achillean

13 ms·

91.
by achillean 5y ago
We have a service where we'll notify you if anything new gets exposed on one of your IPs: https://monitor.shodan.io If you have a membership (which is a one-time payment of $49 - no subscription necessary) then you can moni
92.
by achillean 5y ago
We actually scan on average once a week. I used that language to be ultra conservative but I'll need to change it. For the past 8+ years we've been doing weekly scans.
93.
by achillean 5y ago
It's possible to check every IP on the Internet nowadays so you don't need to keep a list. You can just brute-force check every IPv4 address in less than an hour. I've written on the subject a few times: https://bl
94.
by achillean 5y ago
It's where I learned about stateless scanning. Without scanrand and its stateless scanning technique Shodan wouldn't have been possible.
95.
by achillean 6y ago
This is already used by quite a few organizations/ websites: https://beta.shodan.io/search/report?query=http.securitytxt%... We've been indexing it for a while now and we haven't seen the number of websi
96.
by achillean 6y ago
Do you have any details you can share with us (support@shodan.io) about how attackers are using Shodan? We have a lot of mechanisms to prevent abuse (blocking anonymous access, limiting number of results/ searches, restricting certain
97.
by achillean 6y ago
Lots of other websites have similar headers :) https://beta.shodan.io/search?query=http+bite+my+shiny https://beta.shodan.io/search?query=GNU+Terry+Pratchett
98.
by achillean 6y ago
Woah I had no idea about these 100 responses. Looks like there are quite a few of them on the Internet: https://beta.shodan.io/search/report?query=http.status%3A%3E...
99.
by achillean 6y ago
Some mobile networks in the US will give you a public IP whereas in most other countries they do Carrier-NAT. You can get a better sense of it when looking at the IP space owners for the devices: https://beta.shodan.io/searc
100.
by achillean 6y ago
Internet-accessble industrial control systems have been a problem for many years now. It's a documented issue but it's difficult to fix for a variety of reasons: 1. Difficult to identify the owner: a lot of the devices are on mobi
101.
by achillean 6y ago
FYI there are still more than 8,000 NNTP servers on the Internet: https://beta.shodan.io/search?query=200+nntp
102.
by achillean 6y ago
They must've looked at their traffic stats, seen that most users are mobile and decided to focus on that version instead of having substantially different layouts for mobile vs desktop.
103.
by achillean 6y ago
There are most definitely production systems connected to the Internet. And the advice given by vendors ranges dramatically: https://twitter.com/achillean/status/559124740611506178/phot... It's definitel
104.
by achillean 6y ago
Btw Shodan checks for the existence of the security.txt file and shows/ stores the information if it's available. Here's an example of how it looks: https://beta.shodan.io/host/172.217.31.43#securitytxt
105.
by achillean 6y ago
No, very often they do add the favicons! That makes it easier to locate websites that are outside of your expected IP space but are pretending to belong to you. For example: https://beta.shodan.io/search?query=http.favicon.h
106.
by achillean 6y ago
Something I didn't expect were the number of developers that hadn't heard of favicons before. Got quite a few people asking what those icons were. Btw there are security use-cases around them as well nowadays (ex. detecting phishi
107.
by achillean 6y ago
I've stopped writing blog posts on it because it's still going on and there's not much new to add: https://blog.shodan.io/its-still-the-data-stupid/ You can search for Redis instances that have disabled
108.
by achillean 6y ago
Completely agree and I experienced much of that on my own journey. Customers would ask whether I'm interested in taking VC or if I wanted to keep it as a "lifestyle business" - not realizing that we were doing more than fine
109.
by achillean 6y ago
I believe the recommended configuration is to run OpenVPN via UDP and only accept connections from trusted certificates. If you're running it on TCP then a scanner would be able to see that you have an open port but still can't se
110.
by achillean 6y ago
Shodan does something like a portscan of the entire Internet, albeit fewer ports than if you did nmap -p-
111.
by achillean 6y ago
Btw we do also offer the ability to request scans ( https://help.shodan.io/the-basics/on-demand-scanning ) but it's only available w/ a paying account (including the membership which is a one-time payment of $4
112.
by achillean 6y ago
It also depends how you've configured OpenVPN. If you've properly configured to drop connections that didn't provide a valid certificate then even running it on a regular port would make it invisible to scanners.
113.
by achillean 6y ago
I don't think that's a good comparison but I doubt we'll agree on it and I'm obviously biased on the matter. I hope the additional context will help readers make their own decision.
114.
by achillean 6y ago
Shodan has also had https://me.shodan.io for a while. And you're incorrect about the number of ports/ data. Feel free to explore the data at https://beta.shodan.io
115.
by achillean 6y ago
All of the NTP servers had hostnames ending in "shodan.io". The pool account itself was registered using a shodan.io email address. I told the pool operator what we were doing. And I answered anybody who emailed me asking about it
116.
by achillean 6y ago
We don't retain web logs and the way users interact with Shodan doesn't change the way Shodan crawls the Internet. I.e. using the website/ API doesn't change how we look at the Internet.
117.
by achillean 6y ago
One of my favorite games and I picked the name as an homage to my favorite game where you play a hacker. And to be fair, I didn't think that Shodan would become as big as it has when I first launched the website.
118.
by achillean 6y ago
Yes, we block access to the website from known VPNs/ Tor/ proxies/ cloud
119.
by achillean 6y ago
Actually monitoring your own attack surface is the most common reason companies purchase a subscription. See: https://monitor.shodan.io
120.
by achillean 6y ago
Are you sure it's a 404 and not a 403? We block access to the website from the cloud so you're probably getting blocked.

More ›