achillean

We are writing https://terminal.shodan.io using iced and the development aspect has been great. Biggest issues are around distributing on Windows.

achillean

6 bulan yang laludiscuss

There will be some honeypots in this data but this is a start:

https://www.shodan.io/search/report?query=product%3Atelnetd+...

achillean

6 bulan yang laludiscuss

FYI: it might be better to search by port:23

https://www.shodan.io/search?query=port%3A23

Or to filter by product:telnetd

https://www.shodan.io/search?query=product%3Atelnetd

A query of "telnet" searches Shodan for banners where the "data" property contains the string "telnet":

https://book.shodan.io/getting-started/query-syntax/

achillean

6 bulan yang laludiscuss

Port 23 has decreased significantly over the past decade:

https://i.imgur.com/tZoTWu6.png

Still seeing a sizable number of open ports but it's on the decline.

achillean

6 bulan yang laludiscuss

FYI we released a tool to calculate a bunch of these types of hashes: https://book.shodan.io/command-line-tools/shodan-hash/

More info about the favicon hashing technique: https://blog.shodan.io/deep-dive-http-favicon/

achillean

6 bulan yang laludiscuss

Already seeing some of the new Moltbot deployments exposed to the Internet: https://www.shodan.io/search/report?query=http.favicon.hash%...

achillean

6 bulan yang laludiscuss

I had a similar experience where a competitor released an academic paper rife with mistakes and misunderstandings of how my software worked. Instead of reaching out and trying to understand how their system was different than mine they used their incorrect data to draw their conclusions. I became rather disillusioned with academic papers as a result of how they were able to get away with publishing verifiably wrong data.

achillean

7 bulan yang laludiscuss

Honeypots are advertising that header as well nowadays:

https://www.shodan.io/search/report?query=x-clacks-overhead

Most of the non-honeypot results are for the Gargoyle Router Management interface exposed by Korea Telecom:

https://www.shodan.io/search/report?query=x-clacks-overhead+...

The results have increased significantly over time:

https://trends.shodan.io/search?query=x-clacks-overhead

achillean

7 bulan yang laludiscuss

Maybe it depends on the type of business/ customers that you have because I've had the opposite experience. For us as a security SaaS, B2B enterprise is incredibly stable and predictable. B2C has a lot more variability and payment issues compared to large orgs with dedicated procurement departments, vendor processes etc.

achillean

7 bulan yang laludiscuss

Searching for ALPR was also one of the popular early queries: https://github.com/jakejarvis/awesome-shodan-queries?tab=rea...

The old PIPS ALPR devices aren't online anymore but they had horrible security as well. Just sending a newline to their UDP port would cause them to send you all images as they were being collected in real-time - no authentication needed. And the images had the license plate information encoded in the JPG metadata. I did a talk about it at some point (https://imgur.com/HHcpJOr) and worked with EFF to take them offline

achillean

11 bulan yang laludiscuss

Shodan also has built-in detection for some of them. For example, you can search for "product:ollama" (https://www.shodan.io/search?query=product%3Aollama). Or if you have access to the tag filter then simply "tag:ai" (https://www.shodan.io/search/report?query=tag%3Aai).

achillean

tahun laludiscuss

Around 40,000 services on the Internet are currently including the header:

https://www.shodan.io/search/report?query=x-clacks-overhead+...

For some reason, a lot of honeypots are also using that header so I filtered those out. The number of services has slowly increased over time:

https://trends.shodan.io/search?query=x-clacks-overhead+-tag...

achillean

tahun laludiscuss

There are still more than 300,000 services on the Internet that support SSLv2:

https://www.shodan.io/search/report?query=ssl.version%3Asslv...

And a trend line of how it's changed:

https://trends.shodan.io/search?query=ssl.version%3Asslv2#ov...

It has dropped significantly though over the years but it will continue to stick around for a while.

achillean

tahun laludiscuss

In absolute numbers probably not highly representative but the relative numbers are meaningful to measure adoption. And no, it requires the user to disable authentication in order to get the service details to differentiate between Redis and Valkey. But again, you can compare unauthenticated Redis to unauthenticated Valkey to see how the percentages are changing over time.

achillean

tahun laludiscuss

Based on Internet-accessible services the number of Valkey servers is low (~120):

https://trends.shodan.io/search?query=valkey_version+port%3A...

