Most people think of Google when they hear the word "search engine." Google crawls websites, indexes pages, and helps you find information meant for humans.
But there is another kind of search engine that does not care about websites at all. It looks for devices: security cameras, baby monitors, routers, printers, even industrial systems that control factories and water plants.
This search engine is called Shodan, and it can show you thousands of devices sitting wide open on the internet, without hacking a single one of them.
In this article, I will explain in simple language:
- What Shodan is and how it works
- Why so many cameras and other devices are exposed
- How attackers and researchers use this visibility
- The story of the Mirai botnet that used unsecured cameras to take down big parts of the internet
- A practical five-step checklist to lock down your own home or office network
My goal is to help you understand how visible your devices really are, and how to protect yourself with a few simple changes.
What Is Shodan and How Does It Work?
Traditional search engines like Google read web pages meant for people.
Shodan does something different: it talks directly to machines.
Every device on the internet has an IP address. When something on the internet says "hello" to that address, many devices reply with a short introduction called a banner.
A banner can include:
- What kind of device it is (camera, router, database, etc.)
- What software and version it is running
- The manufacturer
- Sometimes extra information that should never be exposed publicly
Shodan's basic idea is very simple. It knocks on devices all over the internet. Whatever the device says back in its banner, Shodan records. It stores those responses in a searchable database.
So when you search Shodan, you are not searching websites. You are searching a giant catalog of devices that replied to the internet's knock.
If a camera shows up there, it is not because Shodan hacked it. That camera is sitting on a public address, and when Shodan asked, it answered: "Hi, I am a network camera. Here is my model number and my login page."
That is not a break-in. That is the device willingly introducing itself to a stranger over the open internet.
This subtle difference, no exploitation, just recording public responses, is exactly why Shodan is legal to run but still very unsettling to think about.
It Is Not Just Cameras: What Shodan Can See
Once you start cataloging every device that answers, you do not just find webcams.
You find:
- Routers and firewall admin pages
- Printers sharing status interfaces
- Databases exposed with no password
- Smart home devices like fridges and TVs
- Industrial control systems that run critical infrastructure
Security researchers have used Shodan to discover water treatment plants, factory control panels, and other sensitive systems reachable from the public internet, when they should only be accessible from inside a private network.
Shodan was not built for stalkers or voyeurs. It was created so companies and defenders could see their own exposure, find forgotten systems, and close doors before attackers find them. If this kind of intelligence gathering interests you, I wrote a separate guide on how open-source intelligence works that explains the bigger picture.
How Anyone Can Find Exposed Devices
This is the part that sounds like a hacker movie, but technically it is just search filters.
Shodan is a database, and databases love filters. You can filter devices by:
- Product type
- Words in the banner
- Port number (which service is running there)
- Country or even city
Many IP cameras behave similarly online. For example, web interfaces often listen on ports 80 or 880, and a huge number of cameras stream video on port 554 using RTSP (Real Time Streaming Protocol).
If you combine filters like port:554, a specific camera vendor or model, and a city filter, you end up with a map of exposed cameras in that city. All discovered without any complex exploits, just search and filters.
This is why people call Shodan "the scariest search engine," even though it technically never breaks in.
Legal and Ethical Line: Curiosity vs Crime
Finding a device using Shodan is one thing. Opening it is something completely different.
A camera or device appearing in a Shodan result only means it exists, it is exposed to the internet, and it responded to a public request. The moment you click into a live camera feed, admin page, or system you do not own, even if there is no password, you are accessing a computer system without authorization.
In most countries, that is clearly illegal. People have gone to prison for this kind of behavior. So the rule is simple: you may scan, test, and explore only networks and devices you own or have explicit permission to test. Treat everything else as off-limits, even if it looks "open."
In this article, I focus on the useful side: using Shodan to understand your own exposure and strengthen your security.
Using Shodan to Check Your Own Network
Shodan can be a powerful defensive tool. You can use it to see your home or office the way an attacker, or a botnet, might see it.
Here is a simple way to do that:
Find your public IP address. In your browser, search "what is my IP." Note the number your router shows to the internet.
Look up that IP in Shodan. Go to Shodan and use the host lookup feature. Paste your public IP address. Shodan will show you every open port and every service it has seen running at that address.
For most regular home users, the healthy result is boring: almost nothing visible. That is exactly what you want.
If you see things like camera interfaces, router admin panels, databases, or media servers, then something in your house is probably reachable from the open internet.
You can also search by device model name. Search for your camera or DVR model. Shodan will show how many identical devices are exposed worldwide, often with a login page visible in the preview.
This is not an invitation to log in. It is a mirror: if thousands of devices exactly like yours are wide open, there is a good chance yours might be misconfigured too, so it is time to check.
Security professionals use Shodan like this all the time: map their own attack surface, find forgotten exposed systems, and close doors before attackers discover them.
One important note: exposure does not always mean vulnerability. It means the device is visible. And visibility is where every attack begins.
Why So Many Cameras Are Exposed
You might be wondering: if all of this is so dangerous, why are so many devices left open?
The answer usually comes down to two very human problems.
Default Passwords
Most cameras and IoT devices ship from the factory with simple default credentials like admin for the username and admin, 12345, or literally password for the password.
The manual tells you to change the password. Most people never read the manual. So the device goes online using the same credentials that are printed in a PDF anyone can download from the manufacturer's website.
Some cameras are so careless that the default login details appear in the banner Shodan reads. In other words, the device basically hands you the keys while it is introducing itself.
Port Forwarding and UPnP
By default, a camera on your home Wi-Fi is not reachable from outside. But people want to check their camera feed from work or while travelling.
