4 ms·

Serial Port Scans Find More Than 100,000 Hackable Devices

devicenull 13y ago
Seems like every 6 months someone discovers SHODAN and we get another article like this.
- theboss 13y ago
  For real.... If anyone wants the big talk HD gave on this, it was the keynote for 2012 DerbyCon. Here's the slides. https://speakerdeck.com/hdm/derbycon-2012-the-wild-west https://speakerdeck.com/hdm/derbycon-2012-the-wild-west It starts out really fluffy and eventually he gets to the good stuff (i.e. old grandmas computers from 1998 that are still online)
- cnlwsu 13y ago
  its a 3 month old article, so its good to be reminded mid-next-article
  - christianbryant 13y ago
    True, though "old" articles like this are interesting reads as case studies. When you analyse how many times these type of discoveries occur and then trend, it offers both sides of the camp interesting data.
- achillean 13y ago
  Expect to see more kinds of these stories as people discover new things (hint: medical devices). And the advent of the "Internet of Things" is also putting Shodan in a new light. For the technical folks though, I hope to release some cool new stuff soon :)
shortsightedsid 13y ago
UART or Serial Port is the first thing that you need when developing embedded systems. It is simple, easy to hook up to your Laptop (via USB Serial convertors). With terminal emulators like Teraterm, Putty (or the nefarious Hyperterminal) or Minicom, you can get to see what's happening on the device. 1. All devices running linux will have /dev/console tied to UART. 2. For others, typically a printf routine would write to UART. The problem the article talks about occurs when the OEM "forgets" to turn off the UART (either in software or just by breaking the pins during manufacturing).
- csense 13y ago
  > The problem the article talks about occurs when the OEM "forgets" to turn off the UART (either in software or just by breaking the pins during manufacturing). Did you read the article? He's not hacking commercial/industrial devices like gas pumps by driving to a gas station and using a USB-serial adapter to physically attach a laptop or smartphone. Rather, the owners of the gas pumps legitimately attached a serial-to-Ethernet translator themselves to allow applications on their TCP/IP network to control the gas pump hardware. But they didn't secure the connection with an effective firewall or authentication requirement, so now not just the legitimate application, but anyone on the public Internet, can send commands to the pump.
- bobdvb 13y ago
  I agree the article is unfair to say that serial connections are old technology and outmoded. The serial connection is a useful tool for electronics designers and engineers because it is very simple to implement & adds almost no incremental cost to the design. Even if it is internet connected, your "smart" TV has serial connections which you probably can't access but they are there for the designers (not for the general public). Yes, domestically serial has gone the way of the floppy disk, but that doesn't mean it doesn't have a purpose (a but like print journalism really).
jlgaddis 13y ago
I remember freaking out when I first read HDM's post on the Digi devices[0] because I have a ton of the Digi devices deployed at electrical substations for a customer (electric utility). They are connected to the cellular networks and have public IP addresses. Fortunately, I was rewarded for being paranoid and doing everything I could to lock these devices down pre-deployment as none of them were vulnerable to these attacks. It was certainly a stressful day as I checked each of them one by one, though. [0]: https://community.rapid7.com/community/metasploit/blog/2013/04/23/serial-offenders-widespread-flaws-in-serial-port-servers https://community.rapid7.com/community/metasploit/blog/2013/...
- daemon13 13y ago
  What are the typical use cases for Digi and similar devices?
  - jlgaddis 13y ago
    In my case, it's to provide IP connectivity where it is otherwise not available. I'm using the devices shown in the bottom of the picture at http://www.digi.com/products/wireless-routers-gateways/routing-gateways/digiconnectwanfamily http://www.digi.com/products/wireless-routers-gateways/routi... These electrical substations are in the "middle of nowhere". We can't exactly call up the cable or telephone companies and get an Internet connection installed. Fortunately, cellular service is available, even though it is extremely slow in some of these locations. The devices are, at their most basic, cellular routers -- a LAN port on one side connects to the industrial equipment equipment and the device connects to the cellular network to give them Internet access. An IPSec VPN from the device back to the utility's office provides a connection to their management software so that they can communicate with the industrial equipment. The industrial gear is "smart". Need to disconnect a customer because they didn't pay their bill? Send out a digital message and their electricity gets shut off. Huge storm roll through the area? They can quickly see how many customers -- and where -- are without power. IP connectivity to the industrial equipment means they can control everything from their main office and not have to do a "truck roll" for every service change and such, saving them tons of time and money.

