points by supriyo-biswas 12 hours ago | 0 comments
I would be very skeptical of anyone relying on Shodan data. At one point I was trying to write honeypots myself by replicating wifi cameras, but almost all the ones on the internet I found were honeypots of some sort, and the ones that weren't were already hacked and had their web pages replaced. In retrospect it would have probably been better to get a vulnerable device myself and probe it.
If I were you, I would probably ensure that the fridges you used have residential or commercial (aka non-DC) IP addresses. Maybe Shodan uses this data for their "honeypot" label, my experience was some time ago so no idea though.
[–] hedgerow-dev 12 hours ago
[–] supriyo-biswas 11 hours ago
[–] hedgerow-dev 11 hours ago
The datacenter IP is the bigger tell. Real controllers sit on shop or ISP connections. Moving one decoy onto a residential line is on my list.
Along the way I did some hunting for vulnerabilities on the Danfass units, quite interesting stuff actually.