Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shodan: The scariest search engine on the Internet

money.cnn.com

Post reply on HN
Print view View original

141–150 of 152 posts

Re: Shodan: The scariest search engine on the Internet

#141

Post by lutusp »

DoubleCluster wrote: post #139
speeder wrote: post #35

Earlier quoted context omitted.

Getting down is way easier than getting up. ISS has some engines, crashing on earth is very simple, you can just thrust in the opposite direction that you are going (thus falling into the planet, although slowly and probably astronauts can find the attacker and put it back into orbit before anything serious happens) or you can trust in a diagonal of sorts, to slow your speed AND toward the planet (if you just acceler…

I'm not sure the ISS has enough delta-v to get back down quickly. Lowering the orbit enough so that it will fall down in a few weeks is probably possible.

It's likely that a decent orbital dynamics model and a relatively small, well-timed delta-v would bring the ISS down within a rater small planned impact area. It wouldn't be necessary to decelerate very much to accomplish that. Remember that the ISS must periodically boost its orbit to compensate for frictional losses, on that basis it can be assumed that the craft's dynamics are well-understood:

http://www.heavens-above.com/IssHeight.aspx

Re: Shodan: The scariest search engine on the Internet

#142

Post by eru »

brokenparser wrote: post #88
smacktoward wrote: post #74

Earlier quoted context omitted.

Perhaps, but ~70% of the Earth is empty ocean, and lots of the remainder is relatively empty landmass (huge deserts, unpopulated areas like Siberia, etc.), so just from a statistical perspective the odds of something that survives re-entry hitting a populated area without remote guidance are pretty slim.

Russia called, they said no.

Slim, not impossible.

Re: Shodan: The scariest search engine on the Internet

#143

Post by lucb1e »

_pctq wrote: post #136
achillean wrote: post #111

I apologize for the downtime/ delays, this was a big surprise this morning and I clearly wasn't prepared for the full on-slaught of CNN etc. If you have any questions about Shodan I can try to answer them here.

It would kill your business eventually so it may me a naive question but : do you need volunteer work to help identify and warn those insecure networks ?

I guess you should feel free to do so. It takes away lots of fun for highschoolers though :P

Re: Shodan: The scariest search engine on the Internet

#144

Post by mh- »

Houshalter wrote: post #133
dmiladinov wrote: post #69

Earlier quoted context omitted.

I think it's because you can use botnets to divide up the vast IPv4 search space among the individual bots and crawl it exponentially faster.

Exponentially?

I think exponentially is the new literally.

Re: Shodan: The scariest search engine on the Internet

#145

Post by oelmekki »

lucb1e wrote: post #143
_pctq wrote: post #136

Earlier quoted context omitted.

It would kill your business eventually so it may me a naive question but : do you need volunteer work to help identify and warn those insecure networks ?

I guess you should feel free to do so. It takes away lots of fun for highschoolers though :P

Well, it would be way better if we could add some kind of "source notified" flag directly on the database, we do not want to add mail flood to security breach. :)

Re: Shodan: The scariest search engine on the Internet

#146

Post by achillean »

_pctq wrote: post #136
achillean wrote: post #111

I apologize for the downtime/ delays, this was a big surprise this morning and I clearly wasn't prepared for the full on-slaught of CNN etc. If you have any questions about Shodan I can try to answer them here.

It would kill your business eventually so it may me a naive question but : do you need volunteer work to help identify and warn those insecure networks ?

Yes, I encourage security researchers to always notify the relevant network operators/ authorities if they make an interesting discovery. And that data is always provided for free to agencies such as the CERT. At the end of the day I would like to think that Shodan helps make the Internet a safer place by having smarter people than me find critical infrastructure, and then notifying the operators so things can get fixed. There will always be security issues as long as people are deploying them, so I'm not worried about Shodan becoming obsolete.

Re: Shodan: The scariest search engine on the Internet

#147

Post by oelmekki »

lucb1e wrote: post #143
_pctq wrote: post #136

Earlier quoted context omitted.

It would kill your business eventually so it may me a naive question but : do you need volunteer work to help identify and warn those insecure networks ?

I guess you should feel free to do so. It takes away lots of fun for highschoolers though :P

Also, sorry for highschoolers, but this is for their own good :)

I had my own "let's see what we can do" youth, and sure thing it is very insightful. If we were talking only about business damage, I would say : "well, they desserve it". But we're not.

What do you think would happen if tomorrow, news headline was : "Massive oil truck crash kills 10, caused by hacker tempering with traffic lights." ? Repressive laws against any kind of computer toying would become even harder, and our highschoolers may go to jail for simply trying to have fun.

Re: Shodan: The scariest search engine on the Internet

#148

Post by oelmekki »

achillean wrote: post #146
_pctq wrote: post #136

Earlier quoted context omitted.

It would kill your business eventually so it may me a naive question but : do you need volunteer work to help identify and warn those insecure networks ?

Yes, I encourage security researchers to always notify the relevant network operators/ authorities if they make an interesting discovery. And that data is always provided for free to agencies such as the CERT. At the end of the day I would like to think that Shodan helps make the Internet a safer place by having smarter people than me find critical infrastructure, and then notifying the operators so things can get fi…

Maybe you could provide some place to keep track of who has been notified ? Or even better : handle a "report" form yourself, so sources are notified only once and wild internet don't know if source may be watching its logs or not.

Re: Shodan: The scariest search engine on the Internet

#149

Post by hysterix »

VLM wrote: post #103
noonespecial wrote: post #82

Earlier quoted context omitted.

For each given stop light, speed limit, and vehicle configuration, there is a rubicon that is crossed where it is impossible to stop before entering the intersection. Set up your camera and creep the yellow light time down past this limit and profits just start rolling in.

Exactly. There's uncountable number of stories easily google-able across the country where intersections with red light cameras magically coincidentally have their yellow light interval dropped by 1/4 to 1/3 vs intersections without red light cameras, to increase revenue.

Yep.

And then the red light cameras start magically getting bullet holes in them.

http://www.knoxnews.com/news/2007/dec/12/police-man-shot-cam...

http://www.nj.com/news/index.ssf/2012/08/shoot_out_the_red_l...

Re: Shodan: The scariest search engine on the Internet

#150

Post by _b8r0 »

achillean wrote: post #127
_b8r0 wrote: post #125

I've been playing with the data from the Carna botnet output[1]. Basically someone scanned a massive portion of the Internet using broken routers as bots. There's some interesting finds in the data but analysing it is quite awkward given the size. Shodan is interesting but unless you take up a subscription is pretty limited. [1] - http://internetcensus2012.bitbucket.org/paper.html

Actually, more than 90% of the website's services are completely free! There are only 2 services that I charge for: HTTPS and Telnet. All of the new stuff for the past year I've added and made available for free. And with the Developer API you can easily access the data from within your own scripts. Oh, and I've seen this in a few locations now but: NO SUBSCRIPTION REQUIRED. All of the stuff that's sold on the websit…

That's interesting and I stand corrected, I was under the impression for some reason that subscriptions existed. As an aside, have you had a look at the Carna botnet output, and if so how does it compare to your data?
Post reply on HN