The media in this post is not displayed to visitors. To view it, please go to the original post.

Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.

The username is admin and the password changes every day automatically to.. the current date.

Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.

in reply to Ben Hardill

@ben
No. It was an HVAC system. Same penetration scenario and just as stupid though.

Lived in an apartment building about 6 blocks from Target headquarters at the time. Lot of Target employees (including IT) lived there.

Esta entrada fue editada (lunes, 12 de octubre de 2026, 19:26)
in reply to Ben Hardill

@ben Yeah, no thanks.

I always found the Target story to be an interesting one, especially from hearing some of the comments from staff that made it clear they saw that train wreck coming, and naively figured people would learn from it.

Silly me...

in reply to Kevin Beaumont
The media in this post is not displayed to visitors. To view it, please go to the original post.

Shodan search: html:danfoss product:"nginx"

The supermarket impacted today in France put all of their devices directly internet facing and all had the same password, today’s date.

beta.shodan.io/search?query=html%3Adanfoss+product%3A%22nginx%22

reshared this

in reply to Kevin Beaumont
The media in this post is not displayed to visitors. To view it, please go to the original post.

To bypass login send a POST request to /xml.cgi, there’s a write up here: claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-dan…
Esta entrada fue editada (lunes, 12 de octubre de 2026, 19:15)

Nicole Parsons reshared this.

in reply to Kevin Beaumont

I’ve seen some breathless reporting in the media about the situation in France saying it’s the biggest cyber attack ever and the result of a swarm of Agentic AI bots.

Reality: no. It’s a complete lack of security controls and negligent product development by the vendor.

in reply to Aedius Filmania ⚙️🎮🖊️

@Aedius @bremner
But... but... there's always someone in a supermarket! It's not like having a manager, who's already there, doing temperature checks a few times a day will cost much.

Sigh.

And if it's for monitoring when the shop is closed, it could be read only!

When it's set for the required temperature, no one needs to change it, unless you change the stuff inside it, which is a big operation in itself and doesn't happen often.

Even the productivity reason doesn't hold.

in reply to The Frog

@Lily_and_frog @Aedius @bremner
Its mostly for maintenance people to do remote troubleshooting and optimisation. Thats hours of driving at least, and more if specialized service technicians are at supplier headquarters abroad.

A lot of equipment nowadays has such functions, quite often with a phone modem directly in the machine. Yes its a security risk, but also extremely useful

in reply to The Frog

@Lily_and_frog
As someone who spent half his adult life working in the service industry... No one is manually checking those fridge temperatures, ever. Doesn't matter if it's the soda cooler in a shop's impulse buy gauntlet, or a meat storage walk-in.

The only person who looks at the thermometers is the health inspector, right before they hand you a violation notice because your prep fridge's condenser has had it's airflow so choked with dust buildup that it's been unable to get the temperature below 55° F despite the compressor running non-stop for months.

@Zamfr @Aedius @bremner @GossiTheDog

in reply to The Frog

@Lily_and_frog @Aedius @bremner
Its typically a few chillers on the roof (with their conpressors), some distribution pipes and valves, a series of cold units with their individual temp control units, some logging and alarms, a little network between them.

Its not crazy difficult and usually keep working but there is enough that sometimes something breaks, or a setting goes wrong, etc.

in reply to Marius

@Lily_and_frog @Aedius @bremner its then very useful if a manager can pick up the phone, and someone looks at it remotely, identify the problem, perhaps fix it, or directly send maintenance with the right replacement components.

Quite often, that works even without the manager having to pick up the phone.

It means stuff gets fixed quicker, than if you first have to wait for someone to do diagnosis

in reply to Do-re-mi-so-la-ti-do
@bremner From my days working with SCADA, many of the operators assume nobody would be interested in their pump station/substation/HVAC/etc. @GossiTheDog
in reply to Kevin Beaumont
You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
in reply to Kevin Beaumont
The media in this post is not displayed to visitors. To view it, please go to the original post.

LinkedIn’s absolutely awash with security vendors posting brain-dead takes on the fridge thing as they have no idea, at all, what they’re talking about. It’s great as it’s a list of people not to hire.

You may be surprised to know the through line to the posts is.. AI. Remember when we had intelligence.

