So the author charitably calls the 2025 vulnerability a "login bypass", but it's much worse than that. The firmware included a "datetime-based password" mechanism: a built-in backdoor password, like it's the 90s again.
The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food", which the attackers apparently took to be a good suggestion.
As the firmware is open for anyone to download [2], blurring the affected function seems more like an invitation to find out more. I know I was curious when the news about the fridges in France broke. The function's actually called "check_code_of_the_day", and this is the implementation:
> The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food",
And it's _even worse_ than that. A famous french cybersecurity firm, Synacktiv, published a report in 2023 (!) about the code-of-the-day vulnerability, but it made less noise apparently [1]
US bases were also attacked remotely this year too, but yet this attack was still "unprecedented" to the upper management of these grocer chains. Smells like incompetence to me personally.
Thanks for the heads up, I had to laugh with the introduction paragraph, given the code example, and incident,
> Danfoss takes security seriously and as part of our continued improvements, new measures are being implemented. Please review below important security updates included in the latest AK-SM 800A software update that may impact your upgrade experience
Reading the claroty article mentioning nginx, I think it's more likely that their decompiler is just setup to use windows semantics since that's probably a majority of what they analyze.
Iirc LPCTSTR is just an alias for const char* , lp being an anachromism of "long pointer" held over from the days when needing to do a distinction for "flat" 32bit pointers since there already was "near" and "far" pointers during the x86 16bit era.
I'm was super glad I could just copy/paste that code in my LLM-of-choice and it gave me a reasonable explanation of how to exploit it. Thank god an attacker couldn't do that.
Not everybody writes in the language they want to exploit I suppose, that's the great thing about LLMs!
on edit: even though I don't know C or C++ (I suppose it's C but can't be sure) I do think I can figure out what it's doing and how to guess what the password is, so that seems bad.
It’s the Windows dialect of C with Microsoft quasi-Hungarian-notation type names. Whole generations of programmers have grown up with these and all too many somehow think they make sense :)
But the relevant bit is at the end, from “if” to “return”, and should be pretty accessible to anyone familiar with an imperative language who can get past the general ugliness of the code. Once that’s figured out, you can recover the password by copying and executing the rest of the function.
The fact that Russia has access to LLMs that could decompile and explain this firmware ( and possibly even translate the explanation to Russian! ) is just another proof that this was definitely part of the hybrid war and Europe needs to spend a few more tens of billions on weapons and possibly impose restrictions on open weight LLMs.
That's not a solution. Russia can just take the next LLM rolling out of China. The fix is to not be stupid and fix our broken infrastructure. Especially, IT infrastructure, but also things like idiotically Internet-connected fridges of supermarkets apparently.
home or mobile users often have dynamic IPs and thus can't be "whitelisted". Why would you not want someone on their phone access the controls?
And VPNs are just external authentication & encryption mechanisms, you might as well implement those properly inside the application and forego VPN entirely.
Application and VPN work on totally different OSI layers, so what other comment already pointed out - it's defence in dept that exactly is meant to prevent such cases: when one control fails, other might save the day. IP whitelisting is mostly suitable for centralised command center and fixed locations which might have been sufficient in this case, as I really don't believe that these fridges were individually and manuallly controlled by human users via their phones rather than some server and automation.
> home or mobile users often have dynamic IPs and thus can't be "whitelisted". Why would you not want someone on their phone access the controls?
points vaguely at the exploit and how easy it is to find the targets.
If "change it from their phone" is a requirement, they can connect the phone to shop's network, or VPN from phone to HQ then bounce to the controller.
It is security by obfuscation, yes, but it is somewhat effective at low cost.
> And VPNs are just external authentication & encryption mechanisms, you might as well implement those properly inside the application and forego VPN entirely.
The controllers go out of support after some years. They work just fine, so replacing one if possible is costly and seen as unnecessary.
Putting it between $50 VPN box decouples "keeping VPN software up to date" and "keeping the controller up to date". It also gives your IT a single type of VPN config to support rather than being controller dependent.
I think the commenter above is making the point that this should be defence-in-depth.
