9 ms·
To the reader: if this is your first exposure to finding things that aren't supposed to be exposed to the internet and you're finding it interesting enough to w
by eganist 5y ago
To the reader: if this is your first exposure to finding things that aren't supposed to be exposed to the internet and you're finding it interesting enough to want to learn more, there's a tool commonly used among security practitioners called Shodan that enables a much more tunable search for exposed assets.
https://en.wikipedia.org/wiki/Shodan_(website) https://en.wikipedia.org/wiki/Shodan_(website) - deeper reading. I'm not affiliated.
---
It's also a super basic intro to proper google-fu (which you can google to find others' takes on how to become somewhat effective at, erm, googling). Back when I used to blog on Microsoft-related topics, it was common to construct extremely narrow queries to find exposed confidential documents in Skydrive accounts which we could then sift through to find bloggable material.
e.g site:[skydrive domain] filetype:.pptx "Microsoft Confidential" etc.
Or one which still works:
https://www.google.com/search?q="Microsoft+Confidential"+site%3Ablob.core.windows.net https://www.google.com/search?q="Microsoft+Confidential"+sit...
lmao I'm going to have some fun tonight.
- br2 5y agoAre Skydrive documents somewhat public or are people just sharing them by mistake? I don't use it nor am I that familiar with it.
- eganist 5y ago> Are Skydrive documents somewhat public or are people just sharing them by mistake? I don't use it nor am I that familiar with it. Almost all of this would be by mistake, no different than misconfiguring an S3 bucket.
- bellyfullofbac 5y agoYou can create a long complicated link to share with other people, even people without Skydrive/OneDrive/Dropbox/Google Drive accounts. But sometimes people publish these links somewhere where a search engine's crawler sees it and follow it. I remember spotting someone's URL to a Google Doc on their screen which their camera caught in their YouTube video. I manually typed it into my browser's URL bar and voila, I could read that document. Nothing juicy though.
- ethbr0 5y agoI've got a great story about this, ad absurd, from a HIPAA-covered entity. IT turned on One Drive backups for their desktop image, without communicating to users. A week later, there's a flurry of a few tens of thousand angrygrams about users storing sensitive documents in the cloud. ... by which they meant (in user terms) "having files on your Desktop."
- amelius 5y agoPerhaps URLs should have an escape character which says that sensitive information starts/ends, so browsers can take appropriate action.
- jaywalk 5y agoDear god, no. No more messing with URLs.
- kryogen1c 5y agoi think my first exposure to shodan was from viss https://youtu.be/-T-3buBwMEQ https://youtu.be/-T-3buBwMEQ this video is 9 years old now, but id wager the prevalence of pulbic scada and webcams et al is still pretty high.
- belter 5y ago"115 batshit stupid things you can put on the internet in as fast as I can go" https://youtu.be/hMtu7vV_HmY https://youtu.be/hMtu7vV_HmY
- jfrunyon 5y agoSadly, Shodan does not appear to index these, seemingly because it attempts an HTTP connection, while the router expects an HTTPS connection. Edit: I take it back. Looks like the hash is good enough. 47,000 results; the first three that responded are the same kind of routers. https://www.shodan.io/search?query=hash%3A-904286784 https://www.shodan.io/search?query=hash%3A-904286784
- tg180 5y agoLately, Shodan’s results are not as good as in the past. I think they are scanning less aggressively. I always recommend to watch at least both Censys and Shodan. https://censys.io/ https://censys.io/
- walrus01 5y agoSome fun things here, as a google search: site:.gov "for official use only" filetype:pptx site:.gov "for official use only" filetype:pdf
- oriki 5y agofyi, "for official use only" or "fouo" is a slightly more than meaningless designation to shield stuff against FOIA inquiries. most of the stuff you'll find is pretty boring. a little more: https://en.wikipedia.org/wiki/For_Official_Use_Only#United_States https://en.wikipedia.org/wiki/For_Official_Use_Only#United_S...
- p_j_w 5y agoI worked for a government lab some time ago, and FOUO wasn't used to shield against FOIA. Indeed, OUO documents can be released to a FOIA request. It was more or less just the default because no one wants to get in trouble for not making things that are supposed to be marked.