Esta entrada fue editada (lunes, 12 de octubre de 2026, 20:20)
in reply to Kevin Beaumont
You mustn't forget that we really do need the hype around the AI-threat. I mean... how else are we going to sell products countering the very-soon-to-come onslaught of autonomous AI-agent attacks that, unless countered, will entirely enslave and make a botnet of all computers on the internet.
in reply to Kevin Beaumont
And then we have you... who doesn't know either why only certain "French" supermarkets were hit with this problem and other supermarkets of the same supermarket chains and users of Danfoss equipment around the world weren't hit with this problem. If there are so many exposed fridges, then why only hit the French ones? There is a good chance this had nothing to do with the Danfoss vulnerability and was a hack of a management system at a French fridge service company.
in reply to Kevin Beaumont
The media in this post is not displayed to visitors. To view it, please go to the original post.

The manufacturer has confirmed this was caused by unpatched systems being internet-facing. The French government CERT has also issued an advisory saying the same. The patch in question removed the date-based backdoor password. cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-012/
Esta entrada fue editada (martes, 13 de octubre de 2026, 11:09)

Nicole Parsons reshared this.

in reply to Kevin Beaumont
The media in this post is not displayed to visitors. To view it, please go to the original post.

German authorities are reminding orgs not to directly connect food cooling solutions to the Internet. allianz-fuer-cybersicherheit.de/SharedDocs/Downloads/Webs/ACS/DE/BSI-CS/BSI-CS_154.html

Nicole Parsons reshared this.

in reply to Kevin Beaumont
this is kind of funny but reminds me of the thing where we still take our shoes off at airport security. Like sure, you can prevent one particular incident from happening again but if you have to blast out a recommendation this specific then common sense has completely left the building
in reply to John Ulrik
@ujay68 In the current universe: Authorities are forcing residential PV systems to be connected to foreign cloud (so they can sell the green credit even after the locally consumed electricity) even though the modbus register documentation is publicly available from most manufacturers. 😬
in reply to Sterling Hammer

@cdlhamma What gets me about this “hack” have they never heard of VPNs?

You would hope in 2026 nobody is working in IT that thinks surfacing anything especially critical to the entire web is a good idea much less that they would work for a major retailer 🤦‍♂️

in reply to Kevin Beaumont
It's pretty consistent with most IP-enabled, quasi-industrial operational technology that I encounter, and demonstrates a lack of imagination on the part of OEM threat assessments, and a lack of competence in their security engineering.
in reply to Kevin Beaumont
First thing I thought when I heard about this was “Advanced Persistent Teenagers at it again!”
It’s a teenager kind of attack. A target no adult would think about because adults have forgotten all of the open targets that we’ve been safely (de facto) been ignoring forever.
in reply to joepie91 needs more railing 🚅💦 (🔜 eth0)
@joepie91 defrost heaters are notorious for connections going high resistance and overheating. It's not uncommon for them to smoke or overheat anyway with a normal length defrost cycle, never mind one lasting possibly 12 hours...
in reply to Kevin Beaumont
It's like the excuse of all excuses. Remember APTs back in the early 2000s (maybe it was the early 2010s), and everybody got so sick of that term because that's what everybody would say: "Oh, we were breached. It must have been an APT." No, your security just sucks. Now it's, "Oh, we've been breached. It was an agentic storm of rogue AI." No, your security just sucks.
in reply to Krzysztof Sakrejda 🏳️‍⚧️ 🏴‍☠

@wronglang
That shouldn't live in the first place.

Sober people put "local network only" incoming connections limitation.
+ something per-unit-unique like serial number for a password.
If (big if) some piece of hardware does need 24/7 connection to something. Which is supposed to be handled by some middlweare orchestrating this stuff over LAN.

Modern smart tech engineers are actually less smart than their smart fridges, unfortunately.

Esta entrada fue editada (lunes, 12 de octubre de 2026, 23:04)
in reply to Hole Digger #17665
@holedigger17665 hard to do that right if the password resets every day 😅 but also good point that network control is fridge temperature is also insane, even if monitoring might make sense
in reply to Krzysztof Sakrejda 🏳️‍⚧️ 🏴‍☠
@wronglang
"Isolated network"
That is a contradiction in terms.
Do you mean "airgapped, with the modems (including RS232, Ethernet *and* all similar) with a nail through their transceiver driver chips"?
in reply to WellsiteGeo
@WellsiteGeo have you ever had your connection to the external world go out but you can still print to your networked printer? It's like that. You just don't plug in the wire. Or you can be fancy about it, but the easiest way is don't plug in the wire.
in reply to Krzysztof Sakrejda 🏳️‍⚧️ 🏴‍☠
@wronglang Absolutely - I worked at sea, hundreds of miles beyond the reach of mobile networks, mobile (so no cables). And the multiple Iridium (Iridia?) were very explicitly for "we are on fire, sinking, and can see sharks" and upwards alarm levels. And some of the networked printers worked while others didn't (client networks vs owner/operator networks). Some network engineers understood "isolated", but not all.
in reply to Kevin Beaumont

And some sandwiches went to waste. Judging from the symptoms as described in the press they had their fridges connected to the open internet.

