Defcon 20 - Dan Tentler - Drinking from the caffeine firehose we know as shodan

[@Pzoco]

Wow when I saw Gigantium, I almost spit out my coffee.. - I live in that town, and I drive by that building every single day.

[@vissago]

In this particular case the issue is that the sysop would be *NOT* the IT or security group. The way to fix this is to include security when making decisions about putting technology into the business - not just computers, all technology.

[@ashleybishton742]

So true, it's so easy to VNC into a thing and then control it with out any authentication. Still in 2020 it's unreal how many you can just stumble across. And you can literally set alarms destroy factory's do anything you want lol. Loads of windows PC's and loads of shells literally waiting for you to get into with a VNC viewer.

[@halftome]

What would a pentest report look like in a few years? 3 vulnerable fridges, 0-day found for washing machine. garbage bin uses outdated firmware. Kitchen lights vulnerable to format string exploits :)

[@cybercat1531]

Tamási Benjamin here I am 4 years later.

[@bFix]

how can you dislike this video? This presentation is awesome :D

[@SteefHartman]

people get scared, and dislike the fact he scared them with the truth

[@dannyphilipson2641]

there's only 26

[@NedTheDread]

You can alternatively right click on the input field, choose "Inspect Element" and change the type attribute of the input box from "password" to "text".

[@mattmchenry6835]

Viss I love these videos, I work with a lot of that equipment, mostly cameras (I def saw plenty of exacqvision servers) and intercoms but some of the control devices too and power stuff like lieberts and what not. It's super fun watching your videos and trying to see how many interfaces I recognize.

[@mattmchenry6835]

Lol Daktronics and default creds. Signaltec signs are a lot of fun too, it's like the easiest interface ever.

[@R_got_a_name_change]

I keep coming back to this. Classic

[@vissago]

On and off since 2008. Freelanced for 5 years, then took several full time jobs. At the moment I'm working for a pentest firm doing %100 pentest.

[@burneyburney]

awesome presentation

[@twiztidbagz]

As a new user of shodan, I have been able to find tons of cameras and tons of home nas drives that have a TON of free space on them... I am wondering... When you decide to locate these other things, such as traffic cameras, etc etc How do you start? do you find a popular manufacturer? How does that process word? I would love to hear a talk about that.

[@tepadno]

2:05 "some German thing counting cubing meters of gas" :D

[@EradWir]

I like your humor bro

[@philippfarag]

@@EradWir i do not

[@Some_Beach]

@@philippfarag good thing no one asked

[@vissago]

Yep. And the more tech we get, the more people will connect everything together. If they don't stop to think for ten seconds about what could possibly go wrong, or even ask someone, expect more of this sort of stuff to crop up :D

[@mygueldf1462]

what a fking dead crowd tho, this guy is hilarious and brilliant at the same time!

[@wizardsbane]

Kind of funny/scary how much damage he could have done if he really wanted to.

[@vissago]

That, my friend, is the difference between blackhats and whitehats. Blackhats will just go nuts, and never tell a soul of the vulnerability. Or exploit it somehow for gain.

[@sighwestberry5079]

vissago freedom is a appealling idea, but most people in this country prefer locks. At some point we will find ourselves locked in a prison of our own making. In fact we are almost there!

[@osterpenpen9379]

What's scary is that the information he's using is published to the Internet.

[@BrainSlugs83]

IMHO the issue is that a lot of this gear defaults to require no security credentials at all -- the first time you power something up, like the integrated web server in a random piece of equipment for a 100 megawatt hydroelectric dam, it should force you to integrate it with your internal security, setup it's own security, or disable itself. Problem is, everyone wants it cheaper, which means the web servers and solutions are built/architected by junior developers.

[@vissago]

It's a matter of manual fingerprinting, basically. You have to find something you know about and see what kinds of tcp banners it has, then you can search for them. A lot of embedded devices all use the same (sometimes crappy) codebase. For example, search for "auther". You'll find both cameras and print servers. It's literally like feeling around in the dark, which is why I wrote my screenshotter tool.

