Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by achillean on Thursday June 24, 2021 @02:11AM (#27614483)

Here is an overview of what Shodan is:

https://help.shodan.io/the-basics/what-is-shodan

The scanning algorithm is mostly just this:

1. Generate a random IPv4 address

2. Select a random port from a list of ~2k ports

3. Check the random IP on the random port

4. Store the result of the check

5. GOTO 1

The above loop runs endlessly and because IPv4 is fairly small it doesn't take long to check everything.

[ Parent | on HN ]

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by hnick on Thursday June 24, 2021 @05:50AM (#27615616)

If everyone somehow magically switched to the much larger IPv6 address space would that be a big problem for you?

[ Parent | on HN ]

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by achillean on Thursday June 24, 2021 @10:31AM (#27618076)

We also crawl IPv6 but it's a very different and more complicated algorithm. We would still end up crawling a sizable chunk but there are obviously unknowns in how biased our dataset would be (i.e. we might index mostly cloud servers and fewer residential devices).

[ Parent | on HN ]

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by hnick on Thursday June 24, 2021 @08:01PM (#27625495)

That's what I thought, you might have to maintain a map of ISPs and such but even then it'd be hard to find all the clients under them.

[ Parent | on HN ]

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by 29athrowaway on Thursday June 24, 2021 @03:24PM (#27622636)

Is there a way to opt-out from the scans?

[ Parent | on HN ]