Everything that really matters is minimised in public discourse, sidelined, or made look negligible.

All the things caused by negligence, bad decisionmaking, and terrible ideas get a free pass.

in reply to Kevin Beaumont
This PR trick has been working so far, but if they keep overstepping their bounds this much, eventually they're going to tick off enough people enough that they start actually bringing in lawyers and realize "wait a minute, this is just a stunt. We can actually sue them."
in reply to Kevin Beaumont
yeah @Viss did talk(s) about this, some time ago. Pretty sure saw him commenting yesterday w links to talks he gave where he covered it. I didn't click on the name of this company w his talks till I saw his comments this week. I recalled CERN as being another he found exposed, IIRC they like severak he contacted, one government for example, was more like meh or 🤷 vs Oh $hit
in reply to Kevin Beaumont
Wait...did they just automate using Shodan to look for specific internet-facing models, enter the default remote admin passwords before changing one specific setting, then just sit back and watch the world burn? 'Cos if so that's both terrifying and hilarious. 🤐
in reply to Kevin Beaumont

TESTIMONIAL

Hello dear friends!
This lender is, according to my experience, honest. I obtained a loan of 180,000 euros through him, and frankly, I was satisfied with the speed of the processing of my file.

I also spoke about it to several colleagues who, like me, obtained loans without difficulty.

For any additional information, you can contact him directly via mail :

OLIVER11587@proton.me

Good luck to everyone.

in reply to Kevin Beaumont
🙏❤️ Please support my beautiful family. 🥹🌷 My family deserves your support and kindness. 🇵🇸💖 Every little help means so much to us. 🤲✨
chuffed.org/project/149031-give-waleeds-family-a-chance-to-live
in reply to Kevin Beaumont

"System Manager AK-SM 800A software package v4.0x and above enhances your product's security features to meet internationally recognized regulations. Danfoss is now defaulting to a strong security posture and is following secure by design principles."

Snark aside, the list of security features they tout as being available with the new v4 in 'strict' mode is rather terrifying.

danfoss.com/en-us/service-and-support/downloads/dcs/adap-kool-software/ak-sm-800a/#tab-security

Esta entrada fue editada (lunes, 12 de octubre de 2026, 19:26)
in reply to Tony Hoyle

@tony It beats lying about it; but it certainly looks from the release notes like "enough security to actually have security flaws" is a version 4 feature; and from the compatibility notes that there's a bunch of 3rd party software and system integration that relies on the old behavior.

It's that second bit that is probably even worse news. Getting bugs patched is harder than it should be; but trivial compared to getting breaking changes patched.

in reply to Ben Aveling
@BenAveling Really not, if you read the research, or looked at the support site and change log you would know that is not the case.
If you have something to the contrary, feel free to share.
in reply to Victoria Walberg

I only know what I've read:

"Danfoss said in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".

It said its AK-SM800 and AK-SC355 fridge regulator systems were notably affected, with a version of the former using "outdated firmware".

It added that it had long advised supermarkets to update from those models."

rte.ie/news/2026/1012/1595129-france-supermarket-cyberattack/

@vickyjo @GossiTheDog

in reply to Ben Aveling

@BenAveling Ah, so wider than than 800A in screenshot, legacy models affected too.

Those (AK SC 355 and AK SM 800) controllers are very EOL; expensive to replace, but probably cheaper than a commercial fridge.
Only a 5-6 year lifecycle on them.

in reply to Kevin Beaumont

That is harder than password 123456

cybersecuritynews.com/admin-password-danish-data-breach/

in reply to Kevin Beaumont

This seems to have been fixed and sorted out already in 2025. 🤭

CVE-2025-41450
CVE-2025-41451
CVE-2025-41452

Ref. lnkd.in/p/da-kjBZQ

Unknown parent
The media in this post is not displayed to visitors. To view it, please go to the original post.