Yes, of course use good encryption and auth{n,z}, but _also_ layer on restrictions at the network layer to stop general traffic from even getting there.
Yep, and you can prompt something like "the function was a decompiled version, translate it into a readable version", if you don't like reading [probably] ghidra output.
The programmer probably wrote memcmp(pass, buf, 5) which compilers will often fold into an inlined loop, or a few comparisons if they know the 3rd arg.
The weird thing is it didn't emit a 32-bit load+compare for the first 4 bytes, this could probably be done with 2 comparsions. Idk. Maybe weird CPU with stricter alignment rules.
Through my work I deal with grocery software and I can tell you that grocery software is ages behind the times. For most small retailers (small being a business owner with less than 10 stores in their retail chain, mostly local grocers) you are dealing with processes that would have been considered antique for the year 2000
That's not clear. Perhaps the savings made by having connected fridges over the year has offset the hacking event waste, so overall it could still be worth it. Now they need to apply security patches, and possibly only use the connection for monitoring (read-only) and have a kind of "2FA" / physical presence required when sending commands from the web
Not having to pay some token fine multiplied by however many times your employees didn't perfectly pencil whip the temp checks in the 3yr record retention period when you sell some bad fish and get audited as part of the investigation into that.
They don't need to be on internet. They just need to be available remotely. Simple VPN would've solved the issue entirely (...well, up to the moment when they won't update that, but updating VPN is far cheaper than commercial refrigerator controller I'd imagine)
So much security in the past relied on "no one would bother to look in to this". We now have armies of bots relentlessly scanning over everything which is the main reason everything has been getting hacked over the last few months.
I'm really hoping that if it comes to pass, millions of AI-based hacking agents running amok on the internet, exploiting every single thing they can find, will at long last finally cause companies to get their shit together and secure their systems.
Imagine if your neighborhood had a million autonomous door-opening drones randomly flying around identifying doors and entering them. It wouldn't take long for everyone to lock their doors.
I don't disagree with you. But let's expand.. Imagine every neighborhood had autonomous brick throwing drones randomly smashing windows. Imagine every neighborhood had autonomous flame throwing drones randomly setting fires. Imagine every neighborhood and autonomous gun shooting drones randomly killing. Imagine every neighborhood and autonomous grenade lobbing drones randomly blowing up walls.
You can not defend everything. At some point you have to realize the world works because not every exploitable thing is exploited and we live in a civil society (most of us anyway).
I get it, the internet makes things different. But your analogy doesn't work
You can not build a building that can not be destroyed.
"Every neighbourhood" is still a local problem, and can be solved locally. A grenade-lobbing device in australia can not reach 1 Microsoft Way, Redmond with multiple hits per second, nor do we have the resources to produce such artillery at the rate of multiple per second. Any analogy that you want to extend into the real world has to acknowledge these real-world limitations in more than just a footnote, or it's not a useful simile.
My hope and what I see happening is that the major players in the software space are frantically patching as many bugs as they can right now to keep ahead of attackers, and we come out the other end with incredibly robust software.
All the unsupported iot stuff will be obliterated by malicious bots, but the next generation of iot will be both more robust and less directly exposed to the internet. Like how Matter devices sit behind a hub rather than directly connecting to the internet.
>Imagine if your neighborhood had a million autonomous door-opening drones randomly flying around identifying doors and entering them. It wouldn't take long for everyone to lock their doors.
Pretty interesting example, because I'd like to live in a society where I don't have to lock my doors, because it's safe and I trust people around me. Releasing drone police randomly opening doors in the name of security sounds like a strict downgrade, not "a good thing because people will learn".
I don't fully understand what you suggest. I live in a big city. It's very safe here - I am not afraid of walking alone in the night, neither is my wife. Theft is a problem, but not huge - I leave my bike unchained when going into a store, and chained outside overnight, for example. I lost my LED bike lights twice though, weird thing to steal but I guess they're very easy to detach. I also leave my apartment door unlocked when I'm inside, including overnight.
Of course, as you said, in a city I will never feel safe enough to leave a door unlocked when leaving my apartment - big cities are big, and even 0.1% of bad apples may spoil things for everyone. But wanting a safer and more high-trust society sounds like a good thing, right? How would disconnecting from the internet help me.
