Rendered at 08:12:24 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
Confiks 8 hours ago [-]
So the author charitably calls the 2025 vulnerability a "login bypass", but it's much worse than that. The firmware included a "datetime-based password" mechanism: a built-in backdoor password, like it's the 90s again.
The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food", which the attackers apparently took to be a good suggestion.
As the firmware is open for anyone to download [2], blurring the affected function seems more like an invitation to find out more. I know I was curious when the news about the fridges in France broke. The function's actually called "check_code_of_the_day", and this is the implementation:
Thanks for the heads up, I had to laugh with the introduction paragraph, given the code example, and incident,
> Danfoss takes security seriously and as part of our continued improvements, new measures are being implemented. Please review below important security updates included in the latest AK-SM 800A software update that may impact your upgrade experience
floro 2 hours ago [-]
"like it's the 90s again" - it probably was made in the 90s. Working with industrial systems it doesn't surprise me at all.
missmewiththatl 7 hours ago [-]
I'm was super glad I could just copy/paste that code in my LLM-of-choice and it gave me a reasonable explanation of how to exploit it. Thank god an attacker couldn't do that.
amluto 6 hours ago [-]
This doesn’t require any fancy analysis. You can literally read the password off it — the last bit is an oddly decompiled string comparison.
bryanrasmussen 2 hours ago [-]
Not everybody writes in the language they want to exploit I suppose, that's the great thing about LLMs!
on edit: even though I don't know C or C++ (I suppose it's C but can't be sure) I do think I can figure out what it's doing and how to guess what the password is, so that seems bad.
lifeisloving 3 hours ago [-]
Well most SWEs need an llm to spell their own name now.
tarxvf 2 minutes ago [-]
That's not true, copy and paste hasn't fully atrophied for most people yet.
vasco 2 hours ago [-]
Claude disagreed with this take but I'm but I'm not sure it's true myself.
imjonse 3 hours ago [-]
The fact that Russia has access to LLMs that could decompile and explain this firmware ( and possibly even translate the explanation to Russian! ) is just another proof that this was definitely part of the hybrid war and Europe needs to spend a few more tens of billions on weapons and possibly impose restrictions on open weight LLMs.
zelphirkalt 2 hours ago [-]
That's not a solution. Russia can just take the next LLM rolling out of China. The fix is to not be stupid and fix our broken infrastructure. Especially, IT infrastructure, but also things like idiotically Internet-connected fridges of supermarkets apparently.
isoprophlex 1 hours ago [-]
What the hell is up with that comparison at the end?! Seems... overly verbose?
nananana9 18 minutes ago [-]
The programmer probably wrote memcmp(pass, buf, 5) which compilers will often fold into an inlined loop, or a few comparisons if they know the 3rd arg.
The weird thing is it didn't emit a 32-bit load+compare for the first 4 bytes, this could probably be done with 2 comparsions. Idk. Maybe weird CPU with stricter alignment rules.
Turneyboy 58 minutes ago [-]
Most likely this is decompiled and not the way it was originally written.
jonatron 39 minutes ago [-]
Yep, and you can prompt something like "the function was a decompiled version, translate it into a readable version", if you don't like reading [probably] ghidra output.
MiroslavPokorny 3 hours ago [-]
The real problem is devices like this should NOT be connected to the internet and at worst air gapped. Theres no reason including cost that a separate computer just for the fridges etc is not sitting in the office of the supermarket. Pretty sure the destoyed goods and close time cost far more than the extra cheapo computer.
oulipo 34 minutes ago [-]
Or it should/could be connected, but in a read-only mode (eg monitor the data). And control could require someone on the location doing a physical button (pushing an "authorize command" button physically behind the fridge, or in a local control room, or something)
wolfi1 30 minutes ago [-]
I don't think the company which installed the fridges would be tech savvy enough for that nor the supermarkets
ExoticPearTree 2 hours ago [-]
My belief is that is more about convenience than anything else.
It is also worth looking at why this is so, which most likely stems from the lack of technically inclined staff in every location and the cost of having a tech going from store to store everyday to deal with POS, back office computers, amd any other kind of device.
