 Welcome to drinking from the cafe and fire hose we know is showed on. Anybody recognize that slide? Anybody watch old weird out movies? All right, so a little bit about me. My name is Dan. People call me this. I'm a freelance contest guy. This is not just another show on talk. Today we're going to be turning showed on into a gateway drug. So normally what people put on the internet is what showed on will find. And that's kind of boring. It's been two years now. We know you can find switches and routers and servers and cameras and stuff like that. What else is there? So I don't know that anybody is actually doing this yet. And I don't think that there's any kind of accountability. So I figured I'd poke that bear. So a little bit on editorial policy. Anybody work for an organization that prevents you from scanning yourself like under penalty of death, no end mapping or will drag you out to the parking lot and sit on fire. So the bad guys can scan us, but I can't scan us. Rad. If you don't know you're on attack surface, then you're crippling yourself against the bad guys, right? So before we get started, this is entirely read only. Yes, I was connecting to random stuff on the internet, but it was for screenshots only. There was no changes made, nothing like that. No systems were altered entirely read only. So first and foremost, let's get straight to the fun stuff. A lot of cameras, like thousands, tens of thousands of cameras. These are March networks cameras, which are really funny. And when I connected to this camera, I saw something that seemed pretty interesting that there's a dude looking on monitors that appear to have exactly what I'm looking at on them. So who watches the watchers? Me. I watch the watchers. Skated gear, that's popular, right? Let's beat up on that. So skated gear on webcams. Well, okay, you have a skated equipment. It's bad juju to put skated equipment on the internet, so we know. So put a camera on it and put that on the internet. Great move. Other random stuff on webcams. This is some German thing counting cubic meters of gas, okay? But generally speaking, cameras are horrifically, horrifically boring. At the moment I have about 3,900 cameras and when I look at them in a browser, it kills my cable modem and it looks just like this. People's garages, old dude in a living room. Boring. I mean this is, yay, info check, right? And then I came across something like this. What on earth is this thing? What is a T2000? Who's rely on? I've never heard of these guys. What's the deal? So Google to the rescue. It's a hydrogen fuel cell that's used for industrial stuff that you can tell that into with no creds. That's fun. I didn't know you could tell that into these things. It looks pretty industrial. You can find bountiful documentation about the thing online. A lot of military installations tend to use this thing and they're apparently happy with, you know, random PDFs on the internet containing what military installations use this thing? Great. You can tell that into them. Here's how you use it. How you, your simple electrical connection diagram, right? So, you know, where would you normally find these things? Like, okay, now I know this thing and I know you can tell that into it and I know you can find it randomly on the internet by looking for 5 minutes. That's where you find them, okay? And all the things that you'll connect to randomly on the internet that are not servers and switches and routers, the security is horrifically, horrifically bad. Here's an example of a file that I pulled off of. I think it was an energy meter of some kind that you could, the link to this file existed in the source code off the main index.html and if you just hit this thing with W get and you literally open it in VI, I won't tell you what the password is but it's there and it's in clear text. Thanks, dudes. Wind farms, like giant fans that generate power from wind, this one's generating 37 amps, not bad. Lighting HVAC alarm systems, this is some cathedral, something I found, no creds, you just hit it with a browser and it shows you here's our stuff and here's temperature, everything is. Even down to the room, you can find out what temperature different rooms are and you can find out, you can mess with them if you really want to. Power meters and some of these things, this is really cool, the graphs I'll come back to you later but you can do trending based on the stuff that you find here, if you really wanted to be ultra creeper mode, you can watch these graphs and see when people turn their lights on and when people turn their lights off and yeah, it gets creepy. Heat pumps, this starts getting into the interesting side of things where with heat pumps, this is what you'd see in a building or a large hotel or something like that where you have this giant thing and it's feeding multiple ducts in multiple rooms. No creds, point a browser at it, good to go, and they get bigger and this one, you got three water heaters, it's got some sprinklers, it's got a pump, it's got some other stuff. Okay, this is getting interesting, right? Private residences, really rich people tend to use these things because it's kind of a whole automation thing, it's kind of cool to hit your house with a web browser and turn the lights on in your garage or something. They exist, yeah. So there's trending data in a lot of these things where you can identify at what times power goes up and down and at what times lights go on and off and what times air conditioning turns on and off and things like that. This one was for a solar water heater and you can see how the hot water comes in and it goes through different water heaters and it goes up to the panels on the roof and it comes out and you can see the temperatures and you can see the pumps and this will complain at you if the pumps malfunction and things like that, so that's fun. Familiar displays, you see that little thermostat there in the bottom right-hand corner, anybody ever seen one of those things? I was in a traffic court last