@electricbrain 🤷

cyberplace.social/@GossiTheDog/117429525184825091


Shodan search: html:danfoss product:"nginx"

The supermarket impacted today in France put all of their devices directly internet facing and all had the same password, today’s date.

beta.shodan.io/search?query=html%3Adanfoss+product%3A%22nginx%22


in reply to Kevin Beaumont

You could store random data in an array of these across the world by setting the temperature & then watching the current temperatures fluctuate around those & use it as a source of entropy. Obviously only use three or four time zones that are in the middle of the day at a time.

New worst way to generate key pairs?

in reply to Kevin Beaumont
Why are those on the internet or connected to thr network anyway? I mean yes, you could query its temperature and run a monitoring system that alerts you when one of the fridges becomes too warm due to a malfunction. But for that readonly access is enough. Why is the temperature remote writeable?? And what else can be done with the access? Only temperature? What is the regular usecase here?
in reply to Momo

@momo

I reckon it's cheaper to write a web interface than to have buttons and a display on the fridge.

You can copy the web interface into every fridge, but you can't copy a hardware UI.

There's household fridges that allow to do super quick cooling via a function in their phone app, and the manufacturer advertised this as a useful feature if you want to cool down drinks for a party… ignoring the fact that you need to access the fridge physically in order to put the bottles into it, so you might as well just push some physical button… customers are buying this shit as a feature, because they are told it is a feature… even though it's 100% useless.

@GossiTheDog

in reply to Nielso
@nielso
No it's worse. I looked at the manufactuers product page. The System Manager is not a fridges control unit, it's the centerpiece controlling ALL fridges in a market. It can monitor the temperature and send out notifications if something went wrong. It can schedule defrosting circles, stuff like that. It's a cloudless smart fridge IT solution (because Danfoss probably can't offer a cloud service for cheap with the necessary SLAs to prevent damages like this) used by non-IT supermaket personel. And that's why we have thousands of units with default credentials on the internet, where they should not be in the first place.
@GossiTheDog
in reply to Kevin Beaumont
social.claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities…
in reply to abadidea

@0xabad1dea I've advocated in the past for this type of liability; more broadly phrased, dereliction of a public trust should be indictable on the rationale that between the hacker and the large corporate defender, one of these is much easier to deter.

The flagrantly negligent defender in whom public trust is placed also profits from their misdeeds. So the idea would be to fine e.g. banks who do things like lay off all their security teams and then get hacked.

in reply to abadidea
@0xabad1dea The company that sold it, if the instructions failed to underline the importance of not doing so or changing the credentials (or made it impossible to change them) should also have such charges.
in reply to Kevin Beaumont
And who authorized that setting is still working? At any level higher than toilet cleaning?
Nothing to object with toilet cleaning, I do it myself. I'd like to know if that person is so underskilled as it looks, from my perspective of toilet cleaning, which actually stands out in the comparison.
in reply to Kevin Beaumont

not the first time for Danfoss. They had a 06/06/2006 midnight incident, where ALL of their BRC-2000 controllers worldwide were programmed to hammer the motor contactors to burn up the AC motors. This company and their "security" is legendary...

They had a notice about this on their website for a few years, but likely did a document purge to prevent the endless subpoenas in the future...

Esta entrada fue editada (lunes, 12 de octubre de 2026, 21:35)
in reply to Matt Blaze
@mattblaze
It probably used to be rsa keys or something all the techs carried until a pointy haired middle manager decided losing one would compromise the entire system, and demanded the engineering team implement a system that changed every day but every tech could always know the password for without a physical key or written code book. They probably got a bonus for implementing it.
in reply to Kevin Beaumont
the claroty writeup seems to say that the password is derived deterministically from the current date, rather than plainly the current date; are they too charitable to say that there is no half-baked sauce making the daily password harder to guess?
in reply to John Q McDonald

@jqmcd A supermarket chain with a lot of fridges/freezers across multiple sites such that automated monitoring / recordkeeping becomes useful.

Sure you could get your staff to keep an eye on it but (even aside from capitalists don't like to trust staff, let's assume best intentions) that doesn't help if there was a power cut just after the store closed for the night, things defrosted for several hours, then power came back on. Staff come in next morning, fridges seem to be working, but the product mightn't actually be safe to sell.

Alternatively, you get a complaint from a customer who got sick and you need to prove to the food safety inspectors with all your audit logs that your fridges *didn't* fail, not your fault, go investigate further up the supply chain.

