# Use Case Based Blended Teaching of IIoT Cybersecurity in the Industry 4.0 Era
## 4 Shodan for Practical IIoT/Industry 4.0 Cybersecurity Labs
### Lab 4: Advanced Shodan scripting
Thus, it is straightforward to discover MQTT brokers (Shodan query: _\"MQTT Connection Code: 0\" set -alarm)_ that are unprotected and that expose the internal MQTT topics. Industrial vehicles can also be monitored in order to optimize the processes of an Industry 4.0 smart factory. For such a purpose, the GPS and connectivity solution provided by the C4 MAX device can be really useful. Unfortunately, most of the C4 MAX devices detected by Shodan (query: _\"[1m]35 mWelcome on console\"_) provide a Telnet connection that requires no credentials, which allows remote attackers to access the system and the vehicle data. Finally, it is worth mentioning that certain voice communications mechanisms that are commonly used by companies can be found by Shodan, like Voice-over-IP (VoIP) Public Branch Exchange (PBX) systems (example of Shodan query: _PBX \"gateway console\"-password port:23_) or the popular Polycom videoconference systems (Shodan query: _http.title:\"-Polycom\" \"Server: lighttpd\"_), in which the management software also suffers from vulnerabilities and the lack of a proper security configuration (e.g., the use of default administration credentials). ### Robotics

Robotic systems are typically used for automating tasks in smart factories, either for operating autonomously (e.g., for painting or soldering tasks) or for collaborating with industrial operators during specific tasks (e.g., to hold heavy objects). Robotic arms are commonly used in industry and they essentially consist of a controller, different sensors and multiple servo motors that conform the arm. The robotic arm can be controlled manually by an operator or it can act autonomously, according to certain software-defined behavior. In this latter case the controller receives inputs from the sensors (e.g., from a video camera), process them and then decides the actions to be carried out by the servo motors. Cybersecurity problems may arise when the robot controller is connected to the Internet, since a remote attacker may take control of the robot and then cause product or physical damage [90]. Shodan is able to find just a few hundreds of industrial robots connected directly to the Internet, like the ones from ABB Robotics (Shodan query: _ABB slave_), FANUC (Shodan query: _FANUC FTP_), Yaskawa (Shodan query: _Yaskawa_) or Mitsubishi (Shodan query: _Mitsubishi FTP_). However, it must be noted that, in many cases, the robot controller is not connected directly to the Internet, but through a communications router. Shodan is able to find thousands of such routers [90] from manufacturers like Ewon (Shodan query: _ewon_), Westermo (Shodan query: _westerno_) or Sierra Wireless (Shodan query: _sierra wireless_). ### ICSs, SCADAs and CPSs

As it was previously mentioned, Shodan includes a specific section on its web page that provides a good compilation of queries for finding ICSs and SCADAs [67]. For example, it is really easy to find PLCs that make use of Modbus (Shodan query: _port:502_), EtherNet/IP (Shodan query: _port:44818_) or DNP3 (Shodan query: _port:20000 source address_). ICSs can be monitored or controlled remotely through SCADAs that may not provide an Internet-connected interface. In such cases, many industrial companies allow for accessing the SCADA through a Virtual Network Computing (VNC) system. Shodan enables locating VNC systems really fast (Shodan query: _has_screenshot:true product:VNC \"authentication disabled\"_). Unfortunately, many developers do not implement any authentication mechanism, like it is shown in Figures 14 and 15 for two SCADAs found with Shodan. There are also certain cases where a SCADA is initially secured properly, but, due to the lack of software maintenance (i.e., periodic software updates), it becomes vulnerable. A good example are a significant number of Nordex wind farm management systems (Shodan query: _Jetty 3.1.8 \"200 OK\"_) that run on an insecure version of Jetty. Shodan is also able to discover CPSs that are poorly configured in terms of security.