# Use Case Based Blended Teaching of IIoT Cybersecurity in the Industry 4.0 Era
## 4 Shodan for Practical IIoT/Industry 4.0 Cybersecurity Labs
### Lab 4: Advanced Shodan scripting
## Appendix A Practical IIoT and Industry 4.0 Use Cases for Labs 2 and 3

This Appendix provides numerous examples of practical use cases for Labs 2 and 3 that allow for discovering specific industrial devices that in many cases monitor and control critical infrastructure. It is important to note that, to provide easy-to-test examples, the following subsections indicate specific Shodan queries, which can be easily adapted to be used with the online search engines cited in Section 2.2. ### IIoT Devices

Shodan is able to find a significant amount of IIoT devices that can become potential targets for cyberattacks or may be used to perform cyberattacks. One of the types of devices that have been traditionally targeted by Shodan researchers are webcams and Digital Video Recorder (DVR) systems, which are used by many companies in their surveillance systems. Unfortunately, as of writing, many webcam and DVR systems remain unprotected or weakly protected, being really easy to find video-surveillance systems that make use of their default credentials or that do not implement any security mechanism. For instance, such weaknesses were exploited in 2016 by Mirai, a botnet that infected hundreds of thousands of IoT devices like DVRs, webcams or routers to perform one of the largest Distributed Denial of Service (DDoS) attacks in history [89]. Specifically, Mirai was able to create its botnet by performing brute force attacks on weakly protected IoT devices, thus obtaining their management credentials. A practical example of weakly protected video-surveillance systems that can be found with Shodan are thousands of ExacqVision systems (Shodan query: _\"server: vfe\"_): a relevant amount of such systems make use of the default administration credentials or of easy-to-guess passwords (e.g., '1234', 'admin'). As an example, Figures 12 and 13 show two screenshots of unprotected Exacqvision systems found with Shodan. There are many more examples of weakly protected webcams (either deployed in industrial scenarios or private households), like the ones that result from searching for Linksys WVC80N cameras (Shodan query: _WVC80N_), AXIS webcams (Shodan query: _\"port:80 has_screenshot:true\"_) or AVTECH IP webcams (Shodan query: _linux upp avtech_). Similarly to webcams, unprotected DVR systems can be easily found with Shodan. An example of such systems are UNIMO UDR DVRs (Shodan query: _html:\"DVR_H264 ActiveX\"_): almost all of the systems analyzed by the authors for this article made use of the default credentials (a screenshot of one of such systems is shown in Figure A3). Shodan is able to detect other IIoT systems that can be either used by industrial companies or private homes, like certain home automation or climate control systems. For instance, the Somfy system (Shodan query: _title:\"Centrale\" Pragma:\"no-cache, no-store\"_), allows for managing a home or company security alarms remotely. Although the Somfy system is password protected through a web interface, unfortunately, it is easy to find with Shodan systems that make use of the default credentials (an example of one of such systems is shown in Figure A4). Regarding climate control system, it is not difficult to find exposed thermostats from ICY (Shodan query: _title:\"ICY Clever Thermostat\"_), Heatmiser (Shodan query: _title:\"Heatmiser Wifi Thermostat\"_) or Proliphix (Shodan query: _title:\"Status &amp; Control\"_). In addition, some control access systems are also exposed on the Internet and part of them use the default administration credentials (e.g., HID VertX systems (Shodan query: _\"HID VertX\" port:4070_)). Figure A3: Screenshot of vulnerable Unimo DVR system. It is also worth mentioning that Message-Queue Telemetry Transport (MQTT) protocol is increasingly being used for resource-constrained IIoT devices (e.g., sensors, actuators), but, unfortunately, many deployments lack a proper security configuration.