Top all-time · #4001
Shodan Blog
Company blog · blog.shodan.iosecurity
Shodan Blog is the company blog at blog.shodan.io, writing about security. Since 2015, 19 different Hacker News readers have linked it 71 times, most often “MongoDB instances publicly exposed on the Internet”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers cite the Shodan blog as background on internet-exposed databases and devices, such as misconfigured MongoDB instances, and on favicon hash searching. The comments link its posts as sources.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
The latest news and developments for Shodan.
Most-linked posts?
- MongoDB instances publicly exposed on the Internet4 people · 9 mentions · first linked 2015-12-15
- Finding MongoDB instances without any authentication4 people · 7 mentions · first linked 2015-07-19
- The HDFS Juggernaut3 people · 3 mentions · first linked 2017-05-31
- Accepting Crypto: A Vendor Perspective2 people · 4 mentions · first linked 2022-08-03
- /deep-dive-http-favicon/2 people · 3 mentions · first linked 2025-01-24
- Trends in Internet Exposure2 people · 3 mentions · first linked 2020-03-30
- Quick Look at Duplicate SSL Certificate Serial Numbers2 people · 2 mentions · first linked 2015-10-11
- Analyzing Post-WannaCry SMB Exposure on the Internet2 people · 2 mentions · first linked 2017-06-15
What Hacker News says?
Previously: https://blog.shodan.io/dont-be-clever/ > For example, you might know that Shodan crawls the Internet for industrial control systems (ICS). One of the most popular protocols in ICS is called Modbus that runs on port 502. At the moment, there are about 17,000 devices listening to Modbus on the default port. It turns out there are also 700 devices listening on port 503, again a one-off sort of situation. Pr…
Comment linking /dont-be-clever/
on “I stayed in a hotel with Android lightswitches and it was as bad as you'd think”Submitted Duplicate SSH Keys Everywhere as a story · 310 points
HN discussionIt has already happened in the past. Repeatedly. There's news coverage about this at least once a year. And it doesn't require using Shodan as there are plenty of open-source tools for scanning the Internet nowadays. For example, this was from the same news website a few years ago: https://www.bleepingcomputer.com/news/security/massive-wave-... I've also written about it many times: https://blog.shodan.io/its-the-da…
Comment linking /elastic-data-exposure-grows-to-3-2-pb/
on “New ‘Meow’ attack has deleted almost 4k unsecured databases”Submitted The HDFS Juggernaut as a story · 144 points
HN discussionUnfortunately it's rarely that simple. If you look at the currently exposed MongoDB instances you'll see that most of them are in the cloud without any obvious attribution. You could email the cloud providers and see if they will reach out to the end-user but chances are they already know about it. Here's an article I wrote on that subject, although it was related to industrial control systems: https://blog.shodan.i…
Comment linking /taking-things-offline-is-hard/
on “New ‘Meow’ attack has deleted almost 4k unsecured databases”Submitted Finding MongoDB instances without any authentication as a story · 131 points
HN discussionBy default though, MongoDB will only listen on localhost and I believe it'll show you a big warning on boot up if you don't have authentication configured. They used to listen on 0.0.0.0 by default but that was fixed many years ago. And this issue doesn't just affect MongoDB - imo since the "webscale" days it's been a favorite to knock on but the public exposure of data happens across many technologies. Here's a com…
Comment linking /elastic-data-exposure-grows-to-3-2-pb/
on “New ‘Meow’ attack has deleted almost 4k unsecured databases”Submitted The Country of Vietnam Resolves to Localhost as a story · 75 points
HN discussionShort answer: cloud images with poor defaults. I've written about this a few times before and the problem hasn't really changed since the article was posted: https://blog.shodan.io/its-the-data-stupid/
Comment linking /its-the-data-stupid/
on “New ‘Meow’ attack has deleted almost 4k unsecured databases”Submitted MongoDB instances publicly exposed on the Internet as a story · 70 points
HN discussionA story like this pops up every year and preventing ransomware/ mass-deletion of publicly exposed databases has proven to be very challenging to stop from happening. I mean, I wrote about this issue 5 years ago: https://blog.shodan.io/its-the-data-stupid/ We've also sent the raw data to various database vendors for free but even for them it's difficult to reach out to customers to get it fixed. And then there's alwa…
Comment linking /its-the-data-stupid/
on “New ‘Meow’ attack has deleted almost 4k unsecured databases”Submitted Accepting Crypto: A Vendor Perspective as a story · 10 points
HN discussionInternet-accessble industrial control systems have been a problem for many years now. It's a documented issue but it's difficult to fix for a variety of reasons: 1. Difficult to identify the owner: a lot of the devices are on mobile networks that don't point to an obvious owner. 2. Unknown criticality: is it a demo system or something used in production? 3. Security budget: lots of smaller utilities don't have a bud…
Comment linking /trends-in-internet-exposure/
on “Hacker increased chemical level at Oldsmar's city water system, sheriff says”Submitted Publicly accessible MongoDB instances on the Internet as a story · 10 points
HN discussionMongoDB listens to localhost by default and provides a few warnings on startup if you don't have authentication enabled. See: https://blog.shodan.io/its-still-the-data-stupid/ I believe more of the blame should be put onto markets that provide images with insecure settings as MongoDB doesn't bind to the public interface by default and hasn't done so for years.
