Shodan – A Boogeyman’s BFF

Estimated Reading Time: 6 min

If you’ve ever heard me talk on OSINT one of the points I drive home is one I learned early from a colleague, Ian Amit (@iiamit) that if what you present doesn’t cause a change in behavior, it isn’t threat intel, it is intel/information.  Here’s a story on how I used OSINT techniques on my own organization in multiple ways, to cause a change in behavior.

Once upon a time in a land far far far away….there were device administrators that secured their devices properly….

/me wakes up disappointed

During my governance, risk and compliance days, before OSINT was a buzz word in the industry, one of the things organizations wanted to know (without hiring/contracting a pen-tester) was how vulnerable they were to “hackers” [I use that word sparingly as it has a very evil connotation to the ignorant masses].   Knowing they just asked me to boil the ocean, I worked to get them to narrow it down, and identify three things:

1.  WHAT are you worried about being attacked (i.e. specific assets)

And let me be the first to say that if the org doesn’t have a decent Asset and Data Classification Policy that’s actually implemented HA! sucks to be you.

2.  WHICH attack vectors concern you the most

3.  HOW do you want me to answer you (reporting format)

So after getting those nailed down,  I decided to finally put all the hours of education to good use so I felt less guilty about spending all that money getting a degree just to get past the HR gremlins that eat resumes.

We didn’t exactly have a threat model, and being in the “Risk Department”  (pfft!) they weren’t going to listen to me tell them they needed one.  [BTW Risk Analysis != Threat Modeling] Nonetheless, I realized the scope of concern they had included threats to network assets [as opposed to software, people, places etc].  Thus I went forth to identify vulnerabilities that c/would be exploited, and immediately went to a wonderful sight called Shodan 

that will tell you all kind of “wonderful” things about an organization’s threat vectors.  Leveraging a little knowledge of SQL and URL hacking I began running queries to check for some basic vulnerabilities that were not only available for my own perusal, but they were equally available for every other evil derp that didn’t like “us”.    I proceeded to exclaim rather loudly in the office “Are you Fuc41n6 Kidding ME?!” as I saw the results pour in.  So – now I knew it was not just bad…it was like Satan just gave a free pass on the bullet train straight to hell and you could hear him laughing like it was a carnival ride.

I hung my head in dismay, thinking – how am I going to communicate to “Management” just how bad this is?  Afterall they get vulnerability scans quarterly, monthly, weekly and in some cases daily – and they STILL don’t think the problem is “that bad.”  Technically, the Shodan results are nothing more than another data set reflecting vulnerabilities.

Then I remembered some very wise words

The supreme art of war is to subdue the enemy without fighting -Sun Tzu

So I put together an initial OSINT report of generic threat actor profiles that would like (and probably already were) exploiting that exposed via Shodan, but I didn’t send it. Instead, first I took what I learned in Shodan and I created a “How to Sho-Dan” (pun on a C-levles name)  slide deck.  I mean, nobody is ever going to believe my report, I’ll be lucky if 1/3rd of them click on a single link and even luckier if 1/10th of them even understand what they’re reading/clicking on.

Then, I OSINT’d (ummm yeah that’s a word now just roll with me here) so I OSINT’d my fellow employees.  I read their social media profiles, eavesdropped at the water cooler, socially engineered (SE’d) them over coffee to figure out what were 1) their favorite & most hated places for work-hosted events 2) their favorite conference room 3) their idea of “fun” learning at work was.  Then I SE’d my boss into spending money, used his corporate credit card (with his approval), and set up a Lunch & Learn for non-security IT people including devs, netops team, help desk etc.  With food & drink in hand, and a promise of a prize for anyone who could tell me what the query revealed we began learning How To Sho-Dan.

EUREKA!

When it was all over they realized some very critical things:

1. NONE of them had to even create an account to run a query…wut?! this is Open Source?!
2. They didn’t have to know SQL or URL hacking, they only had to know key words and use the search boxes
3. If they did have an account, they could get even more comprehensive reports

THE SINGLE MOST IMPORTANT LESSON:  If they could do it – so could bad guys, and there were definitely some serious boogeymen in the world.

IN THE END

I had successfully moved from data to information to intel to threat intel because the Lunch & Learn, combined with the OSINT report I provided caused a change in behavior, otherwise it was just intel and more vulnerability data.

I sent the OSINT report to the managers that had signed up for (even those that didn’t attend) the Lunch & Learn, and now with them empowered with context and a better understanding of the threat vectors,  I watched change explode.

1. The vulnerability remediation tickets started getting a lot more love by all departments.
2. The network team implemented changes to their firewall approval process, patching firmware, and network architecture.
3. The developers began reconsidering what ports they really needed
4. The server team modified their provisioning process to include a security review/approval milestone that was a show stopper.
5. I even convinced C-levels to plan for an internal pen-testing team.

TAKEAWAYS:

1. If minimally tech savvy people can do/google/youtube it then so can the bad guys
2. OSINT on your own team is not evil 🙂
3. Sometimes an OSINT report is far less valuable than an OSINT hands-on

BONUS
If you want to see a very hilarious and scary presentation go watch my colleague Dan Tentler’s (@Viss) talk from #DEFCON2015 as he exposes ridiculously huge #Fail of things accessible via the Internet.

Below are a list of the (sterilized) Shodan Queries that I used during the training and to generate a report on an OSINT tool that could/was being leveraged by threat actors targeting the organization.

1. Hosts found w/ banner details stating “230 – Any Password will work”
   https://www.shodan.io/search?query=-421+-fe_sendauth+-invalid+-401+-530+%22password%22+org%3A%22Company_Name%22+%22230+Any%22
2. Hosts found with banner stating “Use ‘passwd’ to set your login password this will disable telnet and enable SSH”
   https://www.shodan.io/search?query=-421+-fe_sendauth+-invalid+-401+-530+%22password%22+org%3A%22Company_Name%22+%22passwd%22
3. Hosts found with banner stating “230 Anonymous access granted, restrictions apply”
   https://www.shodan.io/search?query=”230+Anonymous”+”root”+org%3A”Company_Name”
4. FTP Servers reflected as allowing Anonymous access
   https://www.shodan.io/search?query=-534+-530+port%3A21+org%3A%22Company_Name%22
5. Anything Company_Name
   https://www.shodan.io/search?query=org%3A”Company_Name”
6. Company_Name & Default Passwords
   https://www.shodan.io/search?query=%22default+password%22+org%3A%22Company_Name%22
7. Company_Name, Password
   https://www.shodan.io/search?query=-530+%22password%22+org%3A%22Company_Name%22
8. Company_Name and OpenSSH Ports
   https://www.shodan.io/search?query=openssh+port%3A22+org%3A%22Company_Name%22
9. Company_Name and Splunk on port 8089
   https://www.shodan.io/search?query=port%3A8089+splunkd+org%3A%22Company_Name%22
10. Company_Name, MySQL on port 3306
    https://www.shodan.io/search?query=port%3A3306+org%3A%22Company_Name%22+product%3A%22MySQL%22
11. Company_Name, “200 OK”, “Set-Cookie expires 2016”
    https://www.shodan.io/search?query=%22Set-Cookie+expires+2016%22+%22200+OK%22+org%3A%22Company_Name%22

For use with the Search Box if you don’t like the URLs

• city:”$city”
• country:$country
• geo:$lat,$lon
• os:$operatingSystem
• net:$ipRange/$cidr
• org:”$OrgName”
• product:”$product name in here”
• isp:”$ISP Name Here”
• asn:”AS######”
• devicetype:”firewall”
• ports:80, 443