Schneier on Security

Clive Robinson • November 6, 2010 9:37 AM

@ Bruce,

OFF Topic.

I don’t hapen to know if you have heard of the SHODAN service,

http://www.shodanhq.com/

Well it’s a front end to a database of server identifing information gleaned from the internet, that’s been around for about a year.

Apparently crackers have been using it to find poorly configured SCADA systems connected to the Internet (for those who have been in a coma for a couple of months lookup Stuxnet and Iranian Nuclear systems to see what the issues are with Internet connected SCADA systems).

The Industrial ControlSystems branch of CERT has put out the following advisory,

http://www.us-cert.gov/control_systems/pdf/ICS-Alert-10-301-01.pdf

It’s unfortunatly the usuall lacking in technical details stuff CERT kicks out, but people have been complaining to them about SHODAN.