Shodan: the limits of what is allowed or where the hacker's white hat ends

A lot has been written about the search engine Shodan, including on Habré ( here , here , here and also here )





Questions about whether the use of Shodan is legal or in what cases it is legal / illegal are encountered on the Internet quite often (see, for example, here or here - in the latter case, a very interesting question about the legality of connecting via Shodan to an unprotected server). And often it is impossible to find a really reasonable and clear answer to them what can and cannot be done.





The "hacker" seems to have published an article with a promising title "How to legally use a search engine on the IoT" , but, in my opinion, did not give a clear answer either. On Habré RUVDS, although it gave a disclaimer, was not clear enough (it all depends on the country where the remote device is located).





/ Shodan, .





, , ( - « »): 2001 , , – . ( 202a, 202b, 263a, 303, 303b ), ( , . 272 ).





( The Computer Fraud and Abuse Act, - , The Virginia Computer Crimes Act). Crimes Act 1958 .





( ) : , .





- – Shodan.





1.    , , , . , , .





- , , . ? . ? (, ). , / - – .





, , «» : – « . , » .





– – « ....».   





2. . , - , . : , , , , .





3. . . – , , . - ? . : , , , ?





, :





Shodan?





, , .





, ?





, (, , ..) ( - ) /. – , .





  ?





, , – .





, Shodan?





Illegal in the cases stated above. Such actions will be qualified as an attempt on unauthorized access.





And if for the purpose of research or verification of information security?





Legal, but be prepared to present irrefutable evidence of such a goal.








All Articles