There is no evidence AI was used to do this and it feels like a random way to force AI into the conversation? It’s just spectacularly negligent behavior by people who think that they don’t have to trouble themselves with security, but want the convenience of having their stuff on the Internet for remote management.
No AI is needed for that. The Morris Worm was 38 years ago. Various MS Worms were as common as MS Windows 20-ish years ago. Anyone who's glanced over web server logs in the WordPress era knows about automated scanning for its myriad flaws.
Though one could argue that "AI" is needed, currently, for an editor to decide that a story about a hack is worth publishing.
(Yes, current-day AI's do shift the equilibrium. Somewhat. The French fridges would not be news if the situation was anywhere near as bad as the doomsayers seem eager to proclaim.)
It's not so much that it's ruthlessly effective, it's more that it doesn't care about all the tedium of applying all the known techniques to all possible targets.
Unfortunately this isn’t possible. If we spent billions upgrading electricity infrastructure, sure. But it’s much cheaper overall to make smart use of solar panels and batteries that are already being installed in the grid. And that requires a smart grid, full of networked equipment.
For example, during peak sunlight times, many neighbourhoods now generate more solar than they use. Without a sink for that power, voltages would go haywire on power lines and damage equipment. So the grid uses control boxes to manage how much power each house is allowed to send back to the grid. And all that needs compute, live metering and so on.
So... how do you feel about apps[0] that let you automate pushing electricity to the grid from your own home battery based on wholesale electricity prices?
You can do a one way link, sensors on infrastructure which emit data only but can not receive anything. Then another device like an ESP32 or whatever the industrial version is which reads the data and makes it available to the internet.
You now have the ability to remotely monitor the system but hacking it does not allow you to control anything. Though there is still a sizable amount of infrastructure which has no on site workers and needs to be remotely controlled.
They are clearly making money just fine and in very low margin business. Moving cash registers to some electron app and vibecoding inventory management coz current system's app windows are ugly would improve it by 0 to negative %
This isn’t grocery software, it’s a microcontroller for controlling a refrigeration system. The same controller is used in non-grocery refrigeration installations.
The real problem is devices like this should NOT be connected to the internet and at worst air gapped. Theres no reason including cost that a separate computer just for the fridges etc is not sitting in the office of the supermarket. Pretty sure the destoyed goods and close time cost far more than the extra cheapo computer.
Handling food related stuff, at least in my country, requires tracking and registering temperature for the fridge. It needs to be documented. Either you have a probe that you bring to computer to read data.. or you send it somewhere.
I don't know lot about fridge internet tech, but I can see that communication is needed to send this data. Having a hub to be able to do it is probably introduces complexity, but also maybe viable solution.
We had a blackout for a prolonged period of time (not 24hrs, but was 12+). Next day thee shop had all the freezers empty. If the "food and safety administration" on your audit catches that you still sold food when temp dropped under x for period of time, I bet you get into trouble.
You also get into trouble if you don't have records to show.
There is a very significant difference between _monitoring_ the equipment and _controlling_ the equipment. I get it why monitoring the equipment remotely provides a number of significant advantages, I'm in data analytics. I do not see how putting control systems online gains enough advantages to outweigh the risks. Fridges in a grocery stores is probably a weak example, but similar incidents with power systems, hospital/healthcare devices, and the like can actually endanger human lives.
There was far more serious incident very recently where hackers gained control or attempted to gain control of a propulsion system of an oil tanker. Resulting in a military operation to take it back. People need to start treating these risks more seriously.
The one good reason is that there is nobody skilled left in the office of the supermarket. The days of people with the skills to hit a supermarket HVAC system with a hammer are long gone. When the fridges are on the fritz, the minimum-wage shelf packer goes and packs shelves as far away from the fridge as possible.
My belief is that is more about convenience than anything else.
It is also worth looking at why this is so, which most likely stems from the lack of technically inclined staff in every location and the cost of having a tech going from store to store everyday to deal with POS, back office computers, amd any other kind of device.