Comment linking /its-still-the-data-stupid/
on “800M Email Addresses Leaked Online by Email Verification Service”Submitted Accepting Crypto: A Vendor Perspective as a story · 4 points
HN discussionYeah, the issue has existed for years and is widely documented in the security community. There are a few reasons why we haven't seen more widespread chaos: 1. Lack of network visibility by the owners of ICS 2. Availability > Forensics 3. VNC interfaces don't always provide full access And keep in mind that there aren't a huge number of these anonymous VNC instances to begin with. We're talking less than 10,000 inst…
Comment linking /state-of-control-systems-in-the-usa-2015-05/
on “VNC Roulette”Submitted Tracking HTTP/2 Adoption as a story · 4 points
HN discussionIt's possible to check every IP on the Internet nowadays so you don't need to keep a list. You can just brute-force check every IPv4 address in less than an hour. I've written on the subject a few times: https://blog.shodan.io/its-the-data-stupid/
Comment linking /its-the-data-stupid/
on “Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage”Submitted ISP Offers BitTorrent Caching as a story · 4 points
HN discussionSeeing the "_id" : ObjectId() fields indicates to me that this is likely a mongodb instance that was available to everyone. There's been a lot of talk about these recently[1] that I'm surprised this didn't come up sooner. [1] https://blog.shodan.io/its-still-the-data-stupid/
Comment linking /its-still-the-data-stupid/
on “191M US Voters’ Personal Info Exposed by Misconfigured Database”Submitted Introducing the Shodan Real-Time Stream as a story · 4 points
HN discussionYeah, I could definitely see that happening though the overall number of exposed MongoDBs has also increased. And there are Docker images that come w/ insecure defaults ala: https://hub.docker.com/r/swcc/docker-mongodb/~/dockerfile/ One of my concerns is that people are piling onto MongoDB because "it's web scale" and ignoring potentially systemic security issues that aren't specific to MongoDB. The same issue exist…
Comment linking /memory-as-a-service/
on “The MongoDB hack and the importance of secure defaults”Submitted Tracking Hacked Websites as a story · 4 points
HN discussion"Recent" versions aren't. If you install .rpm/.deb versions you're also covered (And anyone who deploys any service on an internet-facing server should know what they're doing) See https://blog.shodan.io/its-the-data-stupid/
Comment linking /its-the-data-stupid/
on “Online databases dropping like flies, with 10,000 falling to ransomware”Submitted Quick Look at Duplicate SSL Certificate Serial Numbers as a story · 3 points
HN discussionIt's also very difficult to identify the end-user of these control systems: https://blog.shodan.io/taking-things-offline-is-hard/
Comment linking /taking-things-offline-is-hard/
on “State of Industrial Control Systems in Poland and Switzerland”Submitted Taking Things Offline Is Hard as a story · 3 points
HN discussionThis is a long-standing issue that a lot of people are aware of but fixing it is difficult. I've written and presented on the topic a few times, see: https://blog.shodan.io/state-of-control-systems-in-the-usa-2...
Comment linking /state-of-control-systems-in-the-usa-2015-05/
on “Water treatment plant hacked, chemical mix changed for tap supplies”Submitted Hiding in Plain Sight as a story · 3 points
HN discussion