year doing traffic school for something that I did on the road and for the life of us we couldn't figure out why the room was so incredibly cold and I had one of these things on it. Every time we went and turned the temperature up so that it wasn't like 50 degrees it went back down again and after finding this I sat there on my couch going oh I see there was probably some kid two rooms away going ha ha ha ha ha ha. Glorious, so you see those things you know that they're connected to a bigger system. The more you know, rainbow. More power systems, power systems that will aggregate like for apartment buildings, they'll aggregate the readings from power meters. Read only you can't really do much with it, you can't, there's no input but it's interesting stuff I guess. Larger industrial systems like the Siemens systems, these things the same sort of deal, they have a who would look at that and say I'm gonna put a web server on that. This seems like a good idea. Well somebody did and now they're on the internet by the tens of thousands. And some of these cases when you start getting into these larger infrastructures like you start getting into oh these are boilers that control hotels and giant industrial buildings so now you get into the whole contents under pressure so you start hesitating from the keyboard a bit saying these water heaters have their own little security measures in them because really you can do some damage with this if you wanted to. So I found a whole bunch of stuff right and a lot of it's kind of some of it's actionable but you know what what can you actually do with this stuff. Well OSint is fashionable so let's do that right. So level one simple recon right creeper mode level level zero. You can install a tool that I was using called chrome ultimate flag which will tell you a little bit about the IP address that you're visiting in the browser. You click the thingy and it tells you the IP address in the city and stuff like that. Let's craft you to know if you found ten thousand webcams and all you can see is just the square with the video. There's no extraneous information. There's no exit for anything like that so it's cool to know at least what city it's in. So you look at the camera your camera system like this and you know what what details can we see okay well it's daylight you know you look outside it's daylight there's somewhere within some kind of time zone near you whatever you look at maybe you can zoom in on the license plates and you can see what state they're in something like that. But in the top right of the frame and the top right photo here you can see that the camera is pointed at the door and the door has the company logo on it. So that was as easy as just taking a screenshot and horizontally flipping it right. And off to the right you can see that there's a desk and a computer and that particular camera was PanTiltZoom. So with no creds you can log into the system and PanTiltZoom around the camera in the lobby of this company. So I did. And I didn't I don't want to get anybody in trouble so I blacked out the name of the place but you can what's the text under the black box there? It says security integrators. Good job guys. So you're based on the name of the company and what state I could see that they were in. I did a little bit of homework and this is how far Google street you've got me. So this is like okay this is still creeper mode level zero. So let's go to creeper mode level one interaction. So now that you have that you find stuff on camera find stuff on the internet what can you do if you just wanted to reach out and touch them just a little bit. So I didn't do any of this this came to me after I published sort of my first blog post with my script and some of the code that I used to generate the stuff and I thought it was pretty funny but they were people that found a pizza place somewhere and I'm not sure how found out to the name of the pizza place and ended up on the fun with them doing a bunch of social engineering and they found some really bored people at like two in the morning in the back to hold up signs for the security cameras. So the security cameras at a pizza place that are exposed to the internet and some randoms on the internet found them and called the place and started having them hold up signs. I thought it was hilarious and like they were very open to this like that's that's the girl on the phone with the caller watching the camera and this photo this screenshot came from the person on the other side. Awesome so I mean you know it's simple and it was pretty like pretty benign but you could see how social engineering and in this light could be you know pretty hardcore. So you know level three yeah you guys ever see Die Hard 4 it's kind of silly they were driving around a truck hacking stuff okay well this is kind of like that except without Justin Long and like the pretty assassin Asian chick lady. So this guy did it with a you know several million dollars and like a truck full of equipment and like a black ops team and all this fun stuff well I did it with like my laptop and a bunch of coffee so let's do that right though this was essentially if you remember the movie it was just a gigantic social engineering campaign at the end right but the minute you find a device that has talent open that will let you shoot down a helicopter with a car I will pen test that system for free. So massive cooling equipment this is a warehouse I found somewhere in Central America that had 14 gigantic evaporative coolers connected to it this was like a food storage this is a food storage facility somewhere or some kind of I'm it could have been medical storage facility but each one of these evaporative coolers presumably could cool a room like this so the panel has details the panel will some of these listen on VNC and you can and you can connect to them and get specific data on what their names are and what buildings they're talking to and things like that so if you're doing pen tests and you want to do recon