Now, can you secure all this? For the most part yes, but it is quite expensive to do it. Maybe they will do it now or they will go with “it cannot happen to us twice” thinking and not do anything substantial about it.
It's not just about having tech inclined staff, but just the whole staffing strategy in general. Most grocery stores et. al. try to staff as cheaply as possible and try to have their workers do as much as possible during their shift. This means that there's no extra time available that they're not shelving products, or sitting at the register.
Rather than have extra staff at the store to do stuff like monitor fridge performance, it's better to have them report stuff centrally and have someone or some tool monitoring thousands of fridges across the entire chain. This way you can send out repair teams and plan maintenance more efficiently.
Most fridges at home don't have hot gas defrost cycles, toxic Ammonia refrigerants and store tens of thousands of euros worth of food in at any time.
They usually require scheduled service teams maintaining them who have tight SLAs (because a supermarket without fridges loses a lot of money per day) so making sure you have remote access to it so you can bring the right parts with you is probably useful.
I suspect when you load a big fridge with lots of room temperature product (does that happen?) the fridge struggles to maintain adequate cold. Though that still seems like something the fridge itself could handle locally.
Surely, these fridges weren't doing inventory tracking? (Or were they?)
If a fridge is being opened frequently, the amount doesnt matter but lets pretend frequently means many times an hour, shouldnt a human be able to spot the fridge is warming up because it doesnt look or feel as cold as normally ?
Sounds fun. Perhaps you would like to volunteer for thermometer duty at your local supermarket.
If there were actually people wandering around supermarkets manually checking fridge temperatures in 2026, everyone on HN would be saying how easy it it ought to be be to avoid all this pointless manual labor using modern technology.
Because being smart is not about avoiding work, its about failing well when things go pear shaped.
Its the same thign that separate good cars from the best. They both drive well enough at normal speeds in normal conditions. The best cars save your life when the others make you a cripple or dead in some unfortunate chance bad luck event.
Supermarkets operate on razor thin margins. They rely on being smart and avoiding work to make a profit. I don't think they are going to be persuaded to do a bunch of extra manual work, and tolerate increased electricity bills, just on the off chance that there's a once-in-a-generation cyber attack.
I think, in classic HN style, you're massively underestimating the complexity of a domain that you have no experience with. There's a whole academic literature on optimizing this:
The software running on fridges should, obviously, be secure (just like any other software should), but air gapping the fridges, and winding the technological clock back a couple of decades, isn't a realistic proposal.
Fridges are manually checked where I work. And logged.
It is very, very, pointless manual labor, but big.corp won't pay for an offsite solution.
Approx 3,000 walk-in fridges across the company, about 1,000 of them also have walk-in freezers.
There is a video game where you can unlock a thermostat which grants you extra points if you go back to it and readjust the temperature once in a while. Everyone hated it and kept mentioning just how ludicrous it is that a device called a "Thermal Static" somehow works by inputting thermal changes as opposed to thermal targets, prompting the developer to agree that was the stupidest idea they had and they would be changing it.
This game is nsfw.
Are you implying french fridge makers in real life are stupider than porn?
You don't take into account more complex situations where retail store is managing remotely say 50,000 fridges, adjusting regionally based on local stock, temperatures, weather forecast, incoming holidays and probably 100 other factors that outsiders have no clue about yet it allows them to have those razor thin margins that keeps them afloat.
Current security model is clearly not adequate but it would be nice if folks recognized that world is more complex than ie their home situation or some very simple use case they can come up with in their head.
A single fridge can be managed with a manual maximum recording thermometer. It records the highest temp reached. Check it daily, if the high temp is over 40F, throw everything away.
you can keep them on a VPN and connect to that VPN yourself from anywhere, without exposing them to the possibility of anyone connecting to them directly from the internet.
The extra steps are useful to have here. Assuming the application implemented in some ad-hoc firmware is secure enough when there trivial ways to add another more standardized layer of defense is simply negligence.
Or it should/could be connected, but in a read-only mode (eg monitor the data). And control could require someone on the location doing a physical button (pushing an "authorize command" button physically behind the fridge, or in a local control room, or something)
Source they were selling this fridge data in real-time? Can you post a link where I can buy it?
