achillean
Joined 17 years ago
Karma
1,592
Submissions
359
Member since
Dec 3
Recent submissions
Comment · 13 days ago
From 2017 through 2022 there was a large increase in the number of exposed refrigerators:
https://trends.shodan.io/search?query=http.favicon.hash:-853...
Over the past few years it has fluctuated but not the same continued growth as before. If you don't have a Shodan account you can see a chart on twitter:
Comment · 3 months ago
The numbers are a bit lower if you exclude honeypots (~2k hosts): https://www.shodan.io/search/report?query=rockwell+port%3A44...
And the problem has actually gotten better over the years:
https://trends.shodan.io/search?query=tag%3Aics+rockwell
The situation used to be worse with things like the Lantronix password recovery service (i.e. a UDP port that would just send you the device password without any auth). It's still not ideal and takings things offline isn't easy (https://blog.shodan.io/taking-things-offline-is-hard/) but it's getting better (slowly).
Comment · 4 months ago
We are writing https://terminal.shodan.io using iced and the development aspect has been great. Biggest issues are around distributing on Windows.
Comment · 8 months ago
There will be some honeypots in this data but this is a start:
https://www.shodan.io/search/report?query=product%3Atelnetd+...
Comment · 8 months ago
FYI: it might be better to search by port:23
https://www.shodan.io/search?query=port%3A23
Or to filter by product:telnetd
https://www.shodan.io/search?query=product%3Atelnetd
A query of "telnet" searches Shodan for banners where the "data" property contains the string "telnet":
Comment · 8 months ago
Port 23 has decreased significantly over the past decade:
https://i.imgur.com/tZoTWu6.png
Still seeing a sizable number of open ports but it's on the decline.
Comment · 9 months ago
FYI we released a tool to calculate a bunch of these types of hashes: https://book.shodan.io/command-line-tools/shodan-hash/
More info about the favicon hashing technique: https://blog.shodan.io/deep-dive-http-favicon/
Comment · 9 months ago
Already seeing some of the new Moltbot deployments exposed to the Internet: https://www.shodan.io/search/report?query=http.favicon.hash%...
Comment · 9 months ago
I had a similar experience where a competitor released an academic paper rife with mistakes and misunderstandings of how my software worked. Instead of reaching out and trying to understand how their system was different than mine they used their incorrect data to draw their conclusions. I became rather disillusioned with academic papers as a result of how they were able to get away with publishing verifiably wrong data.
Comment · 10 months ago
Honeypots are advertising that header as well nowadays:
https://www.shodan.io/search/report?query=x-clacks-overhead
Most of the non-honeypot results are for the Gargoyle Router Management interface exposed by Korea Telecom:
https://www.shodan.io/search/report?query=x-clacks-overhead+...
The results have increased significantly over time:
Comment · 10 months ago
Maybe it depends on the type of business/ customers that you have because I've had the opposite experience. For us as a security SaaS, B2B enterprise is incredibly stable and predictable. B2C has a lot more variability and payment issues compared to large orgs with dedicated procurement departments, vendor processes etc.
Comment · 10 months ago
Searching for ALPR was also one of the popular early queries: https://github.com/jakejarvis/awesome-shodan-queries?tab=rea...
The old PIPS ALPR devices aren't online anymore but they had horrible security as well. Just sending a newline to their UDP port would cause them to send you all images as they were being collected in real-time - no authentication needed. And the images had the license plate information encoded in the JPG metadata. I did a talk about it at some point (https://imgur.com/HHcpJOr) and worked with EFF to take them offline
Comment · 1 year ago
Shodan also has built-in detection for some of them. For example, you can search for "product:ollama" (https://www.shodan.io/search?query=product%3Aollama). Or if you have access to the tag filter then simply "tag:ai" (https://www.shodan.io/search/report?query=tag%3Aai).
Comment · 1 year ago
Around 40,000 services on the Internet are currently including the header:
https://www.shodan.io/search/report?query=x-clacks-overhead+...
For some reason, a lot of honeypots are also using that header so I filtered those out. The number of services has slowly increased over time:
https://trends.shodan.io/search?query=x-clacks-overhead+-tag...
Comment · 1 year ago
There are still more than 300,000 services on the Internet that support SSLv2:
https://www.shodan.io/search/report?query=ssl.version%3Asslv...
And a trend line of how it's changed:
https://trends.shodan.io/search?query=ssl.version%3Asslv2#ov...
It has dropped significantly though over the years but it will continue to stick around for a while.
Contact me at jmath (at) shodan (dot) io