Analyzing Internet-connected industrial equipment

The search engine Shodan crawls the Internet to collect banners from Internet connected devices. When making this information publicly available, anyone can search and find these devices. Results from Shodan show that it is not only web or mail servers that are connected, but also industrial Control Systems (ICS) and Internet of Things (IoT) devices. Some of these devices use protocols that were invented more than 20 years ago. These protocols are not designed to be exposed on the Internet and since they lack security mechanisms, they are vulnerable to attacks. With help from Shodan we have searched for vulnerable devices using search queries corresponding to ICS and IoT protocols. To find the security flaws in protocols, we utilized the vulnerability and exploit database Rapid7. Our results indicate that there are several hundreds of online devices that are vulnerable in Sweden.