# Use Case Based Blended Teaching of IIoT Cybersecurity in the Industry 4.0 Era
## 4 Shodan for Practical IIoT/Industry 4.0 Cybersecurity Labs
### Lab 4: Advanced Shodan scripting
The vast majority were advanced programmers, but they had neither previous knowledge of Shodan or practical experience on IIoT or in most Industry 4.0 technologies. The following are the general results obtained during the four imparted courses:

* A total of 99 students eventually took the whole course (20 students dropped out during the course), delivering 198 reports for the two practical labs. * A total of 178 different queries were given to the students, of which 118 were eventually analyzed (60 of them were assigned to the 20 drop-outs, but they are not considered in the presented results) and actually targeted 47 different IIoT and Industry 4.0 devices (some of the queries targeted the same devices). * For each of the 118 Shodan queries, only the first 20 Shodan results were analyzed. This means that a total of roughly 2360 devices were studied. * For the 47 studied IIoT/Industry 4.0 devices, a total of 3749 vulnerabilities related to already published CVEs were found by the students. Such a high number was mainly due to a few IIoT/Industry 4.0 devices that executed outdated software (e.g., outdated PHP versions, old HTTP servers). * Of the 2360 studied devices, 205 implemented no authentication mechanisms, while 103 of them made use of the default administration credentials. These results imply that cyberattackers may easily take control over 13% of the analyzed industrial devices. It is relevant to point out that, if the results obtained by the 2020 class were only considered, the mentioned percentage would be roughly 25%, since 220 out of the 900 industrial devices analyzed by the students did not make use of proper security mechanisms. As a conclusion of the imparted courses, it can be stated that, despite the students' lack of previous knowledge on industrial cybersecurity, it was possible to train them fast to detect potential vulnerabilities on IIoT and Industry 4.0 devices connected to Internet. In addition, the students concluded that Shodan is a simple but really powerful tool for cybersecurity researchers that emphasizes the need for taking care of the security of the exposed devices, especially for industries that are considered critical. With respect to the problems that the students found during the courses, they were mainly related to two aspects:

* Shodan API programming. Some of the students had problems during the development of the Python script. Specifically, the following were their most frequent problems:
* Excessive number of requests. For most account types, Shodan restricts the number of requests to one per second, so it is necessary to include a software delay in the script (in other case Shodan will return an error). * Use of filters in scripts. Some students had problems when making use of certain filters through Shodan's programming API because the account type they were using did not allow such a use. There are two potential solutions to this problem: to upgrade the account type or to perform the search in two sequential steps: the first step would gather the data on a specific query, while a second one would parse the collected data according to a certain filter. Obviously, this latter method is clearly slower than the former, since it requires to parse the collected results locally with the developed script. * Lack of documentation. Shodan's REST API documentation is clear, but the documentation on some of the wrappers that allow for using it with certain programming languages is not so complete. In the case of the official Python wrapper [85], although it has improved over the last years and provides good examples on basic searches, some content is still missing, like the meaning of certain fields that enable accessing relevant data. For instance, students had problems for determining which information was available on the detected hosts and how to access it (e.g., it is not straightforward to determine that the vulnerability information on a host is accessed through the 'vuln' field). * Lack of knowledge on the analyzed industrial equipment.