Now, can you secure all this? For the most part yes, but it is quite expensive to do it. Maybe they will do it now or they will go with “it cannot happen to us twice” thinking and not do anything substantial about it.
Maxion 2 hours ago [-]
It's not just about having tech inclined staff, but just the whole staffing strategy in general. Most grocery stores et. al. try to staff as cheaply as possible and try to have their workers do as much as possible during their shift. This means that there's no extra time available that they're not shelving products, or sitting at the register.
Rather than have extra staff at the store to do stuff like monitor fridge performance, it's better to have them report stuff centrally and have someone or some tool monitoring thousands of fridges across the entire chain. This way you can send out repair teams and plan maintenance more efficiently.
MiroslavPokorny 57 minutes ago [-]
We all have fridges in our homes.
Why would managing fridge temps be a job that requires more than a few minutes a day at most ?
How hard could it be ?
kelseydh 48 minutes ago [-]
I suspect when you load a big fridge with lots of room temperature product (does that happen?) the fridge struggles to maintain adequate cold. Though that still seems like something the fridge itself could handle locally.
Surely, these fridges weren't doing inventory tracking? (Or were they?)
TeMPOraL 39 minutes ago [-]
Don't forget the fridge is also opened probably 3 times a minute on average during business hours. The use profile is entirely different to home.
TeMPOraL 40 minutes ago [-]
Home fridge, like all home appliances, is basically a toy version of the professional one.
whatareference 45 minutes ago [-]
There is a video game where you can unlock a thermostat which grants you extra points if you go back to it and readjust the temperature once in a while. Everyone hated it and kept mentioning just how ludicrous it is that a device called a "Thermal Static" somehow works by inputting thermal changes as opposed to thermal targets, prompting the developer to agree that was the stupidest idea they had and they would be changing it.
This game is nsfw.
Are you implying french fridge makers in real life are stupider than porn?
zx8080 27 minutes ago [-]
Of course it should be connected! Must be! How else would a manager sell customers data in real time to anyone who wants to buy it?
It's so boring to just sell fridges, let's spy on customers and sell that data! /s
Sad world of greedy things.
The shit will go on until those who makes such decisions start going to jail regularly.
SOLAR_FIELDS 8 hours ago [-]
Through my work I deal with grocery software and I can tell you that grocery software is ages behind the times. For most small retailers (small being a business owner with less than 10 stores in their retail chain, mostly local grocers) you are dealing with processes that would have been considered antique for the year 2000
josephg 7 hours ago [-]
It’s the same in a lot of sectors. Airlines. Electricity companies. Probably train lines. Banks. Fire services.
With all the disruption from AI on our industry, I can’t help but feel a little jealous.
31carmichael 7 hours ago [-]
Electricity companies should be 100% air-gapped from any internet connection, whether or not they have outdated software.
_carbyau_ 39 minutes ago [-]
So... how do you feel about apps[0] that let you automate pushing electricity to the grid from your own home battery based on wholesale electricity prices?
Critical National Infrastructure should go further, as Iran found out with Stuxnet.
Gigachad 6 hours ago [-]
You can do a one way link, sensors on infrastructure which emit data only but can not receive anything. Then another device like an ESP32 or whatever the industrial version is which reads the data and makes it available to the internet.
You now have the ability to remotely monitor the system but hacking it does not allow you to control anything. Though there is still a sizable amount of infrastructure which has no on site workers and needs to be remotely controlled.
procflora 6 hours ago [-]
There is plenty of room for antiquated process and technology in utilities that has nothing to do with grid operations, trust me. :)
SteveNuts 7 hours ago [-]
Maybe AI will be able to give us a better FTP server in these industries
procflora 6 hours ago [-]
We already have that it's called SFTP. ;)
Wait what do you mean you want to use a key to log in, our stuff doesn't support that.
Gigachad 7 hours ago [-]
AI enabled hackers are going to break everything that’s connected to the internet forcing it to move in to the modern era.
josephg 7 hours ago [-]
Disconnecting is also effective. Fridges don’t need to be on the internet.
oulipo 32 minutes ago [-]
That's not clear. Perhaps the savings made by having connected fridges over the year has offset the hacking event waste, so overall it could still be worth it. Now they need to apply security patches, and possibly only use the connection for monitoring (read-only) and have a kind of "2FA" / physical presence required when sending commands from the web
Kina 7 hours ago [-]
What does AI have to do with this?
