CNNMoney posted an ominously titled column “Shodan: The scariest search engine on the Internet” yesterday about a search application that discovers unprotected technology connected to the internet that was promptly aggregated by other outlets like FastCompany – but not until the last third of the article did the author mention two key facts: Shodan has existed for three years and is “almost exclusively used for good.”

Make no mistake, the things Shodan can uncover are scary: It’s essentially a way find technology currently online that was never intended to be networked in the first place, or networked with such laughably thin security protocols like using default admin logins and passwords that it’s child’s play to compromise — with the vulnerable tech ranging from the seemingly mundane like home printers and garage doors to the sort of things you really don’t want to be connected to the outside world, such as citywide traffic systems and nuclear command and control centers.

And as we move closer to a world where everything from our refrigerators to our pacemakers are connected to the Internet in one way or another, these problems will only multiply: An “Internet of things” that lacks security built into the devices that join together to create that network could potentially put everyone at risk. The issue is that these vulnerabilities exist in the first place, not that Shodan can uncover them — as previous coverage of Shodan by Dave Maass in San Diego CityBeat* notes:

“The fact that somebody is basically shining a flashlight into a dark room shouldn’t be the part people are afraid of,” says Dan Tentler, a San Diego-based information-security consultant. “The part people should be afraid of is the fact that some genius decided to take, for example, a five-megawatt hydroelectric plant in France, put its control computer on the Internet and allowed everybody that knew about the IP address to connect to it and make changes to this dam, with no encryption or authentication to speak of.”

As with almost all technological developments, Shodan is neutral. In fact, the bad guys have a vested interest in keeping these types of vulnerabilities quiet so their exploitation will go unnoticed. With Shodan, security experts have a simpler way of identifying what networks are at risk and potentially taking them offline or improving security thus bettering the entire system. And security experts does mean hackers: While the word has taken on a lot of negative connotations in the media, hacking is a process of discovering vulnerabilities that is neutral. Just as it’s questionable to call Shodan scary because the things it uncovers are settling, decrying the process of hacking and all people that do it because they reveal problems with systems is equally objectionable.

There are certainly bad hackers, but there are also good hackers: Just ask Peiter Zatko (better known as Mudge) who spent the last few years as a program manager at the Defense Advanced Research Projects Agency (DARPA) focusing on cybersecurity projects. When he left last week he tweeted that he didn’t know which was neater: “getting Office of SecDef highest award, OR the positive use of ‘hackers’ in the letter!”

Wen Jiabao

“Two former U.S. officials said the administration is preparing a new National Intelligence Estimate that, when complete, is expected to detail the cyberthreat, particularly from China, as a growing economic problem. One official said it also will cite more directly a role by the Chinese government in such espionage.

The official said the NIE, which reflects the views of the nation’s various intelligence agencies, will underscore the administration’s concerns about the threat, and will put greater weight on plans for more pointed diplomatic and trade measures against the Chinese government. The two former officials spoke on condition of anonymity because they were not authorized to discuss the classified report.”

A New York Times story on Wednesday revealed a four month assault against the company starting after a Times investigation into the billions accumulated by Chinese Prime Minister Wen Jiabao’s family during his tenure. The Times systems were compromised, with hackers obtaining all Times employee passwords and access to 53 employee personal computers. One Times journalist, John Schwartz, noted that story explained a lot of recent security measures, including random password resets.

The hackers typically worked regular Beijing hours, according to Mandiant, the security company hired by the Times to investigate, and while chief security officer Richard Bejtlich cautions “If you look at each attack in isolation, you can’t say, ‘This is the Chinese military,’” the Times analysis identifies the Chinese government as the likely culprit.

The Wall Street Journal announced it was the victim of a similar series of attacks Thursday, noting that the hackers appeared interested in sources and information, not financial details. Chinese Embassy spokesman Geng Shuang responded to the allegations made in both stories. “It is irresponsible to make such an allegation without solid proof and evidence,” he said. “The Chinese government prohibits cyberattacks and has done what it can to combat such activities in accordance with Chinese laws.”

Read more