What customer data is this even giving me? How do I get someone's personal information based on the temperature of the drinks fridge in Store #138 in Nantes?
I guess my big question here is why these endpoints were exposed to the Internet in the first place. I thought pretty much everyone these days put all their infrastructure in a private IP range behind a NAT firewall. I can't imagine throwing critical infrastructure up naked onto the Internet, whether I knew of a specific security issue with the firmware or not.
Electricity is expensive. Grocery stores work on extremely thin margins with stock that literally turns rotten. These are physical devices that need maintenance. Their failure is often catastrophic. Grocery store workers are not equipped to fix an HVAC system. Someone needs to monitor for preventative maintenance.
I can't understand the mindset that would treat this as a trivial problem. What's sad is your confidence in giving this situation a 5 second take and declaring the whole thing stupid. Yes, security was clearly an issue, but saying that monitoring of critical infrastructure is sad is bizarre.
Remote monitoring by itself is not a problem, but remote control is and has no benefits. You can't change the temperature of or defrost a freezer without removing everything from it, and if you can remove everything from it someone is already there the change the settings. And it takes extra work to enable remote controlling of a refrigerator system over just providing temperature readings.
And it still isn't going to save electricity. The only thing it can do is warn of a failure and tell you that you got like 20 minutes to start moving food before it has to be trashed for exceeding safe food handling temperatures.
I mean, say you have 30 grocery stores, are you saying you shouldn't be able to build templates to deploy? You gonna have a guy drive all over the place updating schedules 24/7?
Because the things you have in the fridge change. The opening and closing of the doors change. The actual equipment changes. Store hours change. Holidays happen. Sports games happen. Weather happens.
To be honest, a grocery store is one of the most dynamic systems I can think of.
Edit: A bang-bang thermostat is not an appropriate solution for a grocery store.
That's called a thermostat and doesn't require remote control. The frozen food needs to be at the correct temperature all the time, regardless of external factors.
>are you saying you shouldn't be able to build templates to deploy
There's making a meeting out of something that should have been an email and then there's making a software project out of something that should have been an email.
The email is gonna go to the managers DL and it's gonna say "hey assholes the new temp is X set your shit to that" but in professional corporate speak and the managers will use their screwdrivers, take off one access panel and turn a dial ever so slightly" and I'll be able to see they've all done it right from my read-only monitoring system. And this has the side effect of keeping food from going bad in bulk because of a bug or fat finger or "Russian hackers" or whatever. The cost of the labor will almost certainly be cheaper than the cost of the software project amortized over its life.
Monitoring doesn't have to leave a way to enter the system automatically.
Alerts can be sent, and HVAC operators could have a process where they open a support ticket to get temporary access during scheduled windows by store managers.
I remember setting this up years ago for an hospital. Some third party suppliers could obtain RDP access to some VDI who could only accept a limited number of ips but they had to open a ticket and give a reason to get access. It wasn't a 365/24/7. Monitoring could still be sent any time.
But they are perfectly capable of checking the temperature. After all the fridges and freezers are restocked multiple times a day so even if one failed it wouldn't have time to get warm before someone should notice.
Ad there are other ways of monitoring such as having an audible or visual alarm.
Do you think grocery stores are 24/7? How often do you think these checks happen? Do you think it's the best way for those employees to spend their time? How often would these checks need to be performed to show statistical significance? Do you have reason to believe these things have never been thought about by people who run grocery stores? What are the labor requirements in a grocery store to run effectively?
These checks do not need to happen 24 times a day. It is in fact perfectly acceptable for the workers to check it in the morning. I swear to god HN is inventing issues that dont exist to defend overengineered solutions.
Workers, or humans in general, are not very reliable. Especially for a maintenance / checking task that's almost always feels pointless because the freezer will have the right temperature: people strapped for time will skip that step.
Moving the check online doesn't remove the unreliable human, it just switches it from a stock person to an it person, or whoever receives the email in their inbox.
