New click-to-hack tool: One script to exploit them all and in the darkness TCP bind them

This will be out there, no matter the admonishments

Kid sploiters will find all and won't read the TOS.

Batten your hatches instead of suggesting that nice people don't do these things.

Script kiddies will use it

And they will get caught.

And then we'll have another teen fighting an extradition to Gitmo.

"As with anything, it can be used for good or bad," the security researcher added. "The responsibility is with the person using it. I am not going to play gatekeeper to information. I believe information should be free and I am a fan of open source in general."

It is important to have an open mind, but not so open that your brains fall out.

If exploits exist then what better way to have them removed

Like with Intel waiting months after being told of vulnerabilities before admitting the fault but not stopping sales of the effected hardware, vendors often wait too long before fixing problems.

Once a vendor is told a problem exists then every victim who suffers after that point is down to the vendor and people should be able to sue to any losses.

If every known hole is closed then it will take time for any new exploits to filter down to someone who is going to make them public domain like this dev has. More than enough time for the vendors to plug the holes in their sinking ships.

As the saying goes "if we don't make giant mutant firebreathing camels first then someone else will and we will be caught with our pants down"

The time has come

I've been in hardware and software design for over 30 years; I cut my teeth on an IBM 1130 and I haven't looked back since.

I am glad these tools come out - the tools that make fuzzing easier make me a better engineer. If an IT pro is worried about how this will impact his/her company then grow the fuck up.

You either pay your staff to make secuity their full time job, or your companies stock drops. It is so easy to let yourself in the back door or even the front door in todays infrastructure, automated sploits should be the least of your worries.

With state sponsored espionage the norm these days, that Fortune 500 companies continue to farm out work to the lowest bidder if at all, I am the person that you shouldn't detest, but be glad that I exist.

Your choice - talk to me now, or see me later.

This is nothing new , or we wouldnt have had the term "Script kiddie" since the eighties

"As with anything, it can be used for good or bad"

It's pretty hard to invent a "good" use for this, although perhaps I'm lacking imagination. You can make that argument for Shodan and Metasploit in isolation as they can be used by ethical pen testers in a focused way, but tying them together to allow indiscriminate pwnage by the completely unskilled is hard to justify.

Although as others have pointed out, it's not hard to do this kind of scripting and within reach of even marginally skilled bad guys. I imagine if you have an exploitable system indexed in Shodan, you're pretty much toast anyway.

"Python 2.7"

How unfashionable.

if those naughty TLAs hadn´t found all those bugs in the first place ....

or if they hadn´t hoarded them all up because this really is just a major case of ¨what goes around, comes around¨ or ¨not everything that should stay in Vegas, will stay in Vegas ...¨ or ¨wouldn´t it be grand if all software was formally proven to be bug-free ...¨

Shodan is evil

Shodan has long been, if not created for the sole purpose of exploiting others.

#1 use of it, hacking web cams, #2 looking for exploitable PCs and servers, now maybe loading crypto miners.

I have had nasty conversations with Shodan from them port scanning us every day for a year. They denied it, and said they scan things at most once a month - Unless they are hired to scan - anyone can hire them to scan anyone - I hope they all get cancer and die slowly.

Anyone who scans me...

...will have their subnet automatically and permanently blocked at the firewall, Shodan included.

Defending Shodan

In Shodan's defence; one can either choose to blithely carry on, or one can use such services to identify and close holes.

The one thing you can depend upon is human fallibility when it comes to the design of complex systems. Mistakes will be made; particularly so where systems evolve. Checking back for them is just plain common sense.

The old advice to airgap systems has conclusively been proven as a non-starter. Shodan and Metasploit serve a useful service for those charged with defense. Eliminate the bloody obvious, and what's left will generally only be identified by the highly skilled and determined. Last I checked; the latter two categories are damn near impossible to block.

With minor tweaks the autosploit script is a useful, and in hindsight, bloody obvious tool in it's own right.

And yes, it's a script kiddies dream too. :-)