Gigachad 6 hours ago [-]
So much security in the past relied on "no one would bother to look in to this". We now have armies of bots relentlessly scanning over everything which is the main reason everything has been getting hacked over the last few months.
ryandrake 5 hours ago [-]
I'm really hoping that if it comes to pass, millions of AI-based hacking agents running amok on the internet, exploiting every single thing they can find, will at long last finally cause companies to get their shit together and secure their systems.
Imagine if your neighborhood had a million autonomous door-opening drones randomly flying around identifying doors and entering them. It wouldn't take long for everyone to lock their doors.
socalgal2 2 hours ago [-]
I don't disagree with you. But let's expand.. Imagine every neighborhood had autonomous brick throwing drones randomly smashing windows. Imagine every neighborhood had autonomous flame throwing drones randomly setting fires. Imagine every neighborhood and autonomous gun shooting drones randomly killing. Imagine every neighborhood and autonomous grenade lobbing drones randomly blowing up walls.
You can not defend everything. At some point you have to realize the world works because not every exploitable thing is exploited and we live in a civil society (most of us anyway).
I get it, the internet makes things different. But your analogy doesn't work
You can not build a building that can not be destroyed.
Gigachad 3 hours ago [-]
My hope and what I see happening is that the major players in the software space are frantically patching as many bugs as they can right now to keep ahead of attackers, and we come out the other end with incredibly robust software.
All the unsupported iot stuff will be obliterated by malicious bots, but the next generation of iot will be both more robust and less directly exposed to the internet. Like how Matter devices sit behind a hub rather than directly connecting to the internet.
Kina 6 hours ago [-]
I think this is irrelevant.
There is no evidence AI was used to do this and it feels like a random way to force AI into the conversation? It’s just spectacularly negligent behavior by people who think that they don’t have to trouble themselves with security, but want the convenience of having their stuff on the Internet for remote management.
This is just like the OPM hack 10 years ago.
eterm 7 hours ago [-]
AI is ruthlessly effective at finding vulnerabilities.
chrisweekly 7 hours ago [-]
into the modern era...
... or back into the dark ages
SOLAR_FIELDS 7 hours ago [-]
I am reminded of this every time I fly Southwest Airlines
matthewdgreen 6 hours ago [-]
Grocery stores can be as behind the times as they want. I'm worried about hospital fridges.
kevin_thibedeau 7 hours ago [-]
I know someone at a 100 store operation and they're equally working in the stone age.
drillsteps5 8 hours ago [-]
To be fair, their entire threat model was likely "who TF would want to break in to change the settings on a thermostat on a fridge at a grocery store".
A valid question which has yet to be answered (at least not publicly).
rcxdude 13 minutes ago [-]
If 'who TF' includes "everyone on the internet", then there are more than enough people who would do it to prove a point, for bragging rights, just for kicks, or because they want to cause as much damage as possible. The only question is how large is the intersection of that group and those with the ability and awareness to do it (something that is growing with the increased capabilities of LLMs).
pstuart 7 hours ago [-]
Some threat actor that demands quick payment or their perishables perish?
drillsteps5 7 hours ago [-]
It's a fridge. In a grocery store. You just get an employee to adjust the thermostat dial. How would the hackers demand payment if all you need to do is turn the dial back to "frozen"???
Edit: Yes i know the commercial fridges do not have "dials" and it's more involved. Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.
masfuerte 7 hours ago [-]
> Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.
Sure, with time and expertise. How does the average employee adjust the virtual thermostat on fifty network-controlled fridges before the food goes bad?
drillsteps5 7 hours ago [-]
I don't know about your grocery store but the ones I've been to have maybe 5 on the shopping floor and probably a few more in the back. They all have physical controls which (I'm assuming) override the controller if something goes wrong. So if big bad hacker says "I'm gon' turn y'all fridges off if you don't pay me" it's not a threat, it's a silly joke.