[@vissago]

You mean the one that deobfuscates passwords that are obfuscated by asterisks? Google for 'chrome extension html revealer and password revealer'. KZbin wont let me paste links.

[@zigitroll]

damn it i never should have watched this at 2am now i feel like i just smoked crack

[@TC-ht9jv]

I know

[@twiztidbagz]

Understood. Thank you for the response. The Screenshotter tool, and other related things on your blog?

[@brandonwood0]

I just tried shodan....How do you use the search results to actually access the devices? Do you paste the IP in the browser bar...totally new to this...Is there a beginners guide somewhere?

[@TravisTerrell]

I used to live near an indoor mall and a large national department store provided public wifi. A quick network scan found unsecured* network printers. I made it a point to walk within wifi range and print out 1 meme image a day. I like to think that it was brightening somebody's day to have their printer randomly shoot out [relatively wholesome] memes, but of course I will never know. *_unsecured network printer_ is effectively an oxymoron, haha.

[@RobloxFun100]

You are a GENIUS. Can you show me the AC controller? Message me the link, please, if you still have it.

[@vissago]

They could at least do a lot of things - the trouble is that generally speaking the people in charge of these systems ARENT computer people - they're the bar manager, or a warehouse manager, or the facilities group - they are unaware of the implications of these things.

[@0100-s8t]

This was a great and funny talk, thanks for posting it :D

[@trickznmix]

Ahk cool. btw your 'who watches the watchers' joke was excellent. Keep up the good work and all the best.

[@gFamWeb]

Autoplate is now gone on Shodan. there is only one result and you cannot telnet into it.

[@vissago]

Sir - at some point - we all come from 4chan.

[@vissago]

Apples to oranges, my friend. The internet is one gigantic neighborhood. and there are people in other countries that ROUTINELY go around "trying peoples doors", as it were. If you leave your door unlocked on the internet, you're gonna have a bad time.

[@masnoy]

THANKS YOU SHODAN CREATOR AND METASPLOIT TEAM !!! AM I ALONE FEEL POWER OF CYBER GOD?!? ;D WATCH DOGS IS RESTING =D

[@VaraAccountti]

What you do if you get access for them?

[@TahreyUK]

So, it didn't take me too long just using google to work out what the Security Integrator company was ... shoulda blanked out the whole name :D Let's put it this way, they're located in a small business park deep in a forest in Massachusetts...

[@realitynowassigned]

He is the kind of dude that would call it shodon

[@VaraAccountti]

What is meaning of shodan?

[@tomnesheim8817]

ok, so you can go in and "look" at some of these traffic cams and other systems. But can the administrator of these devices see that you were in there after the fact and then send the cops after you for spying or industrial espionage? Or do you have to take measures to hide yourself?

[@thelemonking3288]

***** tor. tor is always the answer

[@AayVy]

kind of scared i have been in that place in demark.!!!!!! i live in denmark btw

[@trickznmix]

Sir, how long have you been pentesting?

[@brandonwood0]

What do you think?

[@SurfKahuna2008]

IP convergence has only just begun... soon enough my shoes laces will each have their own IP address so that each one can remind me if its coming loose... (Nike+ is already close to assigning IPs to your dang shoe!)

[@yellowklayman]

Can you imagine a day when someone finds an exploit for a fridge and turns a whole brand into a bot network?

[@powerjbn9283]

*camera

[@sonofnone116]

2022 says Russia might just pull that type of nonsense.

[@jayynecobb]

Whered you get the name from? Thats my nickname, been my name for 30 years

[@Krissam2k]

He didn't hack anything, all the things he showed were open to everyone, that's the point.

[@njblair143]

Game theorists 13:30

[@VaraAccountti]

How i can find passwords?

