Incident: Internet of Things Vulnerabilities Exposed by Shodan Search Engine

Published Date: 2016-01-25

Postmortem Analysis
Timeline 1. The software failure incident involving the Shodan search engine and the exposure of vulnerabilities in internet-connected devices was highlighted in the article published on 2016-01-25 [39817]. Therefore, the software failure incident likely occurred in January 2016.
System The software failure incident mentioned in the article primarily involves the failure of internet-connected devices due to vulnerabilities and insecurities. The systems that failed in this incident include: 1. Internet-connected webcams with predictable default passwords or no passwords at all [39817]. 2. Shodan search engine, which scans every internet-connected device looking for vulnerabilities and insecurities [39817]. 3. Insecam, a site that collated and aggregated web cameras for voyeuristic purposes [39817]. 4. Manufacturers of internet of things devices that do not prioritize security, leading to widespread vulnerabilities [39817]. 5. Lack of regulatory oversight and enforcement to ensure internet-connected devices meet security standards [39817].
Responsible Organization 1. The software failure incident was caused by the lack of proper security precautions in internet-connected devices, allowing vulnerabilities to be exploited by entities searching for insecurities like Shodan [39817].
Impacted Organization 1. Users of web-connected smoke alarms and smart light fixtures [39817] 2. Individuals whose privacy was compromised by the insecure webcams [39817] 3. Manufacturers of internet-connected devices, particularly webcams and industrial machinery [39817]
Software Causes 1. Lack of proper security precautions in internet-connected devices, leading to vulnerabilities exploited by the Shodan search engine [39817].
Non-software Causes 1. Lack of proper security precautions for web-connected devices, such as webcams, leading to vulnerabilities and insecurities [39817].
Impacts 1. The software failure incident allowed users to find live video feeds from internet-connected webcams lacking proper security precautions, potentially leading to privacy violations and intrusion [39817]. 2. The incident highlighted the widespread availability of webcams with predictable default passwords or no passwords at all, indicating a lack of security measures in internet-connected devices [39817]. 3. The software failure incident exposed vulnerabilities in critical infrastructures such as power plants and wind turbines, making it easier for rogue individuals to exploit these weaknesses [39817]. 4. The incident demonstrated the need for regulatory measures and security standards in the Internet of Things industry to address the root problem of inadequate security in connected devices [39817].
Preventions 1. Implementing strong security measures for internet-connected devices, such as requiring complex passwords and regular security updates, could have prevented the software failure incident [39817]. 2. Manufacturers should prioritize security in their devices and follow principles like supporting prompt, agile, and secure updates, as proposed by the grassroots organization I Am The Cavalry [39817]. 3. Regulatory bodies like the Information Commissioners Office should take a proactive approach, rather than reactive, in addressing internet security issues to prevent incidents like the one caused by Shodan [39817].
Fixes 1. Implementing a combination of regulatory measures and rating systems to incentivize manufacturers to prioritize security in internet-connected devices [39817]. 2. Manufacturers abiding by a set of principles, similar to a "hippocratic oath," for connected medical devices, including supporting prompt, agile, and secure updates, and collaborating with third-party researchers to address security issues [39817].
References 1. Technology site Ars Technica [39817] 2. Security expert Marc Goodman 3. Shodan website and its feed [39817]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to insecure webcams and vulnerabilities has happened again within the same organization or with its products and services. The article mentions that Shodan, the search engine for vulnerabilities in internet-connected devices, has now introduced a new feed for members to easily access footage from unsecured web cameras, highlighting the ongoing issue of poor internet security [39817]. (b) The software failure incident related to insecure webcams and vulnerabilities has also happened at multiple organizations or with their products and services. The article discusses how Shodan has been used to find vulnerabilities in various devices, including nuclear plants in France that were connected to the internet, indicating a broader issue with internet security across different sectors and organizations [39817].
Phase (Design/Operation) design, operation (a) The article highlights a software failure incident related to the design phase where a search engine called Shodan was launched in 2009 with the aim of scanning every internet-connected device looking for vulnerabilities and insecurities. This search engine, named after a malicious AI from video games, reveals weaknesses that are already out there, potentially exposing devices to exploitation [39817]. (b) The article also mentions a software failure incident related to the operation phase where webcams with predictable default passwords or no passwords at all are still widely available. This lack of proper security measures in the operation of these devices makes them vulnerable to being accessed and exploited by unauthorized individuals [39817].
Boundary (Internal/External) within_system (a) within_system: The software failure incident discussed in the articles is primarily within the system. The failure is related to vulnerabilities and insecurities within internet-connected devices, such as webcams with predictable default passwords or no passwords at all, making them easily accessible to unauthorized individuals. Shodan, the search engine in question, scans every internet-connected device looking for weaknesses and exposes these vulnerabilities. The incident highlights the lack of proper security measures within the devices themselves, making them susceptible to exploitation [39817]. (b) outside_system: The software failure incident is not primarily due to contributing factors originating from outside the system. The focus is on the vulnerabilities and insecurities within the internet-connected devices themselves, rather than external factors causing the failure [39817].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The incident described in the articles is related to a search engine called Shodan, which scans every internet-connected device looking for vulnerabilities and insecurities. Shodan itself doesn't introduce vulnerabilities but rather reveals weaknesses that are already present in the devices connected to the internet [39817]. (b) The software failure incident occurring due to human actions: The articles mention that the search engine Shodan, created by John Matherly, has faced criticism for potentially aiding rogue individuals in exploiting vulnerabilities in critical infrastructures. Security expert Marc Goodman highlighted concerns that Shodan provides detailed information on how to exploit various devices, potentially lowering the technical bar for malicious activities [39817].