Unless of course they turn it off without telling the businesses so the products go bad because nobody's watching over the weekend or smth. But then again, why would someone want to do that. I wonder.
sznio 1 hours ago [-]
not if you set it to defrost at 1AM. the food's gonna be cooked by the time someone comes in
gz5 7 hours ago [-]
fridges are very reliable. but let's IoT them anyways so they can theoretically notify us if there is a problem.
so of course that creates/enables the problem and doesn't notify us.
deliciously ironic and rottingly sad.
this case was egregious - built-in backdoor pw - but that is downstream of the decisions to IoT them and to default them to listen on the network.
esikich 7 hours ago [-]
Electricity is expensive. Grocery stores work on extremely thin margins with stock that literally turns rotten. These are physical devices that need maintenance. Their failure is often catastrophic. Grocery store workers are not equipped to fix an HVAC system. Someone needs to monitor for preventative maintenance.
I can't understand the mindset that would treat this as a trivial problem. What's sad is your confidence in giving this situation a 5 second take and declaring the whole thing stupid. Yes, security was clearly an issue, but saying that monitoring of critical infrastructure is sad is bizarre.
prmoustache 2 hours ago [-]
Monitoring doesn't have to leave a way to enter the system automatically.
Alerts can be sent, and HVAC operators could have a process where they open a support ticket to get temporary access during scheduled windows by store managers.
I remember setting this up years ago for an hospital. Some third party suppliers could obtain RDP access to some VDI who could only accept a limited number of ips but they had to open a ticket and give a reason to get access. It wasn't a 365/24/7. Monitoring could still be sent any time.
AngryData 6 hours ago [-]
Remote monitoring by itself is not a problem, but remote control is and has no benefits. You can't change the temperature of or defrost a freezer without removing everything from it, and if you can remove everything from it someone is already there the change the settings. And it takes extra work to enable remote controlling of a refrigerator system over just providing temperature readings.
And it still isn't going to save electricity. The only thing it can do is warn of a failure and tell you that you got like 20 minutes to start moving food before it has to be trashed for exceeding safe food handling temperatures.
esikich 6 hours ago [-]
I mean, say you have 30 grocery stores, are you saying you shouldn't be able to build templates to deploy? You gonna have a guy drive all over the place updating schedules 24/7?
watermelon0 3 hours ago [-]
Why would you need to dynamically change the temperature?
esikich 3 hours ago [-]
Because the things you have in the fridge change. The opening and closing of the doors change. The actual equipment changes. Store hours change. Holidays happen. Sports games happen. Weather happens.
To be honest, a grocery store is one of the most dynamic systems I can think of.
Edit: A bang-bang thermostat is not an appropriate solution for a grocery store.
forgotusername6 2 hours ago [-]
That's called a thermostat and doesn't require remote control. The frozen food needs to be at the correct temperature all the time, regardless of external factors.
ninalanyon 7 hours ago [-]
> workers are not equipped to fix an HVAC system.
But they are perfectly capable of checking the temperature. After all the fridges and freezers are restocked multiple times a day so even if one failed it wouldn't have time to get warm before someone should notice.
Ad there are other ways of monitoring such as having an audible or visual alarm.
esikich 7 hours ago [-]
Do you think grocery stores are 24/7? How often do you think these checks happen? Do you think it's the best way for those employees to spend their time? How often would these checks need to be performed to show statistical significance? Do you have reason to believe these things have never been thought about by people who run grocery stores? What are the labor requirements in a grocery store to run effectively?
watwut 57 minutes ago [-]
These checks do not need to happen 24 times a day. It is in fact perfectly acceptable for the workers to check it in the morning. I swear to god HN is inventing issues that dont exist to defend overengineered solutions.
Also, offline fridges are completely normal.
hmartin 7 hours ago [-]
I wish I could upvote this comment more
gz5 6 hours ago [-]
good points and all the more reason to monitor in reliable, safe manner?
icehawk 6 hours ago [-]
This isn't your single compressor/evaporator/condenser coil appliance that sits in your kitchen. These are far larger and more complex systems.
The AK-SM 800A can control 170 different refrigeration devices. This is more akin to the entire freezer section (and probably meat and dairy) in your supermarket.
vlovich123 7 hours ago [-]
How is it a bad idea to want to automate maintenance of the fridges? It doesn’t require a bad implementation.
