I apologize for the downtime/ delays, this was a big surprise this morning and I clearly wasn't prepared for the full on-slaught of CNN etc. If you have any questions about Shodan I can try to answer them here.
Shodan: The scariest search engine on the Internet
111–120 of 152 posts
Re: Shodan: The scariest search engine on the Internet
#112Looks like it's down: http://imgur.com/TqeYX95 Wonder if that's just because of the publicity, or is someone DoS'ing them.
It's a variety of factors that is causing downtime at the moment. The main culprit is the network itself at the moment, and I'm still trying to put out fires to hopefully make the website a bit more stable.
Re: Shodan: The scariest search engine on the Internet
#113Earlier quoted context omitted.
Man, I found that game to be _very_ bad for my nerves in the 90s.
Me too. Scary game. Nothing else has come near to it. As a tribute, my workstation and laptop are names xerxes and shodan.
Same here. Windows PC is Xerxes, after the AI that gets completely overtaken, and linux server is shodan, the AI that thinks it's smarter than it really is. Linux laptop is polito, the human identity that Shodan assumes for a while (ie 'little shodan')... and the wifi network that carries everything is the 'vonbraun'... :)
Re: Shodan: The scariest search engine on the Internet
#114" The good news is that Shodan is almost exclusively used for good. Matherly, who completed Shodan more than three years ago as a pet project, has limited searches to just 10 results without an account, and 50 with an account. If you want to see everything Shodan has to offer, Matherly requires more information about what you're hoping to achieve -- and a payment. " How does the fact that he charges for it mean that…
Actually, a lot of companies use Shodan data for research! For example, if you want a training set for your new webapp fingerprinting software then loading Shodan might be a good start. Or if you want to create whitepapers for your business, to drive sales for a specific product/ service, then Shodan can provide some empirical data to back up your claims. As was demonstrated with the Internet Census 2012, for people with bad intentions it's easier and much less attention-getting to just use a botnet (plus you don't need to go through the typical business agreements as you would with me). I hope that clarifies it a bit!
Re: Shodan: The scariest search engine on the Internet
#115mhm sorry as i don't know so much about this, but how is this different from google? meaning that with a specific search in google i can find for example all kinds of cameras or systems one shouldn't find, e.g.: -) http://preview.tinyurl.com/34959u Maybe Shodan "focuses" on that, but they can't possible index more of those things than Google already has... Can you find one single thing over Shodan you can't with a sp…
Presumably Shodan ignores robots.txt, right?
A "bad" search engine should treat robots.txt pretty much in reverse: Anything disallowed should go to the top of the list of things to index.. There are sites out there that uses robots.txt rules to prevent Google from indexing things that should be password protected but isn't...
Re: Shodan: The scariest search engine on the Internet
#116Earlier quoted context omitted.
I could be wrong, but I believe Shodan actually portscans the entire internet, whereas Google only crawls known URLs. They also index HTTP headers, which Google doesn't do. It's run by our very own achillean: https://news.ycombinator.com/threads?id=achillean
Sounds like they also attempt to authenticate using default user/pass combos.
No! I do NOT try to authenticate with username/ password! The only exception to that is for FTP, where I try to do an anonymous/anonymous connection (identical to what Firefox etc. do). I put a lot of effort into making the crawling as benign and unobtrusive as possible, so I definitely do NOT try to brute force devices.
Re: Shodan: The scariest search engine on the Internet
#117mhm sorry as i don't know so much about this, but how is this different from google? meaning that with a specific search in google i can find for example all kinds of cameras or systems one shouldn't find, e.g.: -) http://preview.tinyurl.com/34959u Maybe Shodan "focuses" on that, but they can't possible index more of those things than Google already has... Can you find one single thing over Shodan you can't with a sp…
Presumably Shodan ignores robots.txt, right?
I don't crawl for URLs so it doesn't really factor into the equation for me.
Re: Shodan: The scariest search engine on the Internet
#118Earlier quoted context omitted.
Usually the MAC is stored in the network card's flash while the system image is stored in a different flash altogether, which is often cheaper if you can find a way to get away with making them all exactly the same.
Not on new SoCs, where there is only one flash and indeed the ethernet is on the CPU. Which is what these devices are.
1) Are you sure that MAC is actually coming from that one flash that netgear's programming? The real datasheet for the AR7161 isn't public as far as I can tell, but very few SoCs require the end user of the SoC to write their own firmware to provide their own MAC. That type of thing is usually stamped in at the SoC factory. Commonly, it's on a ROM or other OTP memory somewhere, but without the datasheet, I can't tell for sure. And the process which programs that information in is likely separate from the process which programs netgear's firmware in. If you've signed the requisite NDAs and have access to the datasheets, then you may know more, but I still don't think that's a common setup and I doubt netgear would write their firmware assuming that setup.
2) Even if we lived in a world where netgear was doing all this for MAC addresses on SoCs anyway often in computing the question isn't why something isn't done now, but why it was done that way the first time someone wrote it. Build systems, factory processes and other legacy cruft build around a certain way of doing things and often those ways become the way even if new technology makes other ways more simple later.
Re: Shodan: The scariest search engine on the Internet
#119This is incredible! Unfortunately, Shodan itself appears to be down at the moment, presumably due to traffic from CNN. Awesome nonetheless.
could anyone register for a new account? all I get is a 405 not allowed.
That problem has been fixed! I made an error in configuring nginx for memcached and it ended up treating certain pages as static (which prevents them from getting POST requests).
Re: Shodan: The scariest search engine on the Internet
#120This is incredible! Unfortunately, Shodan itself appears to be down at the moment, presumably due to traffic from CNN. Awesome nonetheless.
It's fully up and running again after hours of putting out fires :)