# Use Case Based Blended Teaching of IIoT Cybersecurity in the Industry 4.0 Era
## 4 Shodan for Practical IIoT/Industry 4.0 Cybersecurity Labs
### Labs 2 and 3: Practical Use Cases  
After the students complete the lab on the basics of Shodan, they carry out the second lab of the course. Depending on the previous knowledge and skills of the students, such a second lab can follow two different approaches:  
* Guided approach: 1. First, the course instructor gives each student a list of Shodan queries like the ones detailed in Appendix A. 2. The students then try the queries on Shodan and analyze the obtained results in order to determine which IIoT or Industry 4.0 devices are detected by the queries. Although in many cases the information gathered by Shodan is enough to identify the devices, the students usually need to make use of additional web search engines to find information from the manufacturers or distributors. 3. Once the students gather enough information to identify the IIoT/Industry 4.0 devices and understand their essential inner working, they analyze the vulnerabilities and exploits detected by Shodan. Moreover, the students look for additional signs of weak security, like the use of default credentials or outdated security mechanisms. * Autonomous approach: 1. In this approach the course instructor initially gives the students a specific target or a set of targets (i.e., IIoT/Industry 4.0 devices). 2. The students first investigate the targets by gathering information from their datasheets or manuals with the objective of understanding how they work and which are their default credentials. 3. Then the students build Shodan queries that allow for discovering the targeted devices. 4. Finally, the vulnerability assessment is performed with the help of the Shodan exploit API and other data sources like the available Common Vulnerability and Exposure (CVE) reports. As an example, Table 3 provides a summary of some of the results obtained by the students for different use cases analyzed during the 2020 course. The main conclusions for such use cases are:  
Figure 2: Shodan result list of potential Siemens S7 PLCs. * C4 MAX IIoT monitoring devices:
* Shodan query: _\"[1m[35 mWelcome on console\"_. * All the devices were completely open through their Telnet service. * NetBotz monitor:
* Shodan query: _\"Netbotz appliance\"_. * Roughly 40% of the detected devices have no security at all and allow for accessing the environmental data and onboard web cameras. The rest of the devices required authentication. * Somfy alarm system:
* Shodan query: _title:\"Centrale\" \"Pragma: no-cache, no-store\"_. * Most alarm systems are properly configured, a couple of them made use of the default administration credentials, so any user with access was able to switch off or on the alarms. * Proliphix thermostats:
* Shodan query: _title:\"Status &amp; Control\"_. * All the analyzed devices control panels were open and provided the ambient temperature without requiring credentials. * Automatic tank gauges:
* Shodan query: _unleaded_. * All the analyzed devices provided the tank gauge data without carrying out an authentication procedure. In fact, such data could be obtained through Shodan (i.e., no direct connection with the devices was required to gather the IIoT data). * Electro Industries Gaugetech smart grid meter:
* Shodan query: _\"Server: EIG Embedded Web Server\" \" 200 Document follows\"_. * Most devices provided barely any security in spite of monitoring a critical infrastructure like the electrical grid. Thus, 80% of the analyzed smart meters could be accessed as administrator