topic Re: Block scanning from shodan in General Topics

Block scanning from shodan

nextgenhappines — Thu, 30 Jun 2016 01:21:07 GMT

Hello,

Anyone have successfully block scanning from shodan.io? www.shodan.io ?

It looks like Checkpoint has written specific signature to block shodan scanning, http://blog.checkpoint.com/2016/01/04/check-point-threat-alert-shodan/

-E

Re: Block scanning from shodan

KotreshaMC — Thu, 30 Jun 2016 10:50:05 GMT

We are aslo observing the simmilar kind of traffic triggering from the IP's listed in that article.

blocking individual IP is not good idea but if there is any way that we can block IP's thase resolves to *shodan.io will be best approach.

Im not sure how we can do this 😞

Re: Block scanning from shodan

santonic — Thu, 30 Jun 2016 11:07:11 GMT

Why would you block scanning from Shodan only?

Set up a zone protection profile which will protect you from all scans. Furthermore make sure that your firewall policy only allows traffic to services which need to be visible from whole internet (web servers, mail server..). And those servers must be hardened in any case so nothing to fear there.

Re: Block scanning from shodan

nextgenhappines — Thu, 30 Jun 2016 14:29:46 GMT

Blocking ip may help initally, but I am not going to make it my day job to keep on monitoring if they decided to change ip or add another new scanner. I submit an app-id request to PAN for shodan.io scan.

-E

Re: Block scanning from shodan

nextgenhappines — Thu, 30 Jun 2016 14:32:14 GMT

Hi Santonic,

Why not block these scanners? I already have zone protection profile configured, shodan is a very slow scanner, it will not get flag by ZP. Sometime you may have some servers that you are just need to open to anyone (with some exceptions).

-E

Re: Block scanning from shodan

BPry — Thu, 30 Jun 2016 17:42:57 GMT

Couldn't you just use URL Filtering to disable access to that domain? Wouldn't that be easier then worrying about what IP is accessing that traffic.

Re: Block scanning from shodan

KotreshaMC — Fri, 01 Jul 2016 06:03:06 GMT

It's inbound not outbound traffic.

Re: Block scanning from shodan

KotreshaMC — Fri, 01 Jul 2016 07:54:03 GMT

There is one another way i found,

we can create the objets with the FQDN provided in the article and create security policy for it (FQDN initially resolves at commit time. Entries are subsequently refreshed when the firewall performs a check every 30 minutes; all changes in the IP address for the entries are picked up at the refresh cycle) so this might helpful in blocking the IP that resolves to specified shodan domain.

Re: Block scanning from shodan

Brandon_Wertz — Fri, 24 Mar 2017 03:09:03 GMT

+Bump

Does Palo have simlar IPS sigs as checkpoint?

Shodan.io Internet Of Things Portal
Shodan Scanner ISAKMP Request
Shodan Scanner SIP Request
Shodan Scanner BACNET Request
Shodan Scanner GTP Request
Shodan Scanner ENIP Request

I tried looking through Threat Vault but couldn't find anyting.

Re: Block scanning from shodan

santonic — Fri, 24 Mar 2017 06:56:20 GMT

I don't exactly see why would there be need for shodan specific signatures.

First of all make sure that all inbound traffic is blocked with firewall policy, except for servers snd services which need to be visible from all interenet (web servers, smtp, IPSEC...).

Services which need to be visible to internet need to be hardened and secured. For these services Shodan is the least of your worries. You want them secured from hackers and malware, not just Shodan. So why specific signature for Shodan traffic?

Re: Block scanning from shodan

j04nMan — Tue, 28 Jan 2020 21:42:42 GMT

Maybe because the customer asked for it?

Re: Block scanning from shodan

UtkarshB — Wed, 06 Sep 2023 05:07:15 GMT

correction there: FQDN will refresh in 30 seconds.

I was hoping if we could use domain based EDL in source but that isn't working.
Is there any way to get the most latest list of shodan.io subdomains/IP addresses

Re: Block scanning from shodan

UtkarshB — Wed, 06 Sep 2023 05:13:37 GMT

Did that work out!

Is there any app-ID yet for shodan.io
I don't see

Re: Block scanning from shodan

m.brewster — Fri, 31 May 2024 12:32:46 GMT

If you block the known bad actors list, shodan is on that list.