Where I live, stores don't open on Sundays. Many apparently do in France, but I imagine not all of them. So there are potentially 24 + 12 hours where nobody's there to check stuff
This isn't your single compressor/evaporator/condenser coil appliance that sits in your kitchen. These are far larger and more complex systems.
The AK-SM 800A can control 170 different refrigeration devices. This is more akin to the entire freezer section (and probably meat and dairy) in your supermarket.
No one is saying anything against automation or monitoring per se. It's rather the idea to connect them to the Internet, that's highly questionable. They could be closed circuit streaming data into the back office of the grocery store and one look at a monitor would be enough to tell all is well. It doesn't have to be on the wide open Internet. And if somehow someone feels it must be visible online, then they can put a camera there to view the screen that shows the monitoring.
None of it requires connecting the very fridges to the Internet.
But look, we can sell this "IoT-ready!Now!" version of our fridges for 1.5x as much! Who cares about long term damage to reputation? Next quarter's numbers dictate we have to go for this strategy.
To be fair, their entire threat model was likely "who TF would want to break in to change the settings on a thermostat on a fridge at a grocery store".
A valid question which has yet to be answered (at least not publicly).
If 'who TF' includes "everyone on the internet", then there are more than enough people who would do it to prove a point, for bragging rights, just for kicks, or because they want to cause as much damage as possible. The only question is how large is the intersection of that group and those with the ability and awareness to do it (something that is growing with the increased capabilities of LLMs).
It's a fridge. In a grocery store. You just get an employee to adjust the thermostat dial. How would the hackers demand payment if all you need to do is turn the dial back to "frozen"???
Edit: Yes i know the commercial fridges do not have "dials" and it's more involved. Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.
> Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.
Sure, with time and expertise. How does the average employee adjust the virtual thermostat on fifty network-controlled fridges before the food goes bad?
I don't know about your grocery store but the ones I've been to have maybe 5 on the shopping floor and probably a few more in the back. They all have physical controls which (I'm assuming) override the controller if something goes wrong. So if big bad hacker says "I'm gon' turn y'all fridges off if you don't pay me" it's not a threat, it's a silly joke.
Unless of course they turn it off without telling the businesses so the products go bad because nobody's watching over the weekend or smth. But then again, why would someone want to do that. I wonder.
Clearly, somebody TF had a strong enough motivation to do it. Not for ransom (unless stores are hiding part of story) just for the lolz or directed harm.
Could be competition, could be lonely angry incel hacker, could be state actor (ie russia would not be out of picture given their past actions and current war they wage against entire western culture, but they are far from the only ones).
Leave phpbb forum unguarded, it will get hacked quickly. What gain? None apart from hoping to mine some crypto or be part of botnet. Still, will happen reliably.
That's true, however (phbb/mediawiki/wordpress/etc)'s exploits are very well documented and widely available for people to use simply due to popularity of these software. Which is not true for much more obscure software running on these controllers. So breaking into these was not not only low value but also high effort.
Those fridges are from the 90s. You cant reasonably support it that long. It's not even just software. The PLC is fixed hardware, you can't simply patch that.
You can replace the PLC. It's not like a modern PLC couldn't be made to control a 1990s fridge. The question is "Who will pay for the upgrade". DanFoss sure as hell won't. The stores won't, because they've already paid for the fridge.
Honestly I feel like this should fall under a support contract. The pricing structure could be similar to that of Microsoft. Support is fairly cheap, X number of years included in the purchase price, once the product reaches EOL the price goes up dramatically each year.
There's a massive problem in how we think about these products collectively. They are inherently insecure, they will be attacked and preventing it is expensive. You could build a safer alternative, but you'd be priced out of the market instantly by less safe, but more convenient alternatives.
I work in the industry. Usually customers are sold new PLCs for exorbitant prices as an "upgrade". Service contracts are only for know-how maintenance. Support cases get billed in addition to that.
This is how it's done everywhere I worked. You can patch some bugs for cheap in the software, but you can't fix hardware limitations. I know companies that use PLCs that still don't support encryption despite the upcoming EU regulations.
The companies either don't care or are too greedy to spend money on this.
"The PLC is fixed hardware, you can't simply patch that."
