Hacker Newsnew | past | comments | ask | show | jobs | submit | achillean's commentslogin

I had a similar experience where a competitor released an academic paper rife with mistakes and misunderstandings of how my software worked. Instead of reaching out and trying to understand how their system was different than mine they used their incorrect data to draw their conclusions. I became rather disillusioned with academic papers as a result of how they were able to get away with publishing verifiably wrong data.

Honeypots are advertising that header as well nowadays:

https://www.shodan.io/search/report?query=x-clacks-overhead

Most of the non-honeypot results are for the Gargoyle Router Management interface exposed by Korea Telecom:

https://www.shodan.io/search/report?query=x-clacks-overhead+...

The results have increased significantly over time:

https://trends.shodan.io/search?query=x-clacks-overhead


Maybe it depends on the type of business/ customers that you have because I've had the opposite experience. For us as a security SaaS, B2B enterprise is incredibly stable and predictable. B2C has a lot more variability and payment issues compared to large orgs with dedicated procurement departments, vendor processes etc.


Searching for ALPR was also one of the popular early queries: https://github.com/jakejarvis/awesome-shodan-queries?tab=rea...

The old PIPS ALPR devices aren't online anymore but they had horrible security as well. Just sending a newline to their UDP port would cause them to send you all images as they were being collected in real-time - no authentication needed. And the images had the license plate information encoded in the JPG metadata. I did a talk about it at some point (https://imgur.com/HHcpJOr) and worked with EFF to take them offline


Shodan also has built-in detection for some of them. For example, you can search for "product:ollama" (https://www.shodan.io/search?query=product%3Aollama). Or if you have access to the tag filter then simply "tag:ai" (https://www.shodan.io/search/report?query=tag%3Aai).


Around 40,000 services on the Internet are currently including the header:

https://www.shodan.io/search/report?query=x-clacks-overhead+...

For some reason, a lot of honeypots are also using that header so I filtered those out. The number of services has slowly increased over time:

https://trends.shodan.io/search?query=x-clacks-overhead+-tag...


The result is very strange. It's saying that South Korea has the most number of websites with the header and yet I don't see ANY search result in Korean. No writeup or whatsoever. Wonder what those websites would be.


Flying by the seat of my pants, this page of information has details which we can guess at - 27,799 are South Korea, 27,690 are Korea Telecom (so close that I'll say it's a 1-to-1 match). Wikipedia tells me as of 2015, KT ran more than 140,000 Wifi hotspots.[1]

Further down the info, we see 28,587 (almost the same number as above) HTTP titles are "Gargoyle Router Management Utility" - which is an opensource variant of the OpenWRT world which patches the code to include the Clacks header.[2]

I'm going to conclude that there's a direct correlation in this data (it all being one and the same endpoint/device pattern) and that 30,000 KT Wifi hotspots across South Korea have their management UI open on the public interface and not locked to the internal network or a VPN, etc. running this Gargoyle patch.

[1] https://en.wikipedia.org/wiki/KT_Corporation

[2] https://github.com/ericpaulbishop/gargoyle/blob/master/patch...


Interesting. Thanks for the insight.


There are still more than 300,000 services on the Internet that support SSLv2:

https://www.shodan.io/search/report?query=ssl.version%3Asslv...

And a trend line of how it's changed:

https://trends.shodan.io/search?query=ssl.version%3Asslv2#ov...

It has dropped significantly though over the years but it will continue to stick around for a while.


But how many clients are still using it? As far as my understanding goes, no relevant, up to date piece of software/library still supports


Ahaha

If you look around you'll find services, today, that haven't been upgraded in decades.


Based on Internet-accessible services the number of Valkey servers is low (~120):

https://trends.shodan.io/search?query=valkey_version+port%3A...

Here's a chart of all Redis-compatible services (~55,000):

https://trends.shodan.io/search?query=port%3A6379+redis_vers...


And how representative are publicly accessible redis/valkey instances for redis/valkey usage in general? And can shodan even differentiate Redis from a Valkey instance setup in a backwards-compatible way without being able to authenticate?


In absolute numbers probably not highly representative but the relative numbers are meaningful to measure adoption. And no, it requires the user to disable authentication in order to get the service details to differentiate between Redis and Valkey. But again, you can compare unauthenticated Redis to unauthenticated Valkey to see how the percentages are changing over time.


It's not anymore! They actually changed their defaults and it helped tremendously to reduce the exposure of Redis instances on the Internet.


We released a tool to calculate the favicon hash called "favscan": https://blog.shodan.io/deep-dive-http-favicon/

And here's a map of favicons that Shodan has seen across the Internet: https://faviconmap.shodan.io/


I opened the map and immediately saw the (not very big) erect penis in the top right. The curse of having a dirty mind...


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: