW3)(&" is secure and doesn't need to be reset (despite any attacker being just one web search away from learning the "better" default)? Using a default of '1234' is a great way of reminding even minimally competent people that the password needs to be changed from default *right now.* Unfortunately, there are enough people out there not even minimally competent about security that this continues to be a problem.
Re:astounding that defaults are not tougher (Score:5, Interesting)
So the person setting it up is lulled into thinking that the default "4nk^&nW3)(&" is secure and doesn't need to be reset (despite any attacker being just one web search away from learning the "better" default)? Using a default of '1234' is a great way of reminding even minimally competent people that the password needs to be changed from default *right now.* Unfortunately, there are enough people out there not even minimally competent about security that this continues to be a problem.
To that end, the best option (but scarcely used on hardware interfaces) is to force someone to login as the admin before the device is functional, and during that login to force them to set a new password (with certain password rules prohibiting foolishly simple passwords). Do this, and the problem almost goes away, but the new problem of constant password recovery questions flooding tech support will commence. Most companies, sadly, choose the less secure/less pesky route of just letting it run with the default perpetually.
Re:astounding that defaults are not tougher (Score:4, Insightful)
Too expensive in lost sales.
"I want to return this device. I plugged it in and it doesn't work"
Re: (Score:2)
How about making the default password something that is physical on the device but unique to each device?
You know, something like a serial number.
Re: (Score:2)
This will work as long as the serial number isn't sequential (which makes brute-forcing much easier) and steps have been taken to prevent the device from publishing its serial number to anybody who happens to ask.
Re: (Score:2)
Re: (Score:2)
Using a default of '1234' is a great way of reminding even minimally competent people that the password needs to be changed from default *right now.* Unfortunately, there are enough people out there not even minimally competent about security that this continues to be a problem.
Clearly you've both identified and failed to identify the problem. Minimally-competent people *don't* recognize "1234", or other static passwords, as a flag that they need to change the password. You either need to *make* them do it or supply a unique password from the get-go.
Re:astounding that defaults are not tougher (Score:5, Insightful)
Re: (Score:3)
Fine with a "real" computer, not really doable with a router. I don't even want to know how many of them are used without ever anyone having connected to them.
And no, setting them up in a way that they don't "just work" out of the box is not really a solution either. Then the box is "too complicated" and people stop buying them in favor of a competitor's product, try to get that past marketing.
Re: (Score:2)
Re: (Score:2)
Where do those "Most people" live and can I move there? I'd love to live in a neighborhood with a hint of a clue. Then again, I don't, I'd lose my free WiFi access.
Trust me, "most people" don't even understand why to have a password on their WiFi. And more than a few have no WiFi because their router/AP combo needs to have that configured before use and they couldn't figure it out, but the router "worked", so they stick with wired.
Yes, I'm fairly sure such a requirement would label your routers as "complica
Re: (Score:2)
I'd say I am pretty tech savvy. One particular Motorola router stumped me into calling tech support though. Intuitive, obvious, and clear are not universal. I understand how to configure a Cisco ASA (reasonably well)... But this stumped me. (You had to go to the router's home page to accept its terms and conditions or some such nonsense.)
I was ready to go out and buy another unit...
Re: (Score:2)
Re: (Score:3, Insightful)
That would be a bad idea.
1. A default password is a default password, and should be assumed to be public knowledge.
2. A complicated default password will accidentally trick user into thinking it is more secure than admin/1234. For example, you have already been tricked.
3. If the device is reset to factory default, the password won't be easily remembered, so a device may be stranded in a default or even unusable state until the owner can find the password via documentation, help-desk, or internet database o
Re: (Score:2)
I was going to make your point #1 and agree with you #2 and #3.
You last paragraph though is a HUGE problem. If you loose that piece of paper because it was separated from the packaging, or got wet while sitting in the warehouse and maintenance pulls it off the shelf to install it and it is useless, then the manufacturer gets a huge ear full because the facility was down because they were stupid enough to write the unique password on a slip of paper that was tossed with the packaging.
In the world of instrum
Re: (Score:2)
Not sure about current routers, but older FIOS routers had a "random" password easily derived from the broadcast MAC address.
Re: (Score:2)
Re: (Score:2)
They could have a unique default but a special uber-reset that sets it to '1234'.
Re: (Score:3)
1 2 3 4 is no less secure than 4 t & q, mathematically speaking.
Only in the naive combinations case, when we discard the priors.
In other words, the probablility of 1234 being the password is not just 1/num_possible_combinations, but also the probability of 1234 being the default chapter AND the default password not having been changed.