Seems like every 6 months someone discovers SHODAN and we get another article like this.

theboss 13y ago
For real.... If anyone wants the big talk HD gave on this, it was the keynote for 2012 DerbyCon. Here's the slides. https://speakerdeck.com/hdm/derbycon-2012-the-wild-west https://speakerdeck.com/hdm/derbycon-2012-the-wild-west It starts out really fluffy and eventually he gets to the good stuff (i.e. old grandmas computers from 1998 that are still online)
cnlwsu 13y ago
its a 3 month old article, so its good to be reminded mid-next-article
- christianbryant 13y ago
  True, though "old" articles like this are interesting reads as case studies. When you analyse how many times these type of discoveries occur and then trend, it offers both sides of the camp interesting data.
achillean 13y ago
Expect to see more kinds of these stories as people discover new things (hint: medical devices). And the advent of the "Internet of Things" is also putting Shodan in a new light. For the technical folks though, I hope to release some cool new stuff soon :)

UART or Serial Port is the first thing that you need when developing embedded systems. It is simple, easy to hook up to your Laptop (via USB Serial convertors). With terminal emulators like Teraterm, Putty (or the nefarious Hyperterminal) or Minicom, you can get to see what's happening on the device. 1. All devices running linux will have /dev/console tied to UART. 2. For others, typically a printf routine would write to UART. The problem the article talks about occurs when the OEM "forgets" to turn off the UART (either in software or just by breaking the pins during manufacturing).

csense 13y ago
> The problem the article talks about occurs when the OEM "forgets" to turn off the UART (either in software or just by breaking the pins during manufacturing). Did you read the article? He's not hacking commercial/industrial devices like gas pumps by driving to a gas station and using a USB-serial adapter to physically attach a laptop or smartphone. Rather, the owners of the gas pumps legitimately attached a serial-to-Ethernet translator themselves to allow applications on their TCP/IP network to control the gas pump hardware. But they didn't secure the connection with an effective firewall or authentication requirement, so now not just the legitimate application, but anyone on the public Internet, can send commands to the pump.
bobdvb 13y ago
I agree the article is unfair to say that serial connections are old technology and outmoded. The serial connection is a useful tool for electronics designers and engineers because it is very simple to implement & adds almost no incremental cost to the design. Even if it is internet connected, your "smart" TV has serial connections which you probably can't access but they are there for the designers (not for the general public). Yes, domestically serial has gone the way of the floppy disk, but that doesn't mean it doesn't have a purpose (a but like print journalism really).

jlgaddis 13y ago

I remember freaking out when I first read HDM's post on the Digi devices[0] because I have a ton of the Digi devices deployed at electrical substations for a customer (electric utility). They are connected to the cellular networks and have public IP addresses. Fortunately, I was rewarded for being paranoid and doing everything I could to lock these devices down pre-deployment as none of them were vulnerable to these attacks. It was certainly a stressful day as I checked each of them one by one, though. [0]: https://community.rapid7.com/community/metasploit/blog/2013/04/23/serial-offenders-widespread-flaws-in-serial-port-servers https://community.rapid7.com/community/metasploit/blog/2013/...

daemon13 13y ago
What are the typical use cases for Digi and similar devices?
- jlgaddis 13y ago
  In my case, it's to provide IP connectivity where it is otherwise not available. I'm using the devices shown in the bottom of the picture at http://www.digi.com/products/wireless-routers-gateways/routing-gateways/digiconnectwanfamily http://www.digi.com/products/wireless-routers-gateways/routi... These electrical substations are in the "middle of nowhere". We can't exactly call up the cable or telephone companies and get an Internet connection installed. Fortunately, cellular service is available, even though it is extremely slow in some of these locations. The devices are, at their most basic, cellular routers -- a LAN port on one side connects to the industrial equipment equipment and the device connects to the cellular network to give them Internet access. An IPSec VPN from the device back to the utility's office provides a connection to their management software so that they can communicate with the industrial equipment. The industrial gear is "smart". Need to disconnect a customer because they didn't pay their bill? Send out a digital message and their electricity gets shut off. Huge storm roll through the area? They can quickly see how many customers -- and where -- are without power. IP connectivity to the industrial equipment means they can control everything from their main office and not have to do a "truck roll" for every service change and such, saving them tons of time and money.