Many of our readers have probably crossed paths with the Shodan search engine, dedicated to exposing all kinds of misconfigured devices on the Web. Surveillance cameras, IP cameras, routers, printers... the list is enormous, but with the advance of the so-called Internet of Things, it will surely get much longer. The big question is: Where does user responsibility end, and where does that of manufacturers begin?
Schools, bank exits, stores, gardens, pools, alleys, construction zones, parking lots, squares... all this and much more can appear with the help of Shodan, a sort of "search engine of shame" that leaves exposed all those devices connected to the Web with their factory configuration. Of course, it is necessary to highlight that this is not hacking: The search engine presents many protected cameras, but there are others that still preserve their basic parameters (for example, "admin" as username and password), and in more isolated cases, they don't even have that. Want to try it? Let's see...
Basically, all you have to do is enter the search box of Shodan with "port:554 has_screenshot:true", without the quotes. Each of the results represents an exposed camera. From a garage in Hungary to a living room in South Korea, the lack of care knows no borders. This brings to light one of the most worrying aspects of the Internet of Things: It is not secure. Despite everything, Shodan's function is benign, since its crawler takes a snapshot of the camera and continues on, but if a person reveals all their movements through a camera that was supposedly installed to protect him, his family and his home, what he does is invite disaster.
As if that were not enough, we are facing a perfect storm: The average user feels that they are not obliged to know anything about cybersecurity, while on the other hand, manufacturers cut advanced protection features in order to reduce costs. According to various researchers, informing the user is not enough, so it will be necessary to pressure manufacturers to provide proper security in their products, and if they refuse, apply sanctions. In 2014, the US FTC fined TRENDnet for the serious security flaws in its webcams. The scale of the problem is chilling, since Shodan itself reports millions of cameras in each search. Until a series of minimum standards for the security of these devices is imposed, the feeling is that the Internet of Things will be a true minefield...
