Hacker News
points by supriyo-biswas 12 hours ago | 0 comments
I would be very skeptical of anyone relying on Shodan data. At one point I was trying to write honeypots myself by replicating wifi cameras, but almost all the ones on the internet I found were honeypots of some sort, and the ones that weren't were already hacked and had their web pages replaced. In retrospect it would have probably been better to get a vulnerable device myself and probe it.

If I were you, I would probably ensure that the fridges you used have residential or commercial (aka non-DC) IP addresses. Maybe Shodan uses this data for their "honeypot" label, my experience was some time ago so no idea though.

[–] hedgerow-dev 12 hours ago
At this point the honeypot I'm running is not marked as honeypot. Guess that it's a good sign?
[–] supriyo-biswas 11 hours ago
What I meant is that I'd find some way of ensuring that I'd want to ensure that the responses you're serving up are real. If you are happy with what you have, we're good.
[–] hedgerow-dev 11 hours ago
Fair point and I agree, Shodan isn't the only source. For the reason, for Danfoos the login page comes straight from the firmware package that Danfoss publishes. It's byte for byte identical, so it hashes the same as thousands of real units. Dixell was matched against Shodan records, so that one is weaker, you’re right.

The datacenter IP is the bigger tell. Real controllers sit on shop or ISP connections. Moving one decoy onto a residential line is on my list.

Along the way I did some hunting for vulnerabilities on the Danfass units, quite interesting stuff actually.