[@fraserbc]

You're obviously a script kiddie so why would anyone tell you?

[@vissago]

youtube wont let me link it. Check out my toorcon talk (next vid?) it's got the links to the github repos.

[@Krissam2k]

in before someone assassinates someone important by disabling his cars breaks over the internet with no credentials.

[@vissago]

Agreed - people are being lazy and silly and not taking security into consideration when putting webservers on stuff. By design, scada is NOT SUPPOSED TO BE ON THE INTERNET. I went to a handful of talks. Zfasels talk was rad, Rendermans talk was rad - I missed a BUNCH I wanted to go to, so I need the CDs.

[@undercop5567]

This is how the NSA must feel... I sure as hell wouldn't want to lose the ability to monitor cool shit like this, though it doesn't seem to have much of a legal practical purpose

[@dwerg1]

Holy shit, I've been to Skallerup Klit.

[@5m4rt6uy]

there is a hack to post links on youtube just remove the htp... and w3 . and change forward slash to back slash and you're good to go

[@XRatedPoetry]

Some guy in Germanys car is going to be really clean

[@Skydmig]

Haha yeah I've been to that building. So random

[@vissago]

Thanks! :D

[@SurfKahuna2008]

Are you trolling? Do you not see the purpose of IP convergence? The purpose is to streamline the devices and products that we normally track using archaic means using a unified network, which can use targeted and/or unified interfaces for asset tracking. Knowledge is power, right? Rubbish bins being trackable can help the collection service know which bins are out, which can help determine routes, collection times, staffing, etc., which results in direct cost savings to the end users.

[@EnygmaHD]

Awesome

[@Speedy.V]

This is REALLY NOT FUNNY...its actually HORRIFYING to see how many of these "connected" devices are so unsecured.

[@njblair143]

Seems pretty fuckin funny to me. And probably to anyone that grew up in, and embraced the i Generation.

[@nuvaintereseaza]

I died at 1:40 xD

[@xmodalloy]

Anyone else here after the east coast pipeline hack scare?

[@aaronhamilton6872]

they could at least use ssh...

[@tax_evad3r]

I came from 4chan :D

[@bencze1]

I found the presentation style really annoying, not sure if it was the author or it was intended for a different audience. Looks like you were trying too hard to 'sell' it. The content was entertaining, some funny stuff, I guess this facebook world will continue for some while until some really, really bad incidents happen (ey, no i'm not promoting anything just some realistic thinking).

[@vissago]

Heh, thanks!

[@vissago]

Rendermans talk was badass - he found out the system that commercial aircraft use to keep track of planes flying around has little to no security and permits the injection of phantom aircraft. youtube com/watch?v=NSLqRXyxiBo (put the dots in) this is one of the presenters injecting a fake aircraft into the system - locally, so it doesnt make people shit their pants - and demonstrating that the system recognizes the aircraft.

[@OK2BCK]

running web servers on various things, he makes it sound like a bad thing but it's not true. lack of security and common sense is a bad thing.

[@pfelon]

Cactus

[@MVrockersPS3]

lol

[@RAGHAVENDRASINGH17]

this video DOESNT mention HOW he found this, video looks like bragging

[@edbo10]

the video description literally says that it was found via shodan, why can't people read the damn description it's not so much bragging so much as it is highlighting how people never change the default password on wifi-enabled devices

[@RAGHAVENDRASINGH17]

@@edbo10 i can see that he used shodan, i was asking about specific commands

[@neliscph]

Denmark got owned by iLon

[@NourSelim0]

is this what I think it is? the web server throwing at you: <input type="password" value="password123" /> because if that's the case, I can't even start to describe how stupid these people are! also, you wouldn't need a plugin for that, just plain old view source :D

[@valaha]

Welcome to Anonymous

[@morrisova2]

VIPmsg- I know ur probably a hack but what if your Jewish? ...

[@AayVy]

holy shit he has hacked alot of placed i have been!!!!