Shodan, a tool or a threat?

sebolani — Thu, 17 Dec 2009 19:30:43 +0000

Last month a new search engine appeared, called Shodan. It is a Computer Search Engine, available for free in public, allowing search for routers, servers, computers or any device that opens a port. It is based on a simple idea: Port scan, grab headers and index the results. Quoting Shodan’s quick guide, “SHODAN lets you find servers/ routers/ etc. by using the simple search bar up above. Most of the data in the index covers web servers at the moment, but there is some data on FTP, Telnet and SSH services as well. Let me know which services interest you the most and I’ll prioritize them in my scanning”.

On it’s initial release, Shodan search refine capabilities include country, hostname, ip-range (removed), port, service-version and header part specifications. Although the majority of the indexed results include web server data, it can be used already for other services too. Some examples:

The results of this Service can be used for malicious activities. With automated queries, exploiters could find in seconds vulnerable versions or legacy unpatched machines, botnets could find easier possibly vulnerable hosts or spammers could gather old/unpatched SMTP servers. On the other side, as a side effect, it may can help administrators to identify a possible vulnerability/security hole in their systems.

Shodan can be compared with the capability of forming specific queries to known search engines like Google. One difference is, Google can show data indexed from web page content while Shodan is more like a portscan utility, such us nmap, caching the results.

The service raises some ethical arguments and some discussions about its legality. Although it does not serve anything more that it is not already “in plain view”, port scanning can be considered illegal as they are not “authorized” connections to the hosts.

The FORWARD project blog » port scanning

Shodan, a tool or a threat?