Sunny Jamwal

Shodan began as a pet project of John Matherly to scan the internet for specific ports and gather data related to these ports. Since its launch in 2009 Shodan has gained notoriety in the recent years on becoming the go to source to analyze data gathered by Shodan by scouring the internet. Shodan crawls the internet regularly and stores data gathered for analysis by researchers, whitehats and blackhats. Anyone can subscribe and run queries against Shodan database by paying few hundred dollars as subscription fee. Shodan has made it very easy for anyone to gather reconnaissance data without actually doing any reconnaissance, moreover by not engaging directly with the target in reconnaissance phase there is no chance that target would be tipped. By using this information an attacker can easily create a profile for the target and launched targeted attacks on the target. The Author wanted to explore the risk associated with information exposed over the internet and readily available on Shodan for Ottawa Region. We hope that this presentation informs our audience, businesses and government on risks associated with exposing certain ports, services and unsupported software over the internet.