Daniel

InfoSec researcher, SIEM archeologist & malware analyst posting interesting stuff I find unsecured on the wondernet. BTC Tips 3Chpu93g4QRGdt2m7Z75UXDVokEoq6DZeQ

[Daniel @macroform_node]

A #pixsys #embedded development test system in Italy based on the #texasinstruments #cortexA8 processor, running #windowsCE v7, #UnsecuredVNC and linked to a host machine.

#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch #Shodan #ShodanIO @shodanhq

[Daniel @macroform_node]

#ElectricalSubstation somewhere in #Luxembourg w/ #UnsecuredVNC access to a control panel. The #wondernet tells me clicking the big green button turns it red. #NotRecommended

#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch #Shodan #ShodanIO @shodanhq

[Daniel @macroform_node]

You can't make this stuff up... From the search results on @ShodanHQ just now:
"Server Name: just so you know this is literally me"
#Furries in #China with #UnsecuredVNC

#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch #Shodan #ShodanIO

[Daniel @macroform_node]

Maybe don't leave your @GLCommInc #PacketExpert in place, with #openVNC connectivity and no authentication to secure it. #bushleaguetechthings

#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch #Shodan

[Daniel @macroform_node]

Probably some sort of tooling/industrial machine in Russia, open to the internet. But it's #Russia, so who cares? Might focus on exposed Russian stuff for a while, come to think of it. #blyat #infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch #Shodan

[Daniel @macroform_node]

Italian winery w/ tanks/pumps/etc controls open to the internet. Big red button for enabling the exchange pumps, unrestricted access to change all the values for pressures, temps, & speed. Not great.
#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch #Shodan

[Daniel @macroform_node]

Sometimes I find things that are accessible intentionally and super interesting.. Like this VNC Slot Machine. Check out the GitHub link in the URL in the screenshot for more details. Neat!
#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch #Shodan

[Daniel @macroform_node]

Industrial tooling machinery control panel in Italy open to the internet. Why? For the glory of Satan of course!
No wait. It's just lack of knowing any better.
#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch #Shodan

[Daniel @macroform_node]

Maybe don't leave your @heizung smart home control panel open to the internet?
#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch #Shodan

[Daniel @macroform_node]

Hey @wiseteam_ maybe don't have unsecured VNC access to login screens to your #OpenSense platform
#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch #Shodan

[Daniel @macroform_node]

Some Baidu device in Shanghai doing god knows what with its admin/config interface open to the world via VNC. How's YOUR perimeter?
#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch #Shodan

[Daniel @macroform_node]

Insecure VNC sessions and root shells. Don't be this guy. Know your perimeter.
#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch

[Daniel @macroform_node]

https://t.co/zbhsPJfUPb
#infosec #informationsecurity #atodaso #cybersecurity #duh

[Daniel @macroform_node]

1) Export 172k results from https://t.co/eTuVWv2KAY
2) Pipe to curl -sk -H "X-Requested-With: XMLHttpRequest" -X POST 'hxxps://x.x.x.x/userportal/Controller?mode=8700&operation=1&datagrid=179&json={"x":"test"}' | grep -q 'Session Expired'
3) ?
4) Profit!
#Sophos #RCE #CVE20221040

[Daniel @macroform_node]

Industrial grain drying silo with temperature controls and everything, open to the internet with no credentials necessary to change temps and anything else.
#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch

[Daniel @macroform_node]

Some #Linux OS on a #TinkerBoard with #VNC forwarded to it with no authentication necessary.
#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch

[Daniel @macroform_node]

#IRTE #digitalradio link control panel open to the internet.. Interesting that there's a password required for some things, but not firmware updates.
#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch

[Daniel @macroform_node]

A whole-ass #cyberwar going on out there & #Amazon's STILL letting people spin up #AWS servers with unsecured telnet #rootaccess. Four of 2400 found. I'd say ~40% of those 2400 I found stayed accessible.
#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch

[Daniel @macroform_node]

Not terrible but definitely not ok.. #SecuredServers with #openVNCaccess to a couple of their #CentOS systems. At least they arn't idling logged in. But one could def. just idle till they see something spicy
#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch

[Daniel @macroform_node]

98.175.139.217
166.200.161.202
Some #PIPSTechnology #Autoplate license plate recognition and #ViolationEnforcementSystem devices, open to the internet with no password for telnet access
#infosec #skroobsec #cybersecurity #informationsecurity #infosecresearch