Grimeton 7 hours ago [-]
>85% ran software with known security flaws. That includes 527 older controllers Danfoss no longer supports. Only 195 had every known fix.
As long as the fridges are used the controller has to be supported.
This isn't a raspberry pi $50 a pop...
floro 2 hours ago [-]
Those fridges are from the 90s. You cant reasonably support it that long. It's not even just software. The PLC is fixed hardware, you can't simply patch that.
mrweasel 23 minutes ago [-]
You can replace the PLC. It's not like a modern PLC couldn't be made to control a 1990s fridge. The question is "Who will pay for the upgrade". DanFoss sure as hell won't. The stores won't, because they've already paid for the fridge.
Honestly I feel like this should fall under a support contract. The pricing structure could be similar to that of Microsoft. Support is fairly cheap, X number of years included in the purchase price, once the product reaches EOL the price goes up dramatically each year.
There's a massive problem in how we think about these products collectively. They are inherently insecure, they will be attacked and preventing it is expensive. You could build a safer alternative, but you'd be priced out of the market instantly by less safe, but more convenient alternatives.
jacquesm 7 hours ago [-]
Oh, great idea. We should do that for software: force manufacturers to support their software with bugfixes as long as it is in use. And just bugfixes, the marketing department can stay out of it.
ExoticPearTree 2 hours ago [-]
This will never fly. Some devices can be used for tens of years and they may face vulnerabilities that the hardware cannot support any kind of software fix for them. Imagine the world moves to TLS2 or whatever something new will be called and the hardware you have is too slow for it.
On the other hand, saying an industrial device should receive security updates for 10-15 years instead 5 or whatever happens this days it will be a major step forward. This will incentivise vendors to use better hardware with room to grow, not just the cheapest components possible.
Or, make componente modular so that you can upgrade just the control unit instead of the whole fridge or whatever.
rcxdude 31 minutes ago [-]
The EU's CRA does mandate this kind of thing. It states 5 years minimum, but it needs to be longer if it's expected that the product remains in use for longer, and you need to commit to it in advance and tell customers (at the point of sale: so printed on the box or on the product listing).
eterm 7 hours ago [-]
Things will only meaningfully change when insurance companies stop paying out when reasonable steps weren't taken by companies to protect themselves.
rcxdude 43 minutes ago [-]
Insurance does actually tend to put cybersecurity requirements on to businesses they insure, the problem is that it's pretty hard to write cybersecurity requirements that actually result in secure IT systems as opposed to just a bunch of compliance work.
esikich 6 hours ago [-]
As someone who has worked with small and medium sized businesses, reasonable is extremely variable. I'm dealing with a small business right now that can't upgrade their perfectly good computers because of TPM issues. On one hand, I kind of get the reasoning behind it, but how can you hold a business of 10 people accountable for not knowing how to buy a computer that will be reasonably future proof? Every business needs IT on hand? I think that's asking too much. On the otherhand, you should know the tools you need to run your business. There's no fine line.
ryandrake 5 hours ago [-]
I think if you can afford computers for your business but you can't afford to keep them secure, then you can't afford computers for your business.
esikich 5 hours ago [-]
What about plumbing and electrical? Do you need to employ those as well?
mmyrte 2 hours ago [-]
No, but you do need to keep them secure. The argument goes towards computers as appliances, which I wholly support.
Thaxll 8 hours ago [-]
No one at Danfoss got alerts than sudently hundred of fridges entered defrost mode? Reminds me of those computer you see at stores running weird ms-dos software.
cwillu 8 hours ago [-]
“With our new internet-connected refrigerator line, you can get notifications online if a bunch of equipment malfunctions.”
“Why would a bunch of equipment malfunction?”
“Because you plugged it into the internet, you dolt.”
pixl97 6 hours ago [-]
Many of these things have cycles where they clear frost or otherwise remove moisture from the system by getting hot. What you're talking about is something that could be common. It's the extended heating that starts causing problems, but if the software is taken over the alerts may no be sending.
