Revealing the Black Box of Device Search Engine: Scanning Assets, Strategies, and Ethical Consideration
Mengying Wu, Geng Hong, Jinsong Chen, Qi Liu, Shujun Tang, Youhao Li,, Baojun Liu, Haixin Duan, Min Yang

TL;DR
This paper thoroughly examines device search engines like Censys and Shodan, revealing their operational strategies, ethical issues, and the risks they pose to user privacy and security through extensive empirical analysis.
Contribution
It introduces a novel framework to trace scanner IPs, provides the first comprehensive analysis of their scanning behaviors, and highlights significant ethical concerns and privacy risks.
Findings
Scanner IPs are difficult to block or evade.
Engines often send malformed or unauthorized requests.
They publish PII and screenshots, raising privacy issues.
Abstract
In the digital age, device search engines such as Censys and Shodan play crucial roles by scanning the internet to catalog online devices, aiding in the understanding and mitigation of network security risks. While previous research has used these tools to detect devices and assess vulnerabilities, there remains uncertainty regarding the assets they scan, the strategies they employ, and whether they adhere to ethical guidelines. This study presents the first comprehensive examination of these engines' operational and ethical dimensions. We developed a novel framework to trace the IP addresses utilized by these engines and collected 1,407 scanner IPs. By uncovering their IPs, we gain deep insights into the actions of device search engines for the first time and gain original findings. By employing 28 honeypots to monitor their scanning activities extensively in one year, we demonstrate…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