- HanShotFirst 5y agoWhat I've seen used as a shield against FOIA is the label, "DRAFT - For Discussion Purposes Only." This is meant to ivoke the "deliberative process" exemption.
- soheil 5y ago-draft
- nwallin 5y ago+1. I don't think I ever saw a document marked UNCLASSIFIED// that was not marked UNCLASSIFIED//FOUO. I'm not convinced that there is such a thing as a document that should be marked unclassified that should not also be marked FOUO.
- 5y ago
- atum47 5y agoShodan, great tool. I remember spending time looking at some misconfigured IP cams
- notsureaboutpg 5y agoMe too. going through the filesystem on those things was like looking at a digital graffiti tunnel
- mr_toad 5y agoPeople seem to slap legal notices on documents like they’re some sort of magical spell that they don’t actually understand.
- boston_clone 5y agoIn my experience, the labeling such as "{company_name} Confidential" is for internal data classification purposes. These items being accessible externally via google dorking is just poor site administration.
- grawprog 5y agoAll I'm going to say about Shodan is... Too many people leave the default password on internet connected devices. Seriously, anything is better than the default password.
- pugworthy 5y agoOr there is no password at all, like say a lot of HP printers.
- dvdkon 5y agoOn Konica-Minolta printers the password is almost always the same. My school IT admin explained that they're pretty much always rented or "bought" with a mandatory support contract and the contractors get really annoyed when the admin password isn't the default one, since it's supposed to be "their" password.
- achillean 5y agoNote that Shodan doesn't try to login using default credentials. If you see banners advertising their defaults it just means that the device is telling you what its defaults are - it doesn't mean that the device is still using them. That being said, a ton of devices still use default credentials but we don't have any numbers on how many exactly.
- grawprog 5y agoI wasn't implying Shodan did this. Shodan just lets you find things. Google reveals default passwords quite readily though. It's alarming how often they work to login.
- achillean 5y agoAh yeah, I didn't think you were :) It's just a common misconception so I wanted to let readers here know.
- girvo 5y agoThese used to be known in the script-kiddie scene as "google dorks", IIRC
- achillean 5y agoThe Wikipedia article is unfortunately woefully out of date in describing what Shodan does. For example, Shodan collects data on thousands of ports: https://www.shodan.io/search/facet?query=net%3A0%2F0&facet=port https://www.shodan.io/search/facet?query=net%3A0%2F0&facet=p... And we don't concentrate on a single type of device/ service (the article mentions SCADA). We identify everything from industrial control systems (1) to Minecraft servers (2). The news coverage makes it sound like we're skewed towards ICS, webcams or vulnerabilities but our focus is on providing a comprehensive view of what's connected to the Internet. If you want to quickly check if your IP is exposing anything unexpected to the Internet simply visit: https://me.shodan.io https://me.shodan.io If you see a 404 then nothing public was found. Note that this looks up information in the existing Shodan database - it doesn't launch a scan. (1) Industrial control systems: https://www.shodan.io/search/report?query=tag%3Aics https://www.shodan.io/search/report?query=tag%3Aics (2) Minecraft servers: https://www.shodan.io/search?query=minecraft https://www.shodan.io/search?query=minecraft
- fragmede 5y ago> The Wikipedia article is unfortunately woefully out of date so... did you fix it?
- lmm 5y agoWikipedia policy discourages entities from editing their own page.
- achillean 5y agoBingo. Many years ago I tried to fix it but it was quickly reverted. I understand their policy though and hopefully it will get fixed at some point.
- Talanes 5y agoI wonder if you could use a forum post of someone saying what's wrong on their page as a source to edit the page though. Forum posts aren't outside the realm of valid sources, so where exactly is the line drawn?
- mattl 5y agoNot sure “google-fu” translates to the average user
- syntaxfree 5y agoOh man. I miss Fravia.
- qwertox 5y agoNot that I didn't know about its existence, but I just entered the IP of my VPS and noticed that Portainer was bound to 0.0.0.0... I thought I had it bound to the docker bridge so now I've got to put in some time to see if all is ok. Thank you! Narrator: All was ok.
- deleted 5y ago[deleted]
- frjalex 5y agoThere's also a Chinese-made equivalent of Shodan: https://www.zoomeye.org/ https://www.zoomeye.org/