BrenBarn 18 minutes ago [-]
We'll never get past this as long "well you didn't update" is considered an acceptable rebuttal. The problem is created when vulnerable software is released. We would be better off slowing things down by a factor of a hundred or more rather than continuing the current approach of "update every day to fix the new vulnerabilities introduced by the last update that fixed the old vulnerabilities".
achillean 8 hours ago [-]
From 2017 through 2022 there was a large increase in the number of exposed refrigerators:
Over the past few years it has fluctuated but not the same continued growth as before. If you don't have a Shodan account you can see a chart on twitter:
I'm not one to draw causality, but this vulnerability seems to have had quite the effect on France
cmiles8 34 minutes ago [-]
Reason 732 on why I want the “dumbest” fridge possible, not some “smart” fridge with an app.
jonathanlotan 1 hours ago [-]
They probably just didn't think anyone would want to hack that
paustint 7 hours ago [-]
When looters smash the glass door, it's pretty obvious the vulnerability has been there for YEARS!
tantalor 7 hours ago [-]
Why bother breaking through the glass front, when most places of business have a very obvious back door just waiting.
theteapot 4 hours ago [-]
How did these fridges even get public IP addresses?
Cameri 8 hours ago [-]
Does this amount to gross negligence?
seekup 7 hours ago [-]
even worse: it's grocer's negligence
vijayr02 2 hours ago [-]
You seem to set great store in your buns; take care, they may go bad
UltraSane 7 hours ago [-]
Not isolating the refrigerator API from the Internet seems very negligent.
anilakar 2 hours ago [-]
The refrigeration business does not really overlap with infosec or IT in general.
mrweasel 21 minutes ago [-]
It does now.
emot 8 hours ago [-]
hard to say who’s to blame: stores, installers or the vendor. most of these dashboards sat online for months, only 195 of 1,331 had every fix, and 76% went offline within days of the attack (disconnecting was possible all along, it seems).
jon128 7 hours ago [-]
[dead]
reincoder 8 hours ago [-]
[flagged]
system2 2 hours ago [-]
LLMs are writing better code than professional 90s and early 2000s developers. That's for sure.
So this is the real reason they're rioting. I'd be pissed too.
throwaway27448 7 hours ago [-]
Sadly no, it's just the same old incoherence over the point of the state
8 hours ago [-]
anonym29 7 hours ago [-]
List of legitimate reasons for a refrigerator, an oven, a stove, a washing or drying machine, a microwave, a coffee maker, a sink, a garbage disposal, a toilet, a shower or bathtub, or any other home appliance to be connected to the internet:
numpad0 3 hours ago [-]
Allegedly they needed to stagger compressor startups. Motors, even fully electronically controlled ones, can draw a huge current on startups.
mrob 33 minutes ago [-]
There's something very wrong with the electrical grid if they need to stagger startups over all the shops combined. Staggering startup within a single shop can be done with a LAN.
icehawk 6 hours ago [-]
The device in the article isn't a home appliance.
MiroslavPokorny 3 hours ago [-]
Makes no difference. A super market should be able to air gap all their smart devices and include a non internet connected computer.
esikich 7 hours ago [-]
- Monitor temperatures and get alerts before food spoils
- Get notified if a compressor fails, refrigerant leaks, or a door gets left open
- Catch failing fans, compressors, or defrost heaters before they break
- Automatically log temperatures for food safety inspections
- Optimize defrost cycles and compressor operation to save electricity
- Let technicians diagnose problems remotely instead of driving to the store
- Reduce power usage during peak electricity rates
- Monitor fridges and freezers across multiple stores from one place
- Track energy usage and equipment performance over time
- Get alerts when power goes out or equipment doesn't restart properly
mrob 23 minutes ago [-]
>Reduce power usage during peak electricity rates
This is the only one that requires remote write access, and only when "peak electricity rates" means a dynamic pricing system. But it doesn't actually need full Internet access. Instead, prices can be streamed via data diode to a local processor which calculates correct temperatures based on this information. This calculation should set reasonable limits on allowed temperature, so even if somebody sends false pricing information it's just going to waste some electricity and not destroy all the food.
