Shodan Cataloging of Liebert & APC
(Disclaimer – It is not the intent of this post to point out a particular BAS software vendor. The intent is to show that we, the system integrator, still have work ahead of us to do our part)
Last week I searched for Niagara systems on Shodan and the numbers were 27k plus in just the US. This week the US number is down just over 15k. This does not necessarily mean it will continue to go down. It just means that is the number Shodan has picked up thus far.
This week I search for Liebert and APC. These are typically used in data centers and you would not expect to find them exposed. However, I was able to find some. And the US is once again the leader in the pack of most exposed.
The good news is the number was only in the double digits for Liebert. The number of exposed APC devices were significantly less than Niagara, but numbered close to 4,000. The US was number one with 3,819 and the UK was number two with 578.
Checking out the details page of some sample units show the information available is fairly descriptive.
| The image on the right shows a Liebert Challenger that (according to the location description) is in a server room.The application software is listed as well as the firmware version. |  |
The image on the right is the detailed information for this public IP.It also list:
Notice at the top is the street map.
|
 |
Another example of potentially critical equipment that is exposed and cataloged by Shodan is APC.
The image below shows an APC SNMP device with an exposed IP which happens to be a power strip that controls VM, APP, and SQL servers.
The details for the exposed IP listed are:
- City
- Country
- Internet Service Provider
- Last Update (this is the date and time Shodan last connected to the the site which was three hours before this screen capture)
- Services – Telnet Port 23
- Ports – 23, 80, 161 (all default)
- MIB version
- Etc.
Notice at the top is the street map.
 |
Like I said in the last post, we all know this is something that we cannot change overnight, and at the end of the day we cannot force the end user to spend the money and make the changes necessary to make their systems safer. However, we need to architect new systems securely and make the necessary recommendation to our customers on how to secure their legacy systems.
If you would like more information on any of my other post, email me at fred.gordy@smartcore.com.
The Basics of LED Lighting and Why LED Lighting is the Future: Unlike incandescent and fluorescent lamps, LEDs are not inherently white light sources. Instead, LEDs emit nearly monochromatic light, making them highly efficient for colored light applications such as traffic lights and exit signs. However, to be used as a general light source, white light is needed. White light can be achieved with LEDs in three ways:
Shining the Light on Solar Energy: History of the SunShot Initative — Concentrating Solar Power: n 2011 the Department of Energy began one of its most ambitious and successful initiatives to achieve significant progress in sustainable energy by reducing the cost of installed solar energy through a shared commercialization of solar technologies. Solar power in the U.S. passed the 10 GW capacity milestone in 2013.
The Connection Community Collaboration: Over the last several years organizations and groups have been extremely successful in connecting our industry with standards. The name “Connection Communities” has been attached to the purpose and function these organizations provide. Great job by Ken Sinclair of automated buildings.com for moderating this timely and useful breakout session.
ControlTalk NOW welcomes its third guest, Rick Warner, OME Engineering, out of Baltimore, MD. The klaxon sounded many years ago, but this Target event will more than likely serve as HVAC’s watershed event. In a most opportune time, Rick’s interview brings forth the issues one at a time, and with unabashed sincerity, proposes general, can’t go wrong courses of action, for the benefit of everybody in the HVAC industry. 
Perhaps the most important and menacing challenge facing the HVAC Industry (at least for the immediate future) will be demonstrating its collective knowledge and understanding of CyberSecurity and how to actively cope with (and how to counter) the rising numbers of CyberThreats directed at buildings and HVAC service companies that service those buildings, particularly in light of the recent $420 million losses and expense Target faces as a result of hackers gaining access to Target’s network using stolen network credentials from the HVAC contractor. 