Comment by eganist | Hacker News Reader

Comment by eganist | Hacker News Reader

Parent Full thread

To the reader: if this is your first exposure to finding things that aren't supposed to be exposed to the internet and you're finding it interesting enough to want to learn more, there's a tool commonly used among security practitioners called Shodan that enables a much more tunable search for exposed assets.

https://en.wikipedia.org/wiki/Shodan_(website) - deeper reading. I'm not affiliated.

---

It's also a super basic intro to proper google-fu (which you can google to find others' takes on how to become somewhat effective at, erm, googling). Back when I used to blog on Microsoft-related topics, it was common to construct extremely narrow queries to find exposed confidential documents in Skydrive accounts which we could then sift through to find bloggable material.

e.g site:[skydrive domain] filetype:.pptx "Microsoft Confidential" etc.

Or one which still works:

https://www.google.com/search?q="Microsoft+Confidential"+sit...

lmao I'm going to have some fun tonight.

The Wikipedia article is unfortunately woefully out of date in describing what Shodan does. For example, Shodan collects data on thousands of ports:

https://www.shodan.io/search/facet?query=net%3A0%2F0&facet=p...

And we don't concentrate on a single type of device/ service (the article mentions SCADA). We identify everything from industrial control systems (1) to Minecraft servers (2). The news coverage makes it sound like we're skewed towards ICS, webcams or vulnerabilities but our focus is on providing a comprehensive view of what's connected to the Internet.

If you want to quickly check if your IP is exposing anything unexpected to the Internet simply visit:

https://me.shodan.io

If you see a 404 then nothing public was found. Note that this looks up information in the existing Shodan database - it doesn't launch a scan.

(1) Industrial control systems: https://www.shodan.io/search/report?query=tag%3Aics

(2) Minecraft servers: https://www.shodan.io/search?query=minecraft

Entirely unrelated fun fact: my love for your service started a good number of years ago when you worked with me directly on a specific challenge (subject: "Any way to pay for shodan without Paypal?"). Glad to see the service is continuing to thrive! And that you're engaged in conversation/feedback on HN.

> https://me.shodan.io … this looks up information in the existing Shodan database - it doesn't launch a scan.

But do you discard the IP or save it for future scans? :p

That's not how it works. Shodan continuously checks all IPs on the Internet. When you visit the website you're checking for existing information in the database. Your use of the Shodan website/ API doesn't change how Shodan crawls the Internet.

"all IPs on the Internet."

I believe all IPV4 addresses. Skeptical on IPV6. Though the ntp pool thing was clever.

Yea, but website user IPs could be used as efficiency booster, proven to be live.

It doesn't matter. We check every IPv4 regardless. And for our regular crawling we don't ping before we try to connect as a lot of firewalls block ICMP.

How do I check my server, which doesn't have a browser installed?

It looks like it just redirects to https://www.shodan.io/host/<IP>, so you should be able to just plug your server's IP in instead in your regular browser.

Ah ok, I was browsing on mobile, so didn't see the entire url.

But it doesn't seem to work, unfortunately.

It does work. 404 means there's no info in the database.

Easiest is probably a SOCKS proxy

ssh -D9999 yourserver

then set up the SOCKS proxy in your browser's settings

> The Wikipedia article is unfortunately woefully out of date

so... did you fix it?

Wikipedia policy discourages entities from editing their own page.

Bingo. Many years ago I tried to fix it but it was quickly reverted. I understand their policy though and hopefully it will get fixed at some point.

I wonder if you could use a forum post of someone saying what's wrong on their page as a source to edit the page though.

Forum posts aren't outside the realm of valid sources, so where exactly is the line drawn?

Conflict of interest is totally separate from the reliability of sources issue. I think the thing that would be encouraged in this situation is to detail what you would want changed on the talk page, and have a neutral wikipedian look at it and make the changes if appropriate. See also https://en.wikipedia.org/wiki/Wikipedia:Plain_and_simple_con...

That said, as far as where the line is drawn for sources see https://en.wikipedia.org/wiki/Wikipedia:Reliable_sources i dont think forum posts are usually considered the best sources.

Was about to reply with this exact sentiment. If the page is about you or your service, propose the updates in the talk page (ideally with reliable third-party sources).

I've definitely seen posts by community managers used as reference for some gaming-related articles, which I assume would fit under "Self-published or questionable sources as sources on themselves."

But, of course, none of those posts specifically targeted their Wikipedia articles.

> I wonder if you could use a forum post of someone saying what's wrong on their page as a source to edit the page though.

You could. The person themselves couldn't. (There are guidelines about the risk of bias from primary sources, which apply very much to someone talking about themselves or their own company, so you shouldn't just blindly copy what they say into Wikipedia, but you absolutely can use them as a source)

Off-topic: this discussion reminds me a bit of what happened about five years ago when I offered to host a reddit AMA about anesthesia and anesthesiology and related subjects (I was board-certified in 1980).

The moderator asked me for proof that I was who I was, so I had to spend a couple days digging through my files to find my medical school diploma, board-certification document, medical licenses, etc., then scan and email them to reddit.

