Shodan Blog
blog.shodan.io · Company blog · on HN since 2015
The blog of Shodan, the internet-wide device search engine, reporting on exposed databases, protocols, certificates and internet-scale trends.
What HN saysHN links it for data on exposed MongoDB and other services, and for the favicon-hash technique used to find a hacked site's pre-production server.
19HN people shared it
7linked it in comments
33stories submitted
805story points
3 months agolast shared
2015people per year2026
Most-shared posts
- 1Finding MongoDB instances without any authentication4 people · 131 points · first shared 2015 · 42 comments on HN
- 2MongoDB instances publicly exposed on the Internet4 people · 80 points · first shared 2015 · 22 comments on HN
- 3The HDFS Juggernaut3 people · 147 points · first shared 2017 · 59 comments on HN
- 4Accepting Crypto: A Vendor Perspective2 people · 14 points · first shared 2022 · discussion on HN
- 5Quick Look at Duplicate SSL Certificate Serial Numbers2 people · 5 points · first shared 2015 · discussion on HN
- 6Analyzing Post-WannaCry SMB Exposure2 people · 2 points · first shared 2017 · discussion on HN
- 7Trends in Internet Exposure2 people · 2 points · first shared 2020 · discussion on HN
- 8Deep dive http favicon2 people · first shared 2025
- 9Duplicate SSH Keys Everywhere1 people · 310 points · first shared 2015 · 84 comments on HN
- 10The Country of Vietnam Resolves to Localhost1 people · 75 points · first shared 2015 · 33 comments on HN
- 11Tracking Hacked Websites1 people · 4 points · first shared 2015 · discussion on HN
- 12ISP Offers BitTorrent Caching1 people · 4 points · first shared 2015 · discussion on HN
- 13Introducing the Shodan Real-Time Stream1 people · 4 points · first shared 2015 · discussion on HN
- 14Tracking HTTP/2 Adoption1 people · 4 points · first shared 2015 · discussion on HN
- 15Taking Things Offline Is Hard1 people · 3 points · first shared 2015 · discussion on HN
What HN people wrote when they linked it
teroshan · 2026-03-04
While unfortunately in french, the detailed write-up of the hack [0] is worth a read.
The first step was finding out the pre-prod sever through the hash of the site's favicon in Shodan [1]
[0] https://yggleak.top/fr/home/ygg-dossier#le-hack
[1] https://blog.shodan.io/deep-dive-http-favicon/
achillean · 2020-07-26
By default though, MongoDB will only listen on localhost and I believe it'll show you a big warning on boot up if you don't have authentication configured. They used to listen on 0.0.0.0 by default but that was fixed many years ago.
And this issue doesn't just affect MongoDB - imo since the "webscale" days it's been a favorite to knock on but the public exposure of data happens across many technologies. Here's a comparison with a few others:
https://blog.shodan.io/elastic-data-exposure-grows-to-3-2-pb/
raverbashing · 2017-01-07
"Recent" versions aren't. If you install .rpm/.deb versions you're also covered
(And anyone who deploys any service on an internet-facing server should know what they're doing)
See https://blog.shodan.io/its-the-data-stupid/
westi · 2016-03-11
Previously: https://blog.shodan.io/dont-be-clever/
> For example, you might know that Shodan crawls the Internet for industrial control systems (ICS). One of the most popular protocols in ICS is called Modbus that runs on port 502. At the moment, there are about 17,000 devices listening to Modbus on the default port. It turns out there are also 700 devices listening on port 503, again a one-off sort of situation.
Probably over 20k by now
jwcrux · 2015-12-28
Seeing the "_id" : ObjectId() fields indicates to me that this is likely a mongodb instance that was available to everyone.
There's been a lot of talk about these recently[1] that I'm surprised this didn't come up sooner.
[1] https://blog.shodan.io/its-still-the-data-stupid/
mortehu · 2015-12-22
> A MongoDB database open to the outside world on a public IP address?
Maybe someone was inspired by this article?
https://blog.shodan.io/its-still-the-data-stupid/
> At the moment, there are at least 35,000 publicly available, unauthenticated instances of MongoDB running on the Internet. [...] all of the exposed databases combined account for 684.8 TB of data.
eli · 2015-12-22
Some official distributions listened to all addresses by default (by design) until recently. https://blog.shodan.io/its-the-data-stupid/