Re:astounding that defaults are not tougher (Score:5, Insightful)
Re: (Score:2)
Re: (Score:3)
mathematically speaking, they're incomparable until you define a probability space.
Re: (Score:2)
You missed the parent's point. Without knowing the alphabet from which the string is selected, we can't say anything about how quickly the string would be guessed. For example, if the alphabet is ASCII, into which both strings fall, they are just as good as each other, from a mathematical perspective.
I don't understand either. I suspect you're both splitting hairs, but I can't tell whether they're blond, brown, or red from here.
(0) infidel /home/keeling_ calcme 10*10*10*10 /home/keeling_ calcme 10*52*22*52
10000
(0) infidel
594880
The latter is a significantly larger number than the former; more than ten times larger. The "10"s are the integers from 0 to 9. "52" == 26 letters in the alphabet * 2 (upper and lower case). "22" is the 11 punctuation keys * 2 (ibid.).
I hope you're not suggesting something st
Re: (Score:2)
Then your box will sit like lead on the shelf because your competitor's box "just works" while I'd have to actually know something to use yours.
Hell, did Apple really teach us nothing? They don't sell 'cause of the shiny, they sell because they "just work". That's what people want and that's what they'll buy, to hell with security.
Doesn't say that I agree with that, far from it. But when ease of use competes with security, ease of use will win. Every single time. Unless you can make that box somehow pop up
Dangerous? Hah (Score:4, Interesting)
There are some more dangerous than this that don't put silly search limitations on their users and are geared specifically for black hat use.
Internet of things (Score:4, Insightful)
But that's the next big thing, haven't you heard? Giving net access to unsecured hardware is the way forward!
Great research, but two nitpicks (Score:2)
How many of these are clever honeypots deployed by whitehats? Probably not a significant proportion, but certainly some are.
And two: if there really are so many unprotected, highly critical, easily discovered devices why is e-havoc not common place? Could the threat from internet connectivity be overstated? Surely if a service doesnt need to be on the internet at large, it shouldn't be. These kinds of reports presume that every system is vulnerable (and that's an appropriate assumption if you are in the
Re: (Score:2)
And two: if there really are so many unprotected, highly critical, easily discovered devices why is e-havoc not common place?
Well, there's lots of unprotected, highly critical, easily discovered people and places in the US, but real-world havoc is also relatively uncommon. Probably for the same reasons--most people aren't evil, and there are harsh consequences for those who are.
Re: (Score:2)
Almost none. This stuff is installed by guys with coveralls and ladders, with as little interaction with the customer's IT department as they can get away with. Really. I've worked in the physical security industry for seven years, and every one of our competitors will avoid dealing with the IT staff if at all possible. Having server and network admins on staff is one of our selling points.
L-look at you, Hacker... (Score:2)
Make yourself comfortable, Hacker. (Score:2)
Stay a while.
Particle accelerator - may not be so bad (Score:2)
The mention of a "cyclotron particle accelerator" control system sounds scary, but may not be. At least here at SLAC there are several levels of control systems, and the ones involved in life safety required physical access to locked areas. Even if someone somehow broke both electronic and physical security machines like this are not very dangerous, similar risk to a typical factory.
I expect that nuclear reactors are far more secure. The "command and control" system may not actually control the reactor, but
maybe it's TROUT. ? (Score:5, Funny)
Demon Seed (Score:2)
Now if only we can gain access to Proteus IV and stop the "Demon Seed" [imdb.com] from spawning.
Or wind turbines (Score:2)
but Rodan is even more dangerous (Score:3)
than Shodan
Signup needed (Score:3)
Which technically will hold you liable for anything you search for, smart - and yet useless.
Services doesn't work, constantly fails, down for maintenance etc...
shoddy'an...
This is why my toilet is disconnected from the net (Score:4, Funny)
Re: (Score:2)
But I like a fresh bowl...
Even scarier (Score:5, Interesting)
Re:Even scarier (Score:5, Funny)
Which begs the question: Why are our prisons accessible from the internet in the first place?
Re: (Score:2)
the internet is how governments can watch everyone, for the time when they need to target someone
Re: (Score:2)
not if you're accessing it from, say, North Korea.
Re: (Score:2)
The new FiOS routers ship with a random pass (Score:2)
Don't blame the internet (Score:2)
because you are lazy, inept or hungover. Default passwords or "admin:admin" is braindead. You're a terrible admin if you do this, and you should feel terrible if you get cracked.