Dimension (Hardware/Software) software (a) The articles do not specifically mention any software failure incident occurring due to contributing factors originating in hardware. (b) The articles discuss software failure incidents related to vulnerabilities and insecurities in internet-connected devices. Shodan, a search engine for vulnerabilities, scans every internet-connected device looking for weaknesses [39817]. It highlights the ease of finding, scraping, and delivering footage from unsecured web cameras, emphasizing the poor state of internet security [39817]. Additionally, the articles mention instances where major industrial machinery controls were easily accessible with rudimentary credentials, leading to potential security breaches [39817]. These incidents point to software failures originating from vulnerabilities in the software and lack of proper security measures.
Objective (Malicious/Non-malicious) malicious (a) The software failure incident mentioned in the articles is malicious in nature. The incident involves a search engine called Shodan, which was launched with the aim of scanning every internet-connected device looking for vulnerabilities and insecurities. Security expert Marc Goodman highlighted that Shodan provides tips on how to exploit everything from power plants to wind turbines, making it easier for rogue individuals to hack critical infrastructures [39817]. Additionally, the articles mention how Shodan offers a paid feed that demonstrates how easy it is to find, scrape, and deliver footage from unsecured web cameras, highlighting the poor state of internet security [39817]. This incident showcases a malicious use of software to exploit vulnerabilities in connected devices for potentially harmful purposes.
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The software failure incident related to poor decisions can be seen in the case of the search engine Shodan. Shodan was launched with the aim of scanning every internet-connected device looking for vulnerabilities and insecurities. Despite the intention to reveal weaknesses that are already out there, Shodan has faced criticism for potentially aiding malicious activities. Security expert Marc Goodman highlighted that Shodan provides tips on how to exploit critical infrastructures, lowering the technical bar for individuals to hack into systems [39817]. (b) The software failure incident related to accidental decisions or unintended consequences can be observed in the case of webcams with predictable default passwords or no passwords at all. These webcams are still widely available, making them vulnerable to unauthorized access. Additionally, the article mentions that even though more reputable manufacturers have developed secure devices, the market is still flooded with insecure options due to price competition. This unintentional consequence of having easily accessible webcams with poor security measures contributes to the overall issue of internet security vulnerabilities [39817].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident occurring due to development incompetence is highlighted in the article. It discusses how web-connected devices like smoke alarms and smart light fixtures faced issues such as being unintentionally deactivated or refusing to work with certain lightbulbs after a software update. These incidents point towards failures introduced due to the lack of professional competence in ensuring proper functionality and compatibility of the software with various devices [39817]. (b) The article also mentions incidents where webcams with predictable default passwords or no passwords at all were easily accessible through a search engine called Shodan. This accidental exposure of unsecured web cameras and the ease with which footage could be scraped and delivered highlights a failure due to contributing factors introduced accidentally, such as poor security practices and lack of proper authentication mechanisms [39817].
Duration unknown The articles do not provide specific information about the duration of the software failure incident related to the Shodan search engine and the vulnerabilities it exposed. Therefore, it is unknown whether the software failure incident was permanent or temporary based on the information provided in the articles.
Behaviour omission, value, byzantine (a) crash: The articles do not specifically mention a software failure incident related to a crash where the system loses state and does not perform any of its intended functions. (b) omission: The articles highlight instances where web-connected smoke alarms could be "unintentionally deactivated" with a wave of a hand, and smart light fixtures refused to work with lightbulbs made by other brands after a software update. These instances can be considered as failures due to the system omitting to perform its intended functions at certain instances [39817]. (c) timing: The articles do not mention a software failure incident related to timing, where the system performs its intended functions correctly but too late or too early. (d) value: The articles discuss the issue of webcams with predictable default passwords or no passwords at all being widely available, leading to a failure where the system performs its intended functions incorrectly by allowing unauthorized access to the cameras [39817]. (e) byzantine: The behavior of the software failure incident related to the Shodan search engine can be categorized as a byzantine failure. Shodan, a search engine that scans every internet-connected device looking for vulnerabilities, provides detailed information on how to exploit various devices, potentially leading to inconsistent responses and interactions in the system [39817]. (f) other: The articles do not describe a specific behavior of the software failure incident that falls outside the options provided.

