If you're interested in the internet and security, you've probably heard of Shodan. The name Shodan is short for Sentient Hyper-Optimized Data Access Network, and it refers to a malicious intelligence search engine from the 1990s game System Shock.
In the 2010s, the name has been appropriated by an online service that describes itself as “the world’s first search engine for internet-connected devices.”
To explain how it works, imagine that Shodan bots scan the internet, just like Googlebot does, connecting to potential services, recording the data, creating an index of the results.
The results can be useful if you want to know what is visible to others on your network.
For example, most home routers are configured via a web interface on port 80 (without HTTP encryption) or port 443 (with HTTPS encryption).
In an ideal world, no one but you can connect to your router's web server.
So, someone would want to search for their own router via Shodan. If it shows up, some configuration is wrong.
Of course, when Shodan finds a bug that allows it to record online services and data, it can go much further.
If the Shodan scanner discovers a login page and finds that it can be accessed due to not changing the factory passwords or a bad configuration, it can end up recording and indexing very personal data that you would never make publicly available.
For example, if Shodan is able to connect to port 554 on your home router, it means it can discover a camera that is accessible online from the internet, because this port is commonly used for RTSP, or Real Time Streaming Protocol.
If you haven't set up any security controls on your camera, then Shodan's visit won't stop at discovering the vulnerability. It will most likely continue and you'll find a live snapshot from your camera online.
Of course, if you use a babycam in your baby's bedroom, or a surveillance camera in your home, you certainly don't want to see such moments on the internet.
Unfortunately, the most popular searches on Shodan's search engine are for online webcams, the dreambox (a streaming media device), and of course, pre-selected passwords.
What can I do?
Port scanning your computer is legal. If you don't know how to do it, look for open services, or a search engine like Shodan. Also an easy application is the on-demand security scanner, Nmap.
If you don't know how to do it, make sure that the person you ask for help from is completely trustworthy.
If you find your camera, your kettle, your Wi-Fi security settings, your home thermostat, make sure to do something immediately. Lock the doors….! and change all the default passwords.
