Digital Ghost Ships: Abandoned, Neglected, and Obsolete IoT and OT Devices Exposed to the Internet

The rapid adoption of Internet of Things (IoT) and Operational Technology (OT) devices to control systems remotely has introduced significant cyber-security challenges. Attackers have compromised millions of such devices over the years, exploiting their lack of management and weak cybersecurity. This paper examines cyber-security issues of neglected, obsolete, and abandoned IoT and OT devices exposed to the Internet. To unify these issues under an umbrella term, we coined the term Digital Ghost Ships (DGSs). Our work focuses on identifying DGSs using common scanning tools to find indicators of security misconfigurations and misuse. Moreover, we compare two Internet-wide scans conducted two years apart, focusing on security issues in eight IoT and OT protocols: MQTT, CoAP, XMPP, Modbus, OPC UA, RTPS, DNP3, and BACnet. During our first scan (S1) we found 675,896 DGSs, and 75,007 during our second scan (S2). Lastly, we examine the IP reputation of the vulnerable devices and find that 7,424 (S1) and 792 (S2) DGSs were reported at least once.