Now obviously what they really need is an internet-facing refrigerator _that can't be hacked by a bored seven-year-old_.

@GossiTheDog

in reply to Zeborah
@zeborah @jqmcd That is an argument for making it network-connected, not internet-connected. You'd do that behind a VPN or something, not directly connected to the whole freaking internet.
Esta entrada fue editada (martes, 13 de octubre de 2026, 7:33)
in reply to Mark Rotteveel

@mrotteveel Everyone and their dog has been moving everything to software-as-a-service on the cloud. If your hiring system and payroll system and leave system and procurement system and self-check machines(*) are all operating on the cloud just like everyone else's, why would you think "Oh shit, we'd better invest in servers, networking and firewalls to secure our *fridges*"?

If you ever thought about the security of your fridges at all, you'd start by changing the username and password. So we know they never did, which in turn gives us a pretty good indication of the size/capacity/budget of whatever passes for their IT department....

(*) If anyone knows how to hack into a supermarket's self-check machines to make them stop nagging me to take my groceries while I'm clearly in the process of taking my groceries, please let me know. Just out of curiosity. No reason.

in reply to Kevin Beaumont

@Laukidh I’m impressed the “hackers” (low bar) got the temperature to 50C. Did they just hammer it with manual defrost commands for several hours or something?

Another 10C and the food would have been sous-vide instead of ruined

Esta entrada fue editada (martes, 13 de octubre de 2026, 3:53)
Unknown parent

@mattblaze I always hate this framing of "The researcher responsibly disclosed this to the vendor" when talking about a support backdoor. How does this conversation go?

"Hey you know that thing you deliberately went and did? I just want to let you know that you did it. I know this information may come as a total surprise."

in reply to Kevin Beaumont
Yeah, I don't understand what the fuzz is all about, there are many companies out there with websites. Often they are not even password protected, sometimes they are even wired into their internal services. For example at reichelt.de/ you can get them to ship you stuff from their storage. (at least when their site works)
Unknown parent
@internetthought that might just be market dominance, or the fact that danfoss france or their reseller had noone deciding this was a bad idea, or their counterparts at the supermarket chains not giving a merde... I mean, look at @vncresolver 's posts and cry.
in reply to Victoria Walberg

@vickyjo unless there is another version of the controller available, its certainly not just the date.

IMO it's a bit of an annoying RE task. The function is obvious but you need to carefully work out other input parameters to it to get the password right. It's not reading python script.

Unknown parent
@mattblaze I mean who had the genius idea to put critical infrastructure fridges on the internet? I think there’s even a case that the fridges should shut down all network access if they detect they are on the internet and externally reachable…
in reply to VessOnSecurity

@bontchev
"That day, for no particular reason, I decided to go for a little run"

youtube.com/watch?v=M4ul35wlqjA

in reply to Kevin Beaumont

What really peeves me is: we are lucky it were just fridges this time.

We are putting literally anything on the internet these days, without having second thoughts. Production equipment. Power plants. Medical devices. Anything. Many of them have this kind of bullshit security backdoor.

We haven't seen jack yet. This is only the beginning.

Unknown parent
The media in this post is not displayed to visitors. To view it, please go to the original post.

my apologies, I thought everyone was jumping too quickly to conclusions, because the issue appeared to be only limited to France, but it does appear to be wider spread. So much for "clues" then (see Terry Pratchett quote). I have a bias against cyber attack messaging, when often the alleged attack is human stupidity, misconfiguration, mother nature etc. and not a Neo-like leet h@ckx0r... Oh well, a few supermarkets got a slightly more expensive cybersecurity drill 😋
in reply to Kevin Beaumont
@digitalcourage @padeluun @netzpolitik_feed
Cool! (pun intended)
So the French supermarkets can charge damages to Danfoss for lack of security. Unless ... the manual for the fridge clearly informs about this setting and instructs the user to change the credentials before connecting the fridge to the Internet.
Unknown parent
Good write up by @cybergibbons pentestpartners.com/security-blog/you-dont-need-a-nation-state-to-warm-up-a-fridge/
Esta entrada fue editada (miércoles, 14 de octubre de 2026, 18:55)
in reply to Kevin Beaumont
Are you sure they were mining crypto? In the article they say that is unlikely: 'The devices are low-powered and on slow cellular links, which rules out crypto mining and makes them poor for denial-of-service.'
Did an LLM mess up the summary? 🙃