Shodan- the world's scariest search engine

It’s amazing what technology can do. Just a click away is the world’s largest collection of knowledge. Knowledge that, if used wisely, will make you, and that if used foolishly, will break you. Such is the Internet, a revolutionary invention that began on January, 1^st 1983. Yet there is another revolution that is coming, an “All-Smart” age of things, and that of “Enlightenment” for the humans. We will only dwell on the former. The world of smart things is a no new story to many, especially the tech-enlightened. If you are missing out, then fail not to check on this. But it is basically the world where you and your living and non-living properties e.g. your farm are connected together and are able to exchange critical information, for the betterment of yourselves. But such is the open cast of human dereliction. Just by connecting to your smart track shoes, an anonymous enthusiast can time you when at your highest speed and trip you, resulting in the complete loss of your jawbones. Or one can remotely kindle your house on fire by overheating your smart T.V. Such malicious activities, add the unscalable ones like remotely turning off the cooling system of a nuclear plant or gaining control of your automatic car while at a very busy highway and over speeding it, are made much easier by Shodan, the world’s scariest search engine.

What in the world is Shodan?

It is the Google for the faceless anonymous. But unlike Google, which crawls the Web looking for websites, Shodan navigates the Internet's back channels. It's a kind of "dark" Google, looking for the servers, webcams, printers, routers, smart things and all the other stuff that is connected to and makes up the Internet. It is just a search engine but a special one. It is a one-man’s project developed in the early 2009 by a web developer named John Matherly. Here is how it is different; while typical search engines like google, yahoo or Bing, crawl for data on web pages and then index it for searching, based on the content of the pages, SHODAN interrogates ports and grabs the resulting banners, then indexes the banners (rather than the web content) for searching. Rather than to locate specific content on a particular search term, SHODAN is designed to help the user find specific nodes (desktops/computing device, servers, routers, switches, etc.) with specific content in their banners. Let me make things a little bit easier for you. Just like a ship port which is an open gate way for a country to the outside world, a computer port is a gate way through which a computer application or service talks to the outside world in a network. Banners on the other hand are like flags raised on a particular ship, they tell an onlooker about the ownership and the likelihood contents, and obviously, some info on the security of the ship. So does a port’s banner, it contains some critical information about the specific port one is investigating, this includes the application using the port to communicate, the communication protocols involved, and the machine’s operating system. In a nutshell, they advertise services and version.

Why the scariest?

To the normal you, the info grabbed from a banner rings no bell; but to the hacker you, this information is like the foundation of your every move. Without the use of Shodan, a hacker would normally take multiple hours and even days trying to achieve a one second job (if done via Shodan). Let me take you through the process in a nutshell. Let’s say I want to hack your smart T.V; the first thing I would do is to find your T.V on a network, this involves scanning the network which your device is connected to. Then I would have to identify your T.V’s Internet protocol (IP) address. All this can be achieved by a simple tool like the angry IP scanner. I would then scan your device’s IP for any open ports, like the notoriously known ports 21 (File transfer protocol, FTP), 22 (Secure Shell, SSH), 23 (Telnet), and 80 (HTTP). These can be done once by use of a port scanner like Nmap. The next, and the most important, step is banner grabbing, this is where I would know what application in your smart T.V is currently active, like you tube from port 21. I would also be privileged to find out that you employ Google’s Android as the operating system for your smart T.V. lastly, with all this information from the banners I would nicely perform a successful exploit/hack. Well that is the part we call hacking and I will not spend a single dime of my time teaching you how to hack your neighbour’s smart home T.V. The real worry is Shodan takes you, in a 10 step hacking process, straight to step 8. This time round, it is not only your smart T.V we talk of but also those sophisticated hospital equipment like the MRA scanner, your newly built roller-coaster, your smart home irrigation system, your company’s flexible manufacturing system, your country’s energy management facilities, and the tough notches of the sort. Just after a careful one-hour study on how to use Shodan, a script kiddie can perform some tongue-tying actions.

Shodan runs 24/7 collecting information on about 500 million connected devices and services each month. It's stunning what can be found with just a simple search on Shodan. Countless traffic lights, security cameras, home automation devices and heating systems are connected to the Internet and easy to spot. Shodan searchers have found control systems for a water park, a gas station, a hotel wine cooler and a crematorium. Cybersecurity researchers have even located command and control systems for nuclear power plants and a particle-accelerating cyclotron by using Shodan. What's really noteworthy about Shodan's ability to find all of this -- and what makes Shodan so scary -- is that very few of those devices have any kind of security built into them. It's a massive security failure

Is IoT a dangerous thing then?

I would say no. It is highly a cool thing. But what makes it a looming danger is the misbalance of the equation used to model the IoT. It is an assuring prove that 1 out 5 individuals would like to become cybersecurity individuals, but the remaining four would all like to be black hats often with 2 out of the four looking forward to be grey hats. So the equation is entirely a mess, you might search a square mile for security expert but you just have to visit the next door to witness what hacking really is. Another serious problem is with the creators of the technologies. Security has not been a major factor considered. If am wrong then we should be seeing secure devices rather than those that depend on third party devices and software for security, and what of the bug-full codes that run on the devices. It is also not surprising to find out that passwords to the controls of very serious infrastructures are still left to their vendor assigned defaults like “1234” or “Password”. Another problem is with the consumers of these technologies. I would like to tell you that, once you buy or install that gadget, it is yours and not the world’s, so act like you own it, personalize it.

Conclusion

It is highly advocated that we change before change changes us. This has become the mantra for this tech-dynamic age. But it is the balanced environment that makes an eco-system. It is rather so unlikely that the tech world is highly one-sided. It is not a win-win situation, but rather the win-lose. You should navigate to this link and see for yourself. Clearly highly reputable guys are on the losing end. I just have a last word for the developers of these highly insecure gadgets; I hope you know what you are making.