Of course this happens. (Score:5, Interesting)
This is not at all surprising. We contracted a major premises security company to build out the entry-access systems in our company's new buildings a few years ago. Just to be clear, these control the locks to every door into all of the buildings as well as higher security areas within the buildings. The installers insisted that the control boxes for every building needed to have fixed public IP addresses and could not be behind a firewall in order to work. With little understanding of what they were actually asking, they would only enable service if we provided exactly that to them. Do I even need to mention that they left all of these control units running with default username and password?
Needless to say, once functioning service had been established, I immediately moved everything behind a firewall with no forwarding whatsoever to the NAT private address range. Of course, everything works just fine. I later double-checked the installation guide, which allowed for even wider flexibility in installation, with no real network restrictions of the sort that the installers demanded. I'm sure, however, that if they had ever consulted that document, they would not have understood anything about the network installation instructions.
A big part of the problem with things like this is that the systems are installed by people with next to no real network knowledge. They see their job as alarm, plumbing, cabling, construction, or whatever. So when they get to the networked component, they install it in the simplest, most straightforward manner that has been prescribed by someone only slightly more knowledgeable than they are. They are instructions designed to work in every situation for the dimmest of installers, making it possible to complete the contract as possible, even when the client has no one with network knowledge available. The installers, not understanding networks, see them as impenetrably cryptic and therefore secure from intrusion. In most situations there is no one whose job it is to assess security of these connected devices at the completion of the contract, much less tell the customer that they've left them with a risk.
Sadly, the only real advice for these situations is to make companies (the client companies, I mean, not the vendors) understand that they need to be responsible for their own security. If they don't have the necessary expertise on staff, then they absolutely *need* to hire someone - no, not the damn Geek Squad - to check that any network connected device is secure. If they don't then they own the resultant problems. I suppose, in the long run, that insurance companies will require some sort of compliance if potential risk is to be insured.
Only used for good. Yeah right! (Score:2)
"The good news is that Shodan is almost exclusively used for good. ... Penetration testers, security professionals, academic researchers and law enforcement agencies are the primary users of Shodan. "
Like Law Enforcement can be considered to only use this for good. And whose law enforcement...(USoA, China, UK, France, ....)? Will they follow due process and obtain warrants, where necessary. I think not.
Re: (Score:2)
Shodan HQ Slashdotted! (Score:2)
404 City!
Blaming the messenger, as usual (Score:3)
Since the start of internet is pretty common to see in logs hosts that do ip scanning. Having in the open one that shows to the public the kind of information that gets most of them since the beginning just put into the light how vulnerable are the guys without a clue. The good guys that have a clue had a firewall since the start, and the bad guys with a clue had that database compiled from long ago.
So, its responsibility of the people that have devices on public ip addresses to block/filter/password them, and maybe to the cluelest government that is pushing a cyberwar since last decade to warn, educate, and assist on fixing their citizens on not be so trivially vulnerable. And, of course, thank, not punish, the people behind Shodan for this warning.
It's not the search engine that's dangerous (Score:2)
Re: (Score:2)
It's the inept and stupid implementers of these systems that are dangerous, not the search engine
Maybe you didn't read between the lines hard enough. Go to that serach engine, access ANY of those devices without permission, and thanks to the Computer Fraud and Abuse Act, you've just committed a fucking fellony, Fool!
Did visiting Shodan's site make my Firefox CRASH? (Score:2)
Only a few minutes after visiting Shodan, via its Anniversary promo link (from a Google search),
Firefox 20.0 cashed
Coincidence or cause & effect...? You decide?
Hoped an entry would exist for my former HS (Score:2)
I had hi-res goatse pics ready and everything. No wireless. Less space than a nomad. Lame.
Re: (Score:2)
But SHODAN uses fractal data storage technology! She will just regenerate the damaged nodes, then fire the mining laser at earth, just like she promised to!
Fools left its control systems using the default passwords!
(Giggle)
Re: (Score:3)
Believe it or not, we live in a world in which interesting stories often take more than twenty-four hours to play out, and are still worth discussing some time after the CNN blurb appears.
Re: (Score:3, Interesting)
...slashdot used to be a site that got tech news before it broke in the mainstream outlets.
You mean, like this [slashdot.org]?
Re: (Score:2)
Believe it or not, but slashdot used to be a site that got tech news before it broke in the mainstream outlets. A story being featured on slashdot used to be an accomplishment for a story, showing it was important to geek culture. Now, slashdot just fishes old headlines from drudgereport, breitbart, fox news, and occasionally CNN.
I've been on Slashdot since the last century, and I remember quite clearly that there have always been stories here which I'd first seen elsewhere. The value of the site has always been more in the discussion than in the headlines.
Re: (Score:2)
Re: (Score:2)
You sound like an ass.
Re: (Score:3)
Christ in a chicken basket, shut up already.
Re: (Score:2)