Here's a chart of all Redis-compatible services (~55,000):

https://trends.shodan.io/search?query=port%3A6379+redis_vers...

achillean

tahun laludiscuss

It's not anymore! They actually changed their defaults and it helped tremendously to reduce the exposure of Redis instances on the Internet.

achillean

2 tahun yang laludiscuss

We released a tool to calculate the favicon hash called "favscan": https://blog.shodan.io/deep-dive-http-favicon/

And here's a map of favicons that Shodan has seen across the Internet: https://faviconmap.shodan.io/

achillean

2 tahun yang laludiscuss

We developed "geodns" for situations where you want to do DNS lookups from different regions around the world. For example, ycombinator.com returns different IPs depending on your location:

  $ geodns ycombinator.com
  108.156.133.117                Singapore
  108.156.133.21                 Singapore
  108.156.133.25                 Singapore
  108.156.133.59                 Singapore
  108.156.39.26                  London
  108.156.39.61                  London
  108.156.39.62                  London
  108.156.39.64                  London
  13.32.27.123                   Frankfurt am Main
  13.32.27.47                    Frankfurt am Main
  13.32.27.51                    Frankfurt am Main
  13.32.27.80                    Frankfurt am Main
  13.35.93.12                    Clifton
  13.35.93.14                    Clifton
  13.35.93.46                    Clifton
  13.35.93.47                    Clifton
  18.239.94.100                  Amsterdam
  18.239.94.114                  Amsterdam
  18.239.94.33                   Amsterdam
  18.239.94.79                   Amsterdam
  99.86.20.42                    Doddaballapura
  99.86.20.54                    Doddaballapura
  99.86.20.64                    Doddaballapura
  99.86.20.96                    Doddaballapura

https://gitlab.com/shodan-public/geonet-rs

achillean

2 tahun yang laludiscuss

Looks like there are at least a few hundred instances of OpenEMR exposed to the Internet: https://www.shodan.io/search/report?query=http.favicon.hash%...

achillean

2 tahun yang laludiscuss

A few others:

- Want to distribute data to users that don't want to manage a server? A lot of people don't want to manage a server and don't need the best possible performance.

- Want to take data with you on a thumb drive and work with it offline? It's extremely convenient to be able to use SQLite for an app that has to work offline.

- Does the app mostly just read from the database and fit in memory? It's undervalued to just put the entire database into memory so you don't hit the disk and don't introduce network latency. For example, the following website does all enrichment with in-memory SQLite databases: https://shdn.io/analyze?target=ycombinator.com

At Shodan, we distribute versions of our datasets as SQLite and they're a popular way to consume the data without having to manage infrastructure.

Submissions

Accepting Crypto: A Vendor Perspective

Show HN: InternetDB API – Fast IP Lookups for Port and Vulnerability Information

Show HN: CLI tools to ping and do DNS lookups from different parts of the world

Show HN: Run ping/ DNS lookups from multiple locations around the world

Elastic Data Exposure Grows to 3.2 PB

Favicons Map: visual breakdown of the most common favicons on the Internet

Trends in Internet Exposure

Journey over Unsecured IoT Devices with Kamerka

State of Industrial Control Systems in Poland and Switzerland

Show HN: Share one-liner command snippets

Show HN: An 80s retro-futuristic way to explore the Internet

Rather Than Ask Google, Let’s Ask Shodan

Thousands of Internet-connected Android devices now have no security

Show HN: Internet Exposure Observatory – Tracking network services by country

Analyzing Post-WannaCry SMB Exposure on the Internet

Massive HDFS Data Exposure

Show HN: I pinged the Internet (IPv4) and generated a map

Understanding Security by Country – A Look at SSL Usage

Show HN: Shodan 3D interface using THREE.js

How I found a data leak of a company during a college lecture

comments