>Optimize defrost cycles and compressor operation to save electricity
Assuming this means something different from "Reduce power usage during peak electricity rates", I don't see how it needs Internet access at all.
All the other points are monitoring tasks that can be done with read-only access via a separate data diode.
esikich 38 seconds ago [-]
"full Internet access" is a term you brought here out of nowhere and is what your whole faulty premise hinges on.
xp84 8 hours ago [-]
[flagged]
HPsquared 8 hours ago [-]
Possibly, for a brief moment, the food was nicely cooked.
tantalor 7 hours ago [-]
Intermediate value theorem
dointheatl 7 hours ago [-]
> everything's been looted and burned down
There may yet be hope that a few stores survived. Possibly even a village or hamlet. In the vast rubblescape that is now France.
NordStreamYacht 7 hours ago [-]
Backdoors on French fridges? I think they have a bigger problem right now with their front doors.
The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food", which the attackers apparently took to be a good suggestion.
As the firmware is open for anyone to download [2], blurring the affected function seems more like an invitation to find out more. I know I was curious when the news about the fridges in France broke. The function's actually called "check_code_of_the_day", and this is the implementation:
[1] https://www.claroty.com/team82/research/freeze-the-controlle...[2] https://www.danfoss.com/en-us/service-and-support/downloads/...
> Danfoss takes security seriously and as part of our continued improvements, new measures are being implemented. Please review below important security updates included in the latest AK-SM 800A software update that may impact your upgrade experience
on edit: even though I don't know C or C++ (I suppose it's C but can't be sure) I do think I can figure out what it's doing and how to guess what the password is, so that seems bad.
The weird thing is it didn't emit a 32-bit load+compare for the first 4 bytes, this could probably be done with 2 comparsions. Idk. Maybe weird CPU with stricter alignment rules.
It is also worth looking at why this is so, which most likely stems from the lack of technically inclined staff in every location and the cost of having a tech going from store to store everyday to deal with POS, back office computers, amd any other kind of device.
Now, can you secure all this? For the most part yes, but it is quite expensive to do it. Maybe they will do it now or they will go with “it cannot happen to us twice” thinking and not do anything substantial about it.
Rather than have extra staff at the store to do stuff like monitor fridge performance, it's better to have them report stuff centrally and have someone or some tool monitoring thousands of fridges across the entire chain. This way you can send out repair teams and plan maintenance more efficiently.
Why would managing fridge temps be a job that requires more than a few minutes a day at most ?
How hard could it be ?
Surely, these fridges weren't doing inventory tracking? (Or were they?)
This game is nsfw.
Are you implying french fridge makers in real life are stupider than porn?
It's so boring to just sell fridges, let's spy on customers and sell that data! /s
Sad world of greedy things.
The shit will go on until those who makes such decisions start going to jail regularly.
With all the disruption from AI on our industry, I can’t help but feel a little jealous.
Nothing could possibly go wrong?!?...
[0] https://www.amber.com.au/
Critical National Infrastructure should go further, as Iran found out with Stuxnet.
You now have the ability to remotely monitor the system but hacking it does not allow you to control anything. Though there is still a sizable amount of infrastructure which has no on site workers and needs to be remotely controlled.
Wait what do you mean you want to use a key to log in, our stuff doesn't support that.
Imagine if your neighborhood had a million autonomous door-opening drones randomly flying around identifying doors and entering them. It wouldn't take long for everyone to lock their doors.
You can not defend everything. At some point you have to realize the world works because not every exploitable thing is exploited and we live in a civil society (most of us anyway).
I get it, the internet makes things different. But your analogy doesn't work You can not build a building that can not be destroyed.
All the unsupported iot stuff will be obliterated by malicious bots, but the next generation of iot will be both more robust and less directly exposed to the internet. Like how Matter devices sit behind a hub rather than directly connecting to the internet.
There is no evidence AI was used to do this and it feels like a random way to force AI into the conversation? It’s just spectacularly negligent behavior by people who think that they don’t have to trouble themselves with security, but want the convenience of having their stuff on the Internet for remote management.
This is just like the OPM hack 10 years ago.
A valid question which has yet to be answered (at least not publicly).
Edit: Yes i know the commercial fridges do not have "dials" and it's more involved. Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.