on a target and maybe it's a retail organization something that this is interesting stuff that gets overlooked a lot some of these things actually keep logs which is really funny because once you get in and it's completely open there are names of the names of the laptops of the people that run the thing so like entirely without trying or by happenstance I'm doing like there's intelligence leakage happening through these the skate equipment this one was a pretty hilarious find anybody familiar with Lieberts the company Lieberts they make giant UPS things and data centers you can put them in test mode from the internet test mode turns off the battery what happens when you do that to a data center people get angry I didn't do it but man some of these like I mentioned really have VNC touch panels this one this one has some sort of liquid control flow valve operation and you can you can pause and change the flow of the chart and you can also modify but you go much farther than this thing but you presumably can change the flow rate of the valves that operate this thing this thing is the numbers are reading out somewhere between like two thousand and twenty five hundred on the top and I don't know if that's feet or meters or what but like a water pump that has these kind of figures associated to it might be doing something interesting so okay it's interesting right but it's not really like a fire sale like a movie right well I lawn so I lawn is kind of neat I lawn is is a piece of hardware that was made to control lawn works networks now lawn works was something that you have industrial equipment that needs to talk but people didn't feel right putting it on the internet so they made their own network thing I made their own network topography apology I should say for this sort of thing and they call it long works and then like with everything else somebody took a web server and an ethernet and put that on top of the thing that wasn't supposed to be on the network and these hilariously are stackable just like the watts you can have one of these controllers talking to five hundred more or in this case three dozen more this is a controller that I stumbled across randomly and they have several I see some of blanked out there several IP addresses I want to get anybody in trouble but when you when you open this little a little plus symbol there and sub menu items come in they look kind of interesting one of them I saw was a gigante and so like what looks cool let's Google that what's a gigante it's a stadium thing and under that wood is an ice rink that you can defrost if you want okay I said it was random yeah oh believe me um so this this is a place it's kind of like the San Diego convention center they host big things here and they have stadium seating and all their alarms and all their lights and the garage doors and all of the interesting stuff that you hear about in the movies is connected to this system no no cred no passwords nothing you hit it with a browser crap conveniently they have a floor plan for you should you decide to target a particular area so I went back to the list and kept looking like oh this is glorious what what else could there be so there's this strand camping place that has water slides and lots of solar equipment and I can't imagine that their their island systems are you know controlling much other than maybe water or not water sorry the water slides maybe the valves there and maybe some of the solar power stuff that's interesting that you know trod it with a web server another one that's like another sort of camping place that has a cabin that you can rent in this that based on the website you know this place actually looks kind of cool um it's a facility that's somewhere out in Europe that you can you know rent and they market this to Americans so you can you can go take a vacation there that's kind of fun so that's that's fun I can control ice skating rink the lights the HVAC the power garage door water pressure boilers of something like 37 businesses in some downtown part of some some city that will remain nameless and you're a little bit closer movie but in the movie they were able to control stoplights and signs and things like that let's go I got you covered car light listening on tell that these are intersections like stoplights you can tell that into them and put them in test mode and the warning says don't do this you can kill people okay um auto plate another fun one these are the red light cameras that photograph your car and OCR your license plate send it off the cops these are glorious because you can tell them to them and tell them to send the pictures elsewhere no credits and what's really funny is if you look at if you look at the screen shot it says it's somewhere near the bottom say with no security it actually says yeah there it is it's like right in the center with one of the second line of the asterisk basic vets system with no security awesome so Daktronics these guys I got to give them a thumbs up for because absolutely nothing was listening everything was protected but these guys make signs that do this sort of stuff over free ways so they are also listening on port 80 and you can also tell that into these but they're not I just give you password prompt so you can't really see anything so read like very read only you know so okay before I stop so now we got red light cameras road signs stop lights check uh what else is let's do some current events or anybody remember rugged calm I could come as a fun one right so um if you hit a rugged calm box with a web browser you see something like this um anybody want to take guesses at what those passwords might be cuz um they send them to you and then they obfuscate them so if you view the source or you have any browser plugins that will deobfuscate passwords there you go um and then the next one actually was an interesting one the next one was like anybody familiar with like those movies where some hacker do does something and then his phone blows up and it's the government