Evaluation of the ability of the Shodan search engine to identify Internet-facing industrial control devices

International Journal of Critical Infrastructure Protection

Volumn 7, Issue 2, 2014, Pages 114-123

  Bodenheim, Roland ^a   Butts, Jonathan ^a   Dunlap, Stephen ^a   Mullins, Barry ^a  

^a AIR FORCE INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

Industrial control systems; Mitigation; Security implications; Shodan

Indexed keywords

CONTROL; CONTROLLERS; FACINGS; INTERNET; PROGRAMMED CONTROL SYSTEMS; SEARCH ENGINES;

INDUSTRIAL CONTROL SYSTEMS; INDUSTRIAL CONTROLS; MANUFACTURING FACILITY; MITIGATION; MITIGATION STRATEGY; OIL-AND-GAS PIPELINES; SECURITY IMPLICATIONS; SHODAN;

NETWORK SECURITY;

EID: 84901462416     PISSN: 18745482     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.ijcip.2014.03.001     Document Type: Article

References (11)

1. Control System Integrators Association, What is a Control System Integrator? Madison, Wisconsin. URL 〈〉. http://www.controlsys.org/integrator/about.
2. S. Frei, Vulnerability Threat Trends, NSS Labs, Austin, Texas, 2013.
3. D. Goldman, Shodan: The Scariest Search Engine on the Internet, CNN Money, April 8, 2013.
4. A. Hildick-Smith, Security for Critical Infrastructure SCADA Systems, SANS Reading Room, GSEC Practical Assignment, Version 1.4c, Option 1, Bethesda, Maryland, 2005.
5. E. Leverett, Quantitatively assessing and visualizing industrial system attack surfaces (M.Phil. Dissertation), Darwin College, Computer Laboratory, University of Cambridge, Cambridge, United Kingdom, 2011.
6. J. Matherly, Shodan Computer Search. URL 〈〉. http://www.shodanhq.com.
7. R. O'Harrow, Cyber Search Engine Shodan Exposes Industrial Control Systems to New Risks, The Washington Post, June 3, 2012.
8. B. Radvanovsky, Shining a Light on a Big Problem, Tofino Blog, September 19, 2013.
9. U.S. Department of Homeland Security, Analysis of Shodan Computer Search Engine, Technical Report CSAR-10-025-01, Washington, DC, 2010.
10. U.S. Department of Homeland Security, ICS-CERT Alerts, Washington, DC. URL 〈〉. http://www.ics-cert.us-cert.gov/alerts.
11. U.S. Department of Homeland Security, ICS-CERT Monitor, Technical Report ICS-MM201210, Washington, DC, 2012.