To enable that, they, or the device itself, set up port forwarding on the router: a permanent hole from the internet straight into the camera.
It gets worse. Many cheap devices use a feature called UPnP (Universal Plug and Play) to open these ports automatically, often without clearly asking for permission or explaining the risk.
Now combine a public port opened to the internet with a weak or factory default password. The camera is not just findable. It is basically a walk-in. No exploit, no fancy malware, just a door nobody ever locked.
Real-World Damage: From Peeping to Botnets
This level of negligence does not stay harmless. There are real cases where exposed cameras caused serious problems.
Trendnet Camera Leak
Years ago, a camera brand called Trendnet had a flaw that left thousands of home camera feeds accessible online with no password. People could view living rooms, front doors, and baby cribs simply by finding the camera addresses, often through device search tools like Shodan. The U.S. Federal Trade Commission later took action against the company over this incident.
This is the scenario most people imagine: strangers watching your camera. It is creepy and invasive, but still relatively small in scale.
The Mirai Botnet: When Cameras Attack the Internet
Now let me tell you about something much bigger: the Mirai botnet in 2016.
Mirai performed an automated version of everything I just described. It scanned the internet non-stop for IoT devices, mostly cameras and DVRs, still using factory default passwords. When it found one, it logged in using the default credentials and quietly took it over. It then added that device to a growing botnet, a remote-controlled army of compromised machines.
Mirai eventually controlled roughly 100,000 hacked cameras and recorders. On October 21, 2016, it pointed this army at a major DNS provider called Dyn. The resulting flood of junk traffic peaked above 1 terabit per second, causing massive disruption. For much of that day, huge services like Twitter, Reddit, Netflix, Spotify, and GitHub became unreachable or painfully slow for millions of people.
Before that, Mirai had already been used to knock the website of security journalist Brian Krebs offline. To make things worse, Mirai's source code was later released publicly. Since then, variants of that code have continued scanning for open, poorly secured cameras, possibly including yours, to this day.
The key lesson: the real risk is not only that someone might watch your porch. It is that your unsecured camera can be quietly drafted into a botnet army used to attack the wider internet, and you might never notice.
If this story made you think about what else might be hiding on your home network, I have a detailed post on how cheap smart gadgets hide dangerous backdoors that covers residential proxy malware and other hidden threats.
Five Simple Steps to Lock Down Your Cameras and Devices
The good news: most of this is fixable with a few simple habits. Here is a practical five-step plan you can follow today.
1. Change Default Passwords (Highest Priority)
This is the most important step by far. Change the default password on every camera, DVR, router, and IoT device. Use long, unique passwords for each device. If the devices compromised by Mirai had strong unique passwords, they would have been invisible to that botnet.
If you do only one thing today, do this.
2. Stop Exposing Devices Directly to the Internet
Remove any manual port forwarding rules you set up for cameras or other devices. Disable UPnP in your router so devices cannot silently open ports on their own.
If you still need to access your camera from outside, use the manufacturer's official cloud app, which usually proxies the connection through their servers, or set up a VPN into your home network and view the feed through that. Both approaches let you access your camera without leaving it exposed to the entire world.
3. Keep Firmware Updated
Many scary vulnerabilities were patched years ago. Users just never installed the updates. Log into your device interfaces and check for firmware updates. Turn on automatic updates wherever possible. An updated device is much harder to abuse.
4. Isolate IoT Devices on Their Own Network
Treat cheap IoT devices as untrusted roommates. Use a guest Wi-Fi or a separate network for cameras and smart devices, separate from your main computers and phones. If one camera gets compromised, the attacker is stuck in a sandbox rather than sitting next to your main machines.
5. Regularly Check Your Exposure with Shodan
Every few months, repeat the Shodan check. Look up your public IP in Shodan. See which ports and services are visible. It takes under a minute and gives you a rare view of your home from an attacker's perspective.
Final Thoughts
Shodan feels like a hacker weapon, but it never forces its way into anything. It simply walks down the digital street and writes down which doors were left open. The devices are the ones exposing themselves. Shodan just makes that exposure searchable.
The scary part is realizing how many doors we leave open by accident, with default passwords, lazy setup, and "I will secure it later" thinking.
The hopeful part is this: most of the fix is firmly in your hands, and many of the biggest problems are just one strong password and a few settings changes away.
So, change those default passwords, close those unnecessary ports, and then look yourself up. If the results are boring, that is a win. That means you are doing it right.
Frequently Asked Questions
Is Shodan illegal to use?
Shodan itself is legal. It only records information that devices willingly broadcast to the public internet, much like Google indexes public web pages. What is illegal is accessing devices you do not own, even if they appear open. Stick to scanning only your own networks.
Can I remove my devices from Shodan?
Yes, Shodan respects opt-out requests. You can submit a takedown request through their website. However, the real fix is securing the device itself: if it is not exposed to the internet, it will never appear on Shodan in the first place.
What is the difference between Shodan and a regular search engine?
Google crawls and indexes website content. Shodan scans IP addresses and records the banners that devices return when contacted. One indexes pages meant for people, the other indexes devices that happen to be reachable online.
How do I know if my home camera is exposed?
The fastest way is to look up your public IP address on Shodan. If you see open ports that lead to camera interfaces, they are exposed. You can also use Shodan's search to look for your specific camera model and see how many identical units are publicly visible.
Does a VPN protect my IoT devices?
A VPN protects the traffic leaving your computer or phone, but it does not hide the devices sitting on your home network. If your camera has a port open to the internet, a VPN on your laptop will not close that port. You need to secure each device individually, or better yet, remove the port forwarding and use a VPN to access your home network securely from outside.