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence unknown (a) death: There is no mention of people losing their lives due to the software failure incident in the provided article. [39817]
Domain information, transportation, natural_resources, manufacturing, utilities The software failure incident mentioned in the article is related to various industries: (a) The incident highlights the issue of security vulnerabilities in internet-connected devices, which can impact the production and distribution of information [39817]. (b) The incident also raises concerns about the security of internet-connected devices, which could potentially affect transportation systems if they are compromised [39817]. (c) The security flaws in internet-connected devices, as highlighted in the article, could have implications for industries involved in extracting natural resources if critical systems are compromised [39817]. (d) While not directly mentioned in the article, the security vulnerabilities in internet-connected devices could have implications for sales industries if systems handling transactions are affected. (e) The incident does not specifically mention construction industries, but if construction companies use internet-connected devices for security or monitoring purposes, they could be at risk if those devices are compromised. (f) The security vulnerabilities in internet-connected devices could impact manufacturing industries if critical systems controlling production processes are compromised. (g) Industries related to utilities, such as power plants, could be at risk if their internet-connected devices are vulnerable to exploitation, as mentioned in the article [39817]. (h) The incident does not directly mention finance industries, but if financial institutions use internet-connected devices for transactions or security, they could be impacted by security vulnerabilities. (i) The incident does not directly mention knowledge industries, but if educational institutions or research facilities use internet-connected devices, they could be at risk if those devices are not secure. (j) The incident does not specifically mention health industries, but if healthcare facilities use internet-connected devices for patient monitoring or data management, they could be affected by security vulnerabilities. (k) The incident does not directly mention entertainment industries, but if entertainment venues or hospitality services use internet-connected devices, they could be at risk if those devices are compromised. (l) The incident does not directly mention government industries, but if government agencies use internet-connected devices for critical infrastructure or public services, they could be impacted by security vulnerabilities. (m) The incident is related to the cybersecurity implications of internet-connected devices and does not fall into the specific industries mentioned in options (a) to (l).

Sources

Back to List