2 ms·

This was a really interesting idea and inspired me to do something similar. I had some Shodan credits from a Humble Bundle, so searched for all servers on port

by davb 8y ago

This was a really interesting idea and inspired me to do something similar. I had some Shodan credits from a Humble Bundle, so searched for all servers on port 80 in my city. Then I wrote a very simple Python program to screenshot each of those (using wkhtmltoimage), with 20 concurrent threads. I didn't stitch the images together and didn't try to login to any of the sites (that would be crossing a line, and simply mapping geographically local, public servers seems harmless). Just flicking through the 7,000-ish screenshots has been pretty fun. Lots and lots of: - router admin panels on the WAN interface. Loads of different brands and models - DVR and NAS units - HikVision CCTV (like, hundreds of these - I wonder if they're being used at local hospitals or city centre surveillance by the police) - IIS servers (especially IIS 7) - 403s (mostly with the IIS default template) - University department and team websites (there are a few universities in my city so there are lots of these) Some weird and wonderful personal websites. Lots of one-line jokes just to fill a space on a public server, presumably. A few wikis. Overall it's been really fun looking at all the servers that are public but just not really indexed, physically surrounding me.

DarkStar851 8y ago
HikVision has been really popular with old-school analog CCTV installers, so odds are it's one very large deployment, or one/a few companies all using HV.
- davb 8y ago
  That's interesting! There is a HikVision office in town too. Thinking about the possible deployment scenarios, you're probably right. Municipal project, hospitals, even a large supermarket chain with 20+ cameras per store. I was just surprised by the sheer volume. I reckon if I compile some stats it'll be one of the most popular devices in the city. That and Alien DVR. Hundreds of those too. I'm surprised so many of these at internet connected, with their own public IP. No NAT, no VPN, no firewall. I'd expect that on one-off DIY deployments at grocery stores but this was pretty surprising.
bjoli 8y ago
I once found a control panel for a power plant in the megawatt range in a neighbour country. I don't know exactly how powerful since no sane person would start clicking around, but there was easy access to maintenance things. I called the Swedish government agency responsible for the same thing in Sweden and was quickly escalated and ended up with someone who knew what they were talking about. Hours later the page was down. I suspect this was the correct path since having a foreign national calling about "hacking" a mw power plant might have ended with me in trouble.
- davb 8y ago
  Similarly I did come across some water treatment plant SCADA panels in another country because I didn't limit my Shodan query to my own country. Turns out my city's name exists in another country where there are a bunch of exposed SCADA systems with web interfaces... I didn't touch anything but it doesn't seem very safe. It does raise the issue of responsible disclosure. I've approached companies in the past after identifying security flaws and had the whole range of responses. Thanks for telling us, we'll take it from here. Let us reward you for telling us. Let us sue you for hacking us... Now it's safer, if less socially responsible, to stay quiet. ️

by davb 8y ago

DarkStar851 8y ago

HikVision has been really popular with old-school analog CCTV installers, so odds are it's one very large deployment, or one/a few companies all using HV.

davb 8y ago
That's interesting! There is a HikVision office in town too. Thinking about the possible deployment scenarios, you're probably right. Municipal project, hospitals, even a large supermarket chain with 20+ cameras per store. I was just surprised by the sheer volume. I reckon if I compile some stats it'll be one of the most popular devices in the city. That and Alien DVR. Hundreds of those too. I'm surprised so many of these at internet connected, with their own public IP. No NAT, no VPN, no firewall. I'd expect that on one-off DIY deployments at grocery stores but this was pretty surprising.

bjoli 8y ago

I once found a control panel for a power plant in the megawatt range in a neighbour country. I don't know exactly how powerful since no sane person would start clicking around, but there was easy access to maintenance things. I called the Swedish government agency responsible for the same thing in Sweden and was quickly escalated and ended up with someone who knew what they were talking about. Hours later the page was down. I suspect this was the correct path since having a foreign national calling about "hacking" a mw power plant might have ended with me in trouble.

davb 8y ago
Similarly I did come across some water treatment plant SCADA panels in another country because I didn't limit my Shodan query to my own country. Turns out my city's name exists in another country where there are a bunch of exposed SCADA systems with web interfaces... I didn't touch anything but it doesn't seem very safe. It does raise the issue of responsible disclosure. I've approached companies in the past after identifying security flaws and had the whole range of responses. Thanks for telling us, we'll take it from here. Let us reward you for telling us. Let us sue you for hacking us... Now it's safer, if less socially responsible, to stay quiet. ️