Quantitatively Assessing and Visualising Industrial System Attack Surfaces

CHAPTER 3. EXPLORING THE DATASET 35
Figure 3.3: Default user names and passwords available in help files
Proportion of connected and remotely exploitable nodes
This dissertation is primarily concerned with the scale of industrial system exposure, so
while the anecdotal cases above are interesting, they do not assist understanding the
scale of the problem. The data shows roughly 7500 nodes exposed online, 17% with
authentication, and most without. Primarily this protection is a password, and there are
plenty of known techniques for compromising those. If simple attacks such as password
cracking are eliminated from discussion, then 20.5% of the nodes analysed from SHODAN
have published remote exploits for a technology listed in their application or operating
system dependency stack (as derived from a banner).
Top ten Autonomous Systems
In Table 3.3 the top ten Autonomous Systems are shown and ranked by the number
of devices or systems we found within their allocations. The top ten also conveniently
delineate ASes that contain greater than 100 each. In some cases the AS will have some
responsibility for this state of affairs, but in others they will not. The point of this table
is to show that if one of these ISPs suffer a loss of connectivity, then that has an effect
on the remote management of these systems accordingly.
3.4 Disambiguation and false positives
In general false positives (presence of a node in the dataset when it should not be) can
occur when the string we are searching for in SHODAN is replicated in another banner,