Root Index | ISCSECURITY Masterclass Series
Zane A. — Security Consultant
IoT Search Engines: The Attack Surface You Can't See.
The Bottom Line: If you're not hunting your own infrastructure on Shodan, someone else is. And they're probably doing it faster.
IoT search engines have evolved from curiosity to core adversary infrastructure. IABs, ransomware crews, and state actors don't scan your network anymore, they query it. Passive. Silent. Instant. Here's the latest reality.
Why This Matters Now:
• Zero-Noise Recon: Attackers map entire ASNs from a coffee shop. No packets. No logs. Just API calls and Boolean logic.
• Credentials Still Default: admin:admin on Hikvision, blank passwords on MikroTik, debug shells on industrial gateways.
One device = domain compromise.
• Shadow IT Exploded: MQTT brokers, Prometheus endpoints, Docker APIs on OT gateways, exposed S3 buckets tied to smart devices.
The perimeter isn't dead, it just moved to IoT backends.
• AI-Powered Targeting: LLMs parse engine JSON, correlate firmware versions with N-days, and draft spear-phishing pretexts based on your discovered camera models and badge systems.
• Ransomware Pivoting: NAS devices, HVAC controllers, and NVRs are now double-extortion repositories and Cobalt Strike redirectors.
OT isn't separate anymore, it's the soft underbelly.
The latest Toolkit (Beyond Shodan)
• Shodan: Still king for global enumeration, screenshots, and vuln: mapping.
• Censys: Certificate transparency king. Hunt orphaned cloud endpoints and M&A shadow assets via SANs.
• GreyNoise: Contextualize your findings. If that exposed device is already being exploited en masse, you're not theoretical, you're late.
• FOFA: Chinese firmware and obscure DVR/NVR hunting. Unmatched for HTTP body signatures on Asian-market IoT.
• Netlas: Rising fast. SSL/TLS cert search, response body indexing, lower API burn.
• Criminal IP: Real-time risk scoring + stealer-log correlation. Spot already-compromised assets before they hit your SIEM.
• Onyphe: Fusion intel. Correlates IPs with dark web mentions and threat actor infrastructure.
How do Attackers Actually Use Them:
1. Auto-Ingest Pipelines: Cron jobs hitting org:"TargetCorp" vuln:CVE-XXXX-XXXX. New exposures drop straight into exploitation queues within minutes.
2. CT Log Pivoting: Wildcard cert (*.target.com) → Censys/Netlas backtrace → pre-production environments and forgotten acquisitions.
3. Firmware Supply Chain Mapping: FOFA/ZoomEye identify specific router versions across an ASN → correlated with leaked Original Equipment Manufacturer (OEM) source or N-days → reliable exploitation without touching the target.
4. IoT-as-Proxy: Compromised routers/cameras become SOCKS proxies and C2 redirectors. Engines verify geolocation and uptime before malware deployment.
5. Credential Pre-Validation: Exposed Fortinet VPN + fresh stealer-log session cookie = instant access, no brute force needed.
6. AI Vishing: "Hi, this is Verkada support. We see your twelve MV32s are running outdated firmware..." Generated by LLMs fed with engine data.
Query Snippets to Bookmark:
For Shodan:
Vulnerable industrial target - asn:AS15169 product:"Apache Flink" vuln:CVE-2020-17519
Defensive Action: Audit your cloud infrastructure for exposed Apache Flink dashboards to prevent remote code execution.
OT in the wild - port:502 country:"DE" "Schneider Electric"
Defensive Action: Ensure programmable logic controllers (PLCs) and industrial gateways are never directly routable from the public internet.
Cloud-native IoT backend - ssl:"Kubernetes Ingress Controller" http.status:200
For Censys:
Shadow IT via certs - services.tls.certificates.leaf_data.subject.common_name: "*.target.com"
Defensive Action: Replace target.com with your organization's domain to discover rogue certificates and unauthorized cloud deployments.
Exposed MQTT - services.banner: "MQTT" and services.port: 1883
Defensive Action: Check if your development environments are leaking unauthenticated MQTT data streams. Enforce TLS on port 8883.
For FOFA:
Router firmware hunt - ip="203.0.113.0/24" && title="RouterOS" && header="MikroTik"
NVR/DVR exposure - app="Dahua-IPC" || app="Hikvision-Webs"
Defensive Action: Isolate surveillance and physical security networks entirely from the corporate LAN and internet via strict network segmentation.
What to Audit:
• NVR/DVR: Hikvision, Dahua, Uniview with admin:12345 or admin:admin
• Routers: MikroTik Winbox (8291), Ubiquiti AirOS panels → converted to C2 proxies
• OT Gateways: Modbus/TCP (502), BACnet (47808), IEC 104; often zero-auth
• Medical PACS: DICOM on 104/11112, frequently ancient Windows embedded
• Printers: HP/Canon/Epson web panels → document exfiltration and firmware pivoting
• Smart Buildings: HVAC, access control, elevator APIs bridging IT/OT with no segmentation
• Cloud IoT: Exposed AWS IoT Core, Azure IoT Hub MQTT brokers, missing ACLs
• Solar/BMS: Inverter management and battery systems = physical environment disruption
OPSEC in 60 Seconds:
• Cross-reference across engines. One index is never enough.
• Rotate API keys post-engagement. Assume query logs are retained forever.
• Never verify from corporate/home IPs. Disposable VPS or commercial VPN exits only.
• Sanitize JSON/screenshots of metadata before archiving.
• Open captures in isolated VMs. Tracking pixels and WebRTC leaks are real.
• Honeypot check: static banners, unrealistic uptime, Mirai-like defaults.
The Workflow (Condensed):
1. Map ASN/netblocks (WHOIS, PeeringDB, BGP.HE)
2. Pick your engine stack (West = Shodan/Censys/Netlas | Asia/OT = FOFA/ZoomEye)
3. Build compound queries. Chain filters. Reduce noise.
4. Stream to SQLite/Elasticsearch via APIs. Timestamp everything.
5. Verify passively first. Check cert dates, screenshots, history.
6. Pivot through GreyNoise/Onyphe. Active exploitation changes the math.
7. Active verification only through anonymized infrastructure. Authorized scope only.
Final Thought:
The gap between reconnaissance and intrusion is measured in hours, not days. Attackers already automated this. If your ASM program isn't querying the same engines weekly, you're flying blind while the adversary has night vision.
Question for the thread: What's the most unexpected IoT device you've found exposed during a search? Bonus points if it had a default password.
ISCSECURITY Master Class Series: https://iscsecurity.org
Discussion: https://cyberr.ai/groups/iscsecurity
GitHub: github.com/zanderson73/
2 reactions · 0 comments