SHODAN and default passwords: the lowest hanging fruit

Searching SHODAN for default password brings up 995 results for sites that include those two words in the banners. Undoubtedly there are many other sites out there using default passwords, but these would be the absolute low hanging fruit because not only could they possibly be using the defaults, they're actually advertising what the defaults are. This isn't to say that none of these sites have changed their default passwords; undoubtedly some (or even many) have. The first result I looked at appeared to be a print server:

HTTP/1.0 401
Date: Sat, 21 Dec 1996 12:00:00 GMT
Www-authenticate: Basic realm="Default password:1234"
Server: PrintSir WEBPORT 1.1

It doesn't list the default username, but a null username or "admin" is always a good guess, and in this case, "admin" and "1234" worked. To be fair, I didn't do anything beyond that (I have no desire to be malicious).

How many more of those 995 sites actually use the listed default passwords?

"Your account has been locked. Please contact your system administrator."

When I arrived at work this morning I attempted to log onto my desktop and got the dreaded "Your account has been locked. Please contact your system administrator."

Calling the "help desk" the technician cheerfully confirmed that my account had indeed been locked, and that there was a note not to enable it, but to contact the "security center."

Calling the "security center" the person answering the phone also confirmed that my account had been locked (thanks!) and claimed that it had been done on behalf of someone in another security office.

Calling the next security office it was confirmed a third time that my account had been locked, and the kind gentleman let me know that he would have it unlocked in no time.

But wait, I asked. What had I done to warrant my account being locked? He said he was looking into it. Really? They lock my account, is readily prepared to unlock it, but is still looking into why it was locked in the first place?

About ten minutes later my phone rang and the nice lady on the other end told me she was writing up an "incident report." Oh, great. Well, I figured, I would at least figure out what I had done wrong.

She asked me if I had visited a site called CoTweet. Well, of course I had. I use CoTweet at work to manage my Twitter account, and had been using it every day for at least six months or so. She kindly informed me that CoTweet was on the "prohibited sites" list. She then asked, "What do you use the site for? Is it work-related?" I explained that I use CoTweet (or Twitter for that matter) to keep in contact with other people in the security community. And that yes, it was work-related, but if they insisted, I could live without going to this site (while you might see this as backing down, from my perspective as a contractor it would not be a good idea to pick such a fight with a client's IT staff).

The phone call was short and sweet, and I politely mentioned that if CoTweet was indeed prohibited they should actually block it, which they do not. (Some other sites like Facebook and YouTube are in fact blocked, but neither CoTweet, nor Twitter for that matter, are blocked). She finished up the incident report and my account was active again within 15 minutes or so.

The incident brings up a few questions:

1. Why lock someone's account but not provide them with the information that it had actually been locked, and a means to contact someone for it to be unlocked? I had to figure out everything myself, which clearly wasn't rocket science, but surely there should be some notification procedure in place.

2. Why isn't Twitter, or CoTweet, actually blocked? If you were to go to Facebook, YouTube, or any number of other sites, you would be greeted with a bright red warning screen (affectionately called the "red screen of death") explaining that the site was blocked (incidentally, this seems to happen fairly regularly for most users; mostly by accident, and doesn't ever seen to result in any "incidents"). However, Twitter is generally accessible (at least it has been; lately it errors out but the RSOD is never displayed); and CoTweet works.

3. What sites are actually on the prohibited list? Clearly the blocked sites are on this list, but apparently other non-blocked sites (like Twitter and CoTweet) are also on the list). You might be wondering at this point (as I was), would it be possible to see this list so that we know what sites to avoid? Well, of course not. No one has ever claimed to have seen such a prohibited list, but it apparently does exist. I am not suggesting that my place of work does not have the right to block whatever sites they see fit; they clearly do have this right. But I think they also have a responsibility to their users to let them know the specific policy. Social networking sites are embraced by some businesses, but under fire by many others. So I understand the issues with these sites. But educating your users on such policies is key.

One could argue that Twitter is not really necessary, or "work-related," but I find it invaluable on a number of fronts. With Twitter and CoTweet effectively out of bounds (and third party clients like TweetDeck would just been seen as attempting to bypass their apparent restrictions, or a violation by installing unapproved software. So for the time being (during the day at least), I'm out...

Taking SHODAN for a spin

I talked about SHODAN in my previous post. After playing around with it a little more, I figured it might be a good idea to post some of my findings.

First a quick update: I tried the SHODAN Firefox plugin and it works like a champ--it simply opens up a sidebar with SHODAN search options, and submitting a search opens up a new tab with the search results. It also includes a few links to some common password lists which could undoubtedly be useful with your findings.