I did all that, and they said it wasn't sufficient proof: I needed to take a selfie with the documents and my driver's license to "prove" my bona fides.

At that point I said WTF? and bagged it.

No good deed goes unpunished.

What's the worst/best part of your position that people outside of it would rarely acknowledge publicly?

Huh?

They're trying to get the AMA started here.

Some fun things here, as a google search:

site:.gov "for official use only" filetype:pptx

site:.gov "for official use only" filetype:pdf

fyi, "for official use only" or "fouo" is a slightly more than meaningless designation to shield stuff against FOIA inquiries. most of the stuff you'll find is pretty boring. a little more: https://en.wikipedia.org/wiki/For_Official_Use_Only#United_S...

I worked for a government lab some time ago, and FOUO wasn't used to shield against FOIA. Indeed, OUO documents can be released to a FOIA request. It was more or less just the default because no one wants to get in trouble for not making things that are supposed to be marked.

What I've seen used as a shield against FOIA is the label, "DRAFT - For Discussion Purposes Only." This is meant to ivoke the "deliberative process" exemption.

  -draft

+1. I don't think I ever saw a document marked UNCLASSIFIED// that was not marked UNCLASSIFIED//FOUO. I'm not convinced that there is such a thing as a document that should be marked unclassified that should not also be marked FOUO.

Press releases

I'd imagine you could generalize that observation to any intentionally published work of the government. That's also my understanding of FOUO from when I needed to know: the agency I worked with thought of it as a magic word for "not meant for release" (in spirit, not legality).

Oh. Yup. Good point.

Sadly, Shodan does not appear to index these, seemingly because it attempts an HTTP connection, while the router expects an HTTPS connection.

Edit: I take it back. Looks like the hash is good enough. 47,000 results; the first three that responded are the same kind of routers. https://www.shodan.io/search?query=hash%3A-904286784

Lately, Shodan’s results are not as good as in the past. I think they are scanning less aggressively.

I always recommend to watch at least both Censys and Shodan.

https://censys.io/

All I'm going to say about Shodan is...

Too many people leave the default password on internet connected devices.

Seriously, anything is better than the default password.

Note that Shodan doesn't try to login using default credentials. If you see banners advertising their defaults it just means that the device is telling you what its defaults are - it doesn't mean that the device is still using them.

That being said, a ton of devices still use default credentials but we don't have any numbers on how many exactly.

I wasn't implying Shodan did this. Shodan just lets you find things. Google reveals default passwords quite readily though. It's alarming how often they work to login.

Ah yeah, I didn't think you were :) It's just a common misconception so I wanted to let readers here know.

Or there is no password at all, like say a lot of HP printers.

On Konica-Minolta printers the password is almost always the same. My school IT admin explained that they're pretty much always rented or "bought" with a mandatory support contract and the contractors get really annoyed when the admin password isn't the default one, since it's supposed to be "their" password.

People seem to slap legal notices on documents like they’re some sort of magical spell that they don’t actually understand.

In my experience, the labeling such as "{company_name} Confidential" is for internal data classification purposes.

These items being accessible externally via google dorking is just poor site administration.

i think my first exposure to shodan was from viss

https://youtu.be/-T-3buBwMEQ

this video is 9 years old now, but id wager the prevalence of pulbic scada and webcams et al is still pretty high.

"115 batshit stupid things you can put on the internet in as fast as I can go"

https://youtu.be/hMtu7vV_HmY

These used to be known in the script-kiddie scene as "google dorks", IIRC

There's also a Chinese-made equivalent of Shodan: https://www.zoomeye.org/

Not that I didn't know about its existence, but I just entered the IP of my VPS and noticed that Portainer was bound to 0.0.0.0... I thought I had it bound to the docker bridge so now I've got to put in some time to see if all is ok.

Thank you!

Narrator: All was ok.

Shodan, great tool. I remember spending time looking at some misconfigured IP cams

Are Skydrive documents somewhat public or are people just sharing them by mistake? I don't use it nor am I that familiar with it.

You can create a long complicated link to share with other people, even people without Skydrive/OneDrive/Dropbox/Google Drive accounts. But sometimes people publish these links somewhere where a search engine's crawler sees it and follow it.

I remember spotting someone's URL to a Google Doc on their screen which their camera caught in their YouTube video. I manually typed it into my browser's URL bar and voila, I could read that document. Nothing juicy though.

I've got a great story about this, ad absurd, from a HIPAA-covered entity.

IT turned on One Drive backups for their desktop image, without communicating to users.

A week later, there's a flurry of a few tens of thousand angrygrams about users storing sensitive documents in the cloud.

... by which they meant (in user terms) "having files on your Desktop."

Perhaps URLs should have an escape character which says that sensitive information starts/ends, so browsers can take appropriate action.

Dear god, no. No more messing with URLs.

> Are Skydrive documents somewhat public or are people just sharing them by mistake? I don't use it nor am I that familiar with it.

Almost all of this would be by mistake, no different than misconfiguring an S3 bucket.

Not sure “google-fu” translates to the average user

Oh man. I miss Fravia.

Reply on news.ycombinator.com