Sure, with time and expertise. How does the average employee adjust the virtual thermostat on fifty network-controlled fridges before the food goes bad?
Unless of course they turn it off without telling the businesses so the products go bad because nobody's watching over the weekend or smth. But then again, why would someone want to do that. I wonder.
so of course that creates/enables the problem and doesn't notify us.
deliciously ironic and rottingly sad.
this case was egregious - built-in backdoor pw - but that is downstream of the decisions to IoT them and to default them to listen on the network.
I can't understand the mindset that would treat this as a trivial problem. What's sad is your confidence in giving this situation a 5 second take and declaring the whole thing stupid. Yes, security was clearly an issue, but saying that monitoring of critical infrastructure is sad is bizarre.
Alerts can be sent, and HVAC operators could have a process where they open a support ticket to get temporary access during scheduled windows by store managers.
I remember setting this up years ago for an hospital. Some third party suppliers could obtain RDP access to some VDI who could only accept a limited number of ips but they had to open a ticket and give a reason to get access. It wasn't a 365/24/7. Monitoring could still be sent any time.
And it still isn't going to save electricity. The only thing it can do is warn of a failure and tell you that you got like 20 minutes to start moving food before it has to be trashed for exceeding safe food handling temperatures.
To be honest, a grocery store is one of the most dynamic systems I can think of.
Edit: A bang-bang thermostat is not an appropriate solution for a grocery store.
But they are perfectly capable of checking the temperature. After all the fridges and freezers are restocked multiple times a day so even if one failed it wouldn't have time to get warm before someone should notice.
Ad there are other ways of monitoring such as having an audible or visual alarm.
Also, offline fridges are completely normal.
The AK-SM 800A can control 170 different refrigeration devices. This is more akin to the entire freezer section (and probably meat and dairy) in your supermarket.
As long as the fridges are used the controller has to be supported.
This isn't a raspberry pi $50 a pop...
Honestly I feel like this should fall under a support contract. The pricing structure could be similar to that of Microsoft. Support is fairly cheap, X number of years included in the purchase price, once the product reaches EOL the price goes up dramatically each year.
There's a massive problem in how we think about these products collectively. They are inherently insecure, they will be attacked and preventing it is expensive. You could build a safer alternative, but you'd be priced out of the market instantly by less safe, but more convenient alternatives.
On the other hand, saying an industrial device should receive security updates for 10-15 years instead 5 or whatever happens this days it will be a major step forward. This will incentivise vendors to use better hardware with room to grow, not just the cheapest components possible.
Or, make componente modular so that you can upgrade just the control unit instead of the whole fridge or whatever.
“Why would a bunch of equipment malfunction?”
“Because you plugged it into the internet, you dolt.”
https://trends.shodan.io/search?query=http.favicon.hash:-853...
Over the past few years it has fluctuated but not the same continued growth as before. If you don't have a Shodan account you can see a chart on twitter:
https://x.com/shodanhq/status/2110526116679021055
- Get notified if a compressor fails, refrigerant leaks, or a door gets left open
- Catch failing fans, compressors, or defrost heaters before they break
- Automatically log temperatures for food safety inspections
- Optimize defrost cycles and compressor operation to save electricity
- Let technicians diagnose problems remotely instead of driving to the store
- Reduce power usage during peak electricity rates
- Monitor fridges and freezers across multiple stores from one place
- Track energy usage and equipment performance over time
- Get alerts when power goes out or equipment doesn't restart properly
This is the only one that requires remote write access, and only when "peak electricity rates" means a dynamic pricing system. But it doesn't actually need full Internet access. Instead, prices can be streamed via data diode to a local processor which calculates correct temperatures based on this information. This calculation should set reasonable limits on allowed temperature, so even if somebody sends false pricing information it's just going to waste some electricity and not destroy all the food.
>Optimize defrost cycles and compressor operation to save electricity
Assuming this means something different from "Reduce power usage during peak electricity rates", I don't see how it needs Internet access at all.
All the other points are monitoring tasks that can be done with read-only access via a separate data diode.
There may yet be hope that a few stores survived. Possibly even a village or hamlet. In the vast rubblescape that is now France.