Now, moving on. I think it is useful to recognize right off the bat that as a search engine, SHODAN's results are banners. So knowing what to look for in specific banners is the key to optimizing search results. Let's start with a very basic search for "cisco-ios". The resulting banners look something like this:

HTTP/1.0 401 Unauthorized
Date: Fri, 20 Nov 2009 01:42:13 GMT
Www-authenticate: Basic realm="level_15 or view_access"
Connection: close
Accept-ranges: none
Server: cisco-IOS

Note that the search parameter is picking up on the Server: line. Also important to note is the Www-authenticate: line which is indicating the requirement for a username and password (in my experience, these are typically pop-up boxes).

As of today, there are 67,533 such results. Further filtering indicates that virtually all (67,526) are port 80 and just a handful are port 23. So by in large these are all web-based interfaces to Cisco devices. An even more interesting addition to our filter is the search for "Www-authenticate" which results in 65,675 results. By common sense we can deduce that there are nearly 2,000 such Cisco devices that do not include "Www-authenticate" in their banner.

Here is an example of one such device that does not include the authentication line:

HTTP/1.0 200 OK
Transfer-encoding: chunked
Accept-ranges: none
Expires: Fri, 20 Nov 2009 00:49:00 GMT
Server: cisco-IOS
Last-modified: Fri, 20 Nov 2009 00:49:00 GMT
Connection: close
Cache-control: no-store, no-cache, must-revalidate
Date: Fri, 20 Nov 2009 00:49:00 GMT
Content-type: text/html

The unique feature between the two banners shown here is that "Last-modified" shows up here but not in any of the 65,675 "Www-authenticate" banners. In fact, there are 1,201 such results for "Last-modified".

Following such results indicates a variety of Cisco devices in various states, none of which appear to have any authentication enabled. One such result was http://69.74.xxx.xxx/xhome.htm which was the Cisco Device Manager for a Catalyst 3560 series Switch. The web interface gave me full access to the device with no username or password required (in fact, none was even set). In fact, the switch name and port descriptions were useful in identifying the company and even the exact building where the switch was located, and even some of the businesses that were using the switch.

Many results led to Cisco HTML interfaces:

Cisco Systems
Accessing Cisco 1841 "device name here"
Show diagnostic log - display the diagnostic log.
Monitor the router - HTML access to the command line interface at level 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
Connectivity test - ping the nameserver.

Show tech-support - display information commonly needed by tech support.
Extended Ping - Send extended ping commands.

QoS Device Manager - Configure and monitor QoS through the web interface.

And yes, the levels are linked to further HTML pages with all the Cisco IOS commands literally spelled out for you:

http://69.74.xxx.xxx/level/15/exec/-/show/running-config/CR
Building configuration...

Current configuration : 2344 bytes
!
! Last configuration change at 12:50:30 UTC Thu Nov 26 2009
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname (hostname here)
...

I won't list the rest of the config, but I think you get the picture. ;-)

Other results led to "Cisco Router Web Setup" pages and other devices in various states of configuration. Again, none required any authentication.

I suspect this is just scratching the surface, so I'm looking forward to see what others come up with!

Is SHODAN really controversial?

This week saw the release of SHODAN, a computer search engine. From the site:

SHODAN lets you find servers/ routers/ etc. by using the simple search bar up above. Most of the data in the index covers web servers at the moment, but there is some data on FTP, Telnet and SSH services as well. Let me know which services interest you the most and I'll prioritize them in my scanning.

Lets say you want to find servers running the 'Apache' web daemon. A simple attempt would be to use:

apache

How about finding only apache servers running version 2.2.3?

apache 2.2.3

You can also narrow down the results using the following search parameters:

* country:2-letter country code
* hostname:full or partial host name
* net:IP range using CIDR notation (ex: 18.7.7.0/24 )
* port:21, 22, 23 or 80


For example: get all web (port:80) hosts running 'apache' in switzerland (country:CH) that also have '.ch' in any of their domain names:

apache country:CH port:80 hostname:.ch

Those in the security community are immediately interested because of the potential to easily find vulnerable boxes by searching for specific versions of particular software (as advertised in the collected banners). Twitter was alive on Tuesday with a number of interesting searches.

Richard Bejtlich (@taosecurity) makes some interesting comments:

Shodan is a dream for those wanting to spend Thanksgiving looking for vulnerable boxes, and a nightmare for their owners. I would not be surprised if shodan.surtri.com disappears in the next few days after receiving a call or two from TLAs or LEAs or .mil's. I predict a mad scramble by intruders during the next 24-48 hours as they use Shodan to locate, own, and secure boxes before others do...Personally I think Shodan will disappear.

I certainly agree that finding vulnerable boxes will be a main focus of SHODAN's users. But the suggestion that this site may quickly disappear? While I agree with Richard more often then not, I find it difficult to fathom a scenario where this would happen. SHODAN is a search engine for computers, but in an even more basic sense it is a search engine of collected banners; banners that are available to anyone who would search these boxes. This search engine has already done the scanning. In a sense, SHODAN is a rainbow table made up of collected banners.

