Censys, the new search engine for the Internet’s secrets

Censys is a new Search Engine for devices exposed on the Internet, it could be used by experts to assess the security they implement.

Now the hackers and experts have a new powerful tool for their analysis, it is Censys, a search engine quite similar to the most popular Shodan. Censys is a free search engine that was originally released in October by researchers from the University of Michigan, it is currently powered by Google.

Censys is a search engine that scans the Internet searching for devices and return aggregate reports on how resources (i.e. Devices, websites, and certificates) are configured and deployed.

censys search engine

Censys daily scans of the IPv4 address space searching for any devices and collecting related information.

“Censys is a search engine that allows computer scientists to ask questions about the devices and networks that compose the Internet. Driven by Internet-wide scanning, Censys lets researchers find specific hosts and create aggregate reports on how devices, websites, and certificates are configured and deployed.” states the description on the Censys official website.

Censys, like Shodan, maintains a complete database of every device exposed on the Internet. It represents a privileged instrument for the hackers that have to search for a specific target and need to gather information on its configuration. At the same time, security experts could easily locate poorly protected devices exposed over the internet.

“We have found everything from ATMs and bank safes to industrial control systems for power plants. It’s kind of scary,” said Zakir Durumeric, the researcher leading the Censys project at the University of Michigan and inventor of ZMap.

Censys was developed as a part of an open source project that aims at maintaining a “complete database of everything on the Internet,” the intent is to help security experts to assess the security of products and services exposed on the Internet.

Censys uses ZMap, a network scanner that analyzed 4 Billion IP addresses and collect information on a daily basis, and ZGrab, as an application layer scanner. The Censys architecture and the functions it implements are detailed in the research paper.

ZMap is able to scan specific machines searching for security vulnerabilities that could be potentially exploited.

Let me suggest to read the MIT Technology Review on Censys, entitled “A Search Engine for the Internet’s Dirty Secrets,” but most interesting is the step-by-step tutorial published by the development team.

Censys is already used by security experts, recently the researchers from SEC Consult have found that IoT devices are re-using cryptographic keys, leaving in danger millions of devices.

The experts analyzed 4000 firmware and found around 580 unique private keys, the use of Scans.io and Censys.io allowed them to discover that the same set of keys was widely re-used, on 580 keys, 230 are actively used.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Censys, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.