Shodan: The scariest search engine on the Internet • Hacker News Board

Re: Shodan: The scariest search engine on the Internet

#91

Post by DangerousPie » Mon, Apr 08, 2013, 7:04 PM UTC

" The good news is that Shodan is almost exclusively used for good.

Matherly, who completed Shodan more than three years ago as a pet project, has limited searches to just 10 results without an account, and 50 with an account. If you want to see everything Shodan has to offer, Matherly requires more information about what you're hoping to achieve -- and a payment. "

How does the fact that he charges for it mean that it's "almost exclusively used for good"? I would argue there is very little incentive to pay for something like this unless there is a monetary gain.

Re: Shodan: The scariest search engine on the Internet

#92

Post by neeee » Mon, Apr 08, 2013, 7:13 PM UTC

http://youtu.be/5cWck_xcH64 is a really good presentation about what you can find on shodan.

Re: Shodan: The scariest search engine on the Internet

#93

Post by IgorPartola » Mon, Apr 08, 2013, 7:18 PM UTC

Looks like it's down: http://imgur.com/TqeYX95

Wonder if that's just because of the publicity, or is someone DoS'ing them.

Re: Shodan: The scariest search engine on the Internet

#94

Post by NegativeK » Mon, Apr 08, 2013, 7:36 PM UTC

DangerousPie wrote: post #91

" The good news is that Shodan is almost exclusively used for good. Matherly, who completed Shodan more than three years ago as a pet project, has limited searches to just 10 results without an account, and 50 with an account. If you want to see everything Shodan has to offer, Matherly requires more information about what you're hoping to achieve -- and a payment. " How does the fact that he charges for it mean that…

I seem to remember Matherly saying that he charged larger institutions who need lots of data for legit research. He also (as of a year and a half ago) said that he was basically breaking even.

I guess a university security researcher is looking for monetary gain in the form of grants, though.

Re: Shodan: The scariest search engine on the Internet

#95

Post by pseut » Mon, Apr 08, 2013, 8:33 PM UTC

rcfox wrote: post #78

VLM wrote: post #62

Earlier quoted context omitted.

I'd like to see the local lights reprogrammed to follow the legal guidelines instead of short yellows to maximize traffic ticket revenues.

Consider yellow to mean "stop", and the length of it becomes irrelevant and the roads become a little bit safer.

You should also glance in your rear-view mirror to verify that the car behind you follows the same rule before you commit to stopping. Simple rules about traffic safety usually need a little tweaking IRL...

Re: Shodan: The scariest search engine on the Internet

#96

Post by tibbon » Mon, Apr 08, 2013, 8:34 PM UTC

Even scarier is how fast their servers fall over :)

Re: Shodan: The scariest search engine on the Internet

#97

Post by kmfrk » Mon, Apr 08, 2013, 8:37 PM UTC

tptacek wrote: post #8

Eagerly awaiting the moment someone at CNN finds out about Metasploit. I'd like to think of it as a kind of "Dark Firefox".

I think Firesheep is more of a "Dark Firefox".

Re: Shodan: The scariest search engine on the Internet

#98

Post by kmfrk » Mon, Apr 08, 2013, 8:39 PM UTC

rubinelli wrote: post #67

lt wrote: post #44

Earlier quoted context omitted.

Sounds like they also attempt to authenticate using default user/pass combos.

Is that legal? I've seen all kinds of analogies like "if your neighbor leaves the front door unlocked..." or "but if you go down the street testing each lock..." but never anyone who really knew what actual criminal law says.

Look at what happened to the guy who was able to access Sarah Palin's account, because her secret questions were basically googleable.

(Today,) that's just cruisin' for a bruisin'.

Re: Shodan: The scariest search engine on the Internet

#99

Post by redblacktree » Mon, Apr 08, 2013, 8:50 PM UTC

icambron wrote: post #86

redblacktree wrote: post #71

Earlier quoted context omitted.

It seems like the harder part would be hitting New York. You could crash the ISS somewhere on Earth pretty trivially, if you had the controls.

Assuming they didn't, you know, disconnect you while you were doing it. There are actual people up there; presumably they have manual overrides.

Right. I was assuming/implying a lot by saying, "if you had the controls." In the hypothetical where you have complete control of the ISS (despite manual overrides, et al), you'd still have a very hard time hitting a specific target on Earth. You could crash the thing fairly easily though. That's all I meant to say; I understand that this isn't a practical reality.

Re: Shodan: The scariest search engine on the Internet

#100

Post by vecinu » Mon, Apr 08, 2013, 9:02 PM UTC

laumars wrote: post #90

vecinu wrote: post #61

But he added that cybercriminals typically have access to botnets -- large collections of infected computers -- that are able to achieve the same task without detection. What do botnets have to do with crawling the web for unsecured devices? I'm not sure I understand the correlation.

Funny enough that question was answered in a rather public way just a few weeks ago: https://news.ycombinator.com/item?id=5404642 (Researcher sets up illegal 420,000 node botnet for IPv4 Internet map)

I did read this article a few weeks ago but seem to have forgotten its link to my question.

Thank you for the reminder.