If I thought it was likely that the site would simply disappear due to pressure from the government or law enforcement, I could understand the "mad scramble." However, I just don't see this collection of data rising to the level where the government, law enforcement, or some TLA, would pressure the site to disappear.

I would be curious if Richard would be willing to pick an "over/under" style date after which he thinks SHODAN will be taken down. A friendly wager, perhaps? ;-)

Matthew Franz asks: "Where's the Controversy about Shodan?" Matt admits that he doesn't really come to any definite conclusions ("I'm not sure what to think"), but he did seem concerned that among his followers there were "absolutely no questions about the site..."

I think perhaps that Matt answers his own question: Other than those posed by Mr. Bejtlich, there really haven't been any questions about the site. Twitter posts about SHODAN revolve around crafting interesting queries, not moral quandaries about the site itself. I'm more inclined to the view of Simple Nomad, who says: "WTF?!? shodan is controversial? Not one of you ever scan and grab banners before? Grow a nutsack, security industry."

I'd be curious to hear your thoughts.

UPDATE: A SHODAN Firefox plugin is already available. I haven't tested it yet.

A short lesson in Polish history

The conference that I'm attending here in Poland (CONFidence 2009/2.0) is being held in a movie theater, “Kino Femina,” and is located at Aleja Solidarnosci 115. Is is at the intersection of Aleja Jana Pawla II which makes this a very interesting intersection, to say the least. A bit of translation assistance might be useful, though!

"Aleja Solidarnosci" means Solidarity Avenue. "Aleja Jana Pawla II" means John Paul II Avenue. If you are at all familiar with Polish history of the 1970s and 1980s, the significance should be pretty obvious!

On political opinions and credibility

On a number of occasions in the past, I have been told by well-meaning women that because I am a man, I simply cannot understand the issues surrounding abortion and therefore my opinion doesn't matter (for the record, I consider myself pro-life--although I think if I was pro-choice these same women would happily embrace my opinion). While I don't subscribe to this notion, I certainly understand it.

But let's suspend reality for a moment and consider this notion to be true--that if you're a man, your position on abortion does not matter specifically because you are a man. In other words, you have this deep emotional attachment to something that others cannot or have not experienced, and that attachment or experience makes you uniquely qualified and the expense of others who do not have that attachment or experience.

Now let us consider the many in our country who oppose the wars in Iraq and/or Afghanistan. Should it not follow that unless you have actually been to Iraq, or Afghanistan, that your opinion on the war does not matter?

I'm more of the belief that anyone is certainly welcome to their opinions on any issue, but the amount of credibility that I give to that opinion will be based on a couple of factors. Sure, I would lend more credibility to someone's opinion about Iraq or Afghanistan more if they had actually been there, but on the other hand I also respect anyone's opinion as long as it is reasonably thought-out. So emotional attachment and experience do play a role, but it is not the only role, and it is not black and white. To me the second factor is more important, and that is whether or not you vote. If you haven't voted, I don't care what you've done, your opinion is of the lowest credibility.

Move your pawns at your own peril

One of the themes of Irving Chernev’s Logical Chess: Move by Move is development, specifically developing pieces, not pawns; and furthermore, only moving those pawns which facilitate development of your pieces. Unnecessary pawn moves also permanently weaken your overall structure, particularly those that protect your King. As an amateur, I understand these principles but sometimes struggle to apply them well. Even more difficult for me is taking advantage of my opponent when they fail to do apply these principles. The following game was particularly instructive to me because my opponent made what I believed to be unnecessary pawn moves and I was able to immediately attack the weaknesses that resulted from this position.

The fix is in: Hypocrisy in Massachusetts politics

Back in 2004 when Senator John Kerry was running for President and Republican Mitt Romney was Governor of Massachusetts, the Massachusetts legislature passed a law that would have prevented Romney from replacing Kerry (if he had won) with an interim appointment until a new election could be set up. This was pure politics, wanting to prevent a Republican governor from replacing a Democrat with a Republican.

Fast forward to 2009. In the wake of Senator Edward Kennedy's death, now Massachusetts Governor Deval Patrick (a Democrat) could not replace Kennedy because of the very law the legislature passed in 2004 to deal with Romney. So what do you do when laws don't suit you? Just change them.

Both houses of the Massachusetts legislature passed bills allowing Patrick to appoint an interim Senator; Patrick is expected to sign the bill into law today. On top of that, Massachusetts laws typically don't go into effect for 90 days. So what do you do when procedure doesn't suit you? Just waive the procedure. Yes, Massachusetts is expected to waive the 90 day waiting period, because, well, the Democrats really need that 60th vote in the Senate. Furthermore, Democrats hold an absolutely majority in Massachusetts politics, so Republicans can't really do anything about it.

No doubt both parties play the political game, but this one just seems over the top.