I thought I would make a blog post about the new search engine.. Shodan.
It is a search engine for ALL sorts of stuff, including FileShares and Databases!!! And if you have been in dentistry for awhile, you would know how weak many of the database in dentistry authenticate, you may ALSO have seen at times, people who expose servers to the internet.
This has never really been a big deal, until now. Because now, there are search engines that query actual databases and things that Google has traditionally ignored.
When you combine these two (Shodan, and Hard-Coded Database credentials) it could spell out disaster for anyone that is found in the search result for Shodan.
For instance, today I searched for Schick CDR and PowerPay and found 12 Schick CDR Databases exposed along with 14 PowerPay Servers exposed. Power Pay is merchant account software that is sold by Henry Schein and used in a dental office.
![]()
I have searched for OpenDental and Dentrix and etc. I don't think Shodan has found that many OpenDental servers but I don't think Shodan attempts to authenticate with default mysql credentials, so it wouldn't find them even if they were exposed. Same with Dentrix (Faircom ACE) and Eaglesoft (Sybase SQL). But MS-SQL.. it seems you can see information about the actual instance without authentication.
Oh.. Did I mention I got raided by the FBI for finding patient data on ftp.eaglesoft.net???
http://www.dailydot.com/politics/justin-shafer-fbi-raid/
It is a search engine for ALL sorts of stuff, including FileShares and Databases!!! And if you have been in dentistry for awhile, you would know how weak many of the database in dentistry authenticate, you may ALSO have seen at times, people who expose servers to the internet.
This has never really been a big deal, until now. Because now, there are search engines that query actual databases and things that Google has traditionally ignored.
When you combine these two (Shodan, and Hard-Coded Database credentials) it could spell out disaster for anyone that is found in the search result for Shodan.
For instance, today I searched for Schick CDR and PowerPay and found 12 Schick CDR Databases exposed along with 14 PowerPay Servers exposed. Power Pay is merchant account software that is sold by Henry Schein and used in a dental office.
I have searched for OpenDental and Dentrix and etc. I don't think Shodan has found that many OpenDental servers but I don't think Shodan attempts to authenticate with default mysql credentials, so it wouldn't find them even if they were exposed. Same with Dentrix (Faircom ACE) and Eaglesoft (Sybase SQL). But MS-SQL.. it seems you can see information about the actual instance without authentication.
Oh.. Did I mention I got raided by the FBI for finding patient data on ftp.eaglesoft.net???
http://www.dailydot.com/politics/justin-shafer-fbi-raid/