they're like hey hacker guy yeah that actually happens um so I hit this and um I said oh that totally that's or yeah that's not malware or anything some kid defaced something yeah look at all those java applets that I'm not gonna let run okay next took a screenshot I put it on Twitter next I had a discussion with a gentleman that paid me afterwards and said no no that's actually safe you can you can run that I like whatever you say dude he says no no seriously seriously it's not bad you can run it fine spin up a VM take a snapshot pop this thing open it looks like this oh are those megawatts yeah those are megawatts this is a hydroelectric plant in Fumel France with their skating equipment open to the internets um and they have two turbines and each turbine generating something like three megawatts each oh that's kind of a big deal I didn't put the screen job on Twitter but the gentleman I was talking to said yeah you're gonna get a call from some interesting people I'm like yeah some dude saying that to me on Twitter randomly no 845 the next morning ring ring hi my name is Anthony I'm calling for my I see a cert I'm with the department of DHS I'm like oh Christ here we go what size cups do I need right um he's actually a really cool guy I get to meet him he's wandering around here somewhere but uh yeah we're supposed to get drinks flairously um so that was interesting that was a one of those occasions that you hear about where the feds call the hacker guy but like it doesn't end in the dude going to jail awesome um so satellite systems also listen on these things and and hilariously they're a lot more boring than you think I ever since I was a kid I'm like yeah I want to get into satellites wow this is lame they're just it's like serial but over radio it's they're open they're listening and you can see how many frames go back and forth this I think the television set up somewhere in Europe that you know completely open um this one was new now storage race analogy this came out recently like three weeks ago um you get one of those storage arrays from fries or wherever and it's a network device and you can uh you can plug it in and do nas and and uh SMB and NFS to it awesome uh you go ahead and put that on the internet too um this one was glorious I was in tears laughing you can tell that into a car wash what the hell I don't yeah I don't yeah oh god no yeah that was that was interesting um you can tell them so I the first thing I came to me was like oh yeah there's a mission of possible stuff you have your you have your uh your foreign diplomat go into the car wash and you like put the barriers up and spray with soap or you know send guns um this one was this one was doubly hilarious this is massive humidifier systems that are in hospitals and industrial settings and other like these things are the size of like three or four refrigerators side to side they're six feet tall ten feet wide three feet deep and they make vapor um so you think okay that's not so interesting so they have a marketing video where you can connect directly to the board they have no idea what they're doing but um uh they're advertising or the marketing material a client boasts that their equipment is in the White House okay good to know search that for later um emergency telco gear like like voice stuff that that uh first responders uh use is open listening on the internet okay you want to put some fake 911 calls in rocket you can do that this is what the interface looks like um then occasionally some really really really really old like for runner kind of stuff comes around and you see stuff like this which i'll give you a second to read and if anybody can spot the hilarity in here please point and yell yeah support for Netscape 6 guys huh this code was taken from geocities holy crap did you know speakers have web servers this one you can send it at an mp3 and it will play it troll mode activate um a wine cooler a gigantic ridiculous wine cooler that has a champagne alarm in a giant hotel somewhere okay rad even more like this is great stuff um orphaned it's it's just funny during pen tests it would be absolutely I cannot wait to put this kind of stuff in a word for it so thinking longer term I mentioned the trading uh trending stuff earlier uh there are tools in in the better equipment that will let you trend over months and weeks and things like that so you can start building profiles on these things that you find when people come in when people leave when the alarms go off when the alarms are turned on when the gates open and shut all sorts of really creepy stuff doing profiling or long term investigations or anything like that so scanning the whole net or internet is is getting a lot easier we can do the stuff we can measure it now um if anybody saw any of my previous talks on this material I presented a layer one a few months ago um I saw a whole bunch of ridiculous cameras um and I have some numbers um uh the first time I I I did this I found 560 cameras um there was a BBC article scaring everybody on the 7th February talking about how creepy it is that people can see cameras on the internet um and then I did the I did a retest I found 25% less cameras or so then US media picked it up and then the numbers went up and then um I did the test again uh just a little while ago and the numbers went up almost to where they were before so scaring the crap out of people is a great tactic but it's temporary um it does scale though and I'm working on it so when I have more interesting information with these numbers I intend to come back and present some more and if you want to stop me this is how you can find me and I have one minute left oh no I'm sorry like um oh yeah yeah sorry not Central America like the middle of the United States yeah so yeah Midwest sorry all of those screenshots were mine I took all of those screenshots no that's if you hit that stuff with a browser then that's just my Mac this machine screenshot presentation yeah that's 20 seconds ago well that's it for me