Oh yes you can patch it - that's how I got the 20 year old laminator working where I work. If the hardware is still good you can absolutely change firmware if you have the PLC control software (like RockWell ControlFlash) or know how to manipulate the ladder logic directly.
Sure you can. Code is code. I took a machine without brush cleaning for transfer sheets and hand-tapped, mounted motors and controllers and brush assemblies, ran the connections into the PLC, install and connect the power relays, reflashed the PLC firmware with custom code, BAM it works.
As long as you have room in memory, you can add functionality.
As someone who has worked with small and medium sized businesses, reasonable is extremely variable. I'm dealing with a small business right now that can't upgrade their perfectly good computers because of TPM issues. On one hand, I kind of get the reasoning behind it, but how can you hold a business of 10 people accountable for not knowing how to buy a computer that will be reasonably future proof? Every business needs IT on hand? I think that's asking too much. On the otherhand, you should know the tools you need to run your business. There's no fine line.
TPM issues is a M$ invented shit. They shouldn't be running anything past Windows 10 anyway, and Windows 10 I believe, at least the normal versions are EOL already?
But yeah businesses will do stupid things like installing Windows 11, and if they don't have dedicated staff to handle shit, they won't even know better what they should be doing. Plus their software may have idiotic requirements on top, that don't really make switching easy.
Insurance does actually tend to put cybersecurity requirements on to businesses they insure, the problem is that it's pretty hard to write cybersecurity requirements that actually result in secure IT systems as opposed to just a bunch of compliance work.
In theory, an insurance company could inspect and pen-test.
In practice, that would run into (probably, IANAL) legal issues, cost & staffing issues, and the narrow worldviews and business models of the insurance industry.
Oh, great idea. We should do that for software: force manufacturers to support their software with bugfixes as long as it is in use. And just bugfixes, the marketing department can stay out of it.
This will never fly. Some devices can be used for tens of years and they may face vulnerabilities that the hardware cannot support any kind of software fix for them. Imagine the world moves to TLS2 or whatever something new will be called and the hardware you have is too slow for it.
On the other hand, saying an industrial device should receive security updates for 10-15 years instead 5 or whatever happens this days it will be a major step forward. This will incentivise vendors to use better hardware with room to grow, not just the cheapest components possible.
Or, make componente modular so that you can upgrade just the control unit instead of the whole fridge or whatever.
The EU's CRA does mandate this kind of thing. It states 5 years minimum, but it needs to be longer if it's expected that the product remains in use for longer, and you need to commit to it in advance and tell customers (at the point of sale: so printed on the box or on the product listing).
No one at Danfoss got alerts than sudently hundred of fridges entered defrost mode? Reminds me of those computer you see at stores running weird ms-dos software.
Many of these things have cycles where they clear frost or otherwise remove moisture from the system by getting hot. What you're talking about is something that could be common. It's the extended heating that starts causing problems, but if the software is taken over the alerts may no be sending.
Over the past few years it has fluctuated but not the same continued growth as before. If you don't have a Shodan account you can see a chart on twitter:
For people who are saying the infrastructure not be connected to the internet are missing the advantages. I think the real solution is being able to protect using the latest and greatest security protocols. I understand that it will be hard for manufacturers and small groceries to keep track of that, but I think its a good opportunity for a security layer that is maintained by 3p. I am sure there already are and this incident hopefully will be a wake up call.
Security through obscurity is dead. I used to let my straggly collection of home servers and rented VPSs chug along with outdated firmware and security settings I only loosely understood, comfortable in the knowledge that:
1) Nobody cared about my servers
2) They weren't connected to anything important
But because of AI, (1) is no longer true. And if you believe Anthropic's murmurings about self-replicating LLMs, (2) may not be relevant either. I have had to pre-emptively get a frontier LLM to systematically fix and harden all of my hobby instances. On the bright side - also because of LLMs - it was very easy. There is really no excuse for outdated security anymore, when an LLM can one-shot harden almost any service.
hard to say who’s to blame: stores, installers or the vendor. most of these dashboards sat online for months, only 195 of 1,331 had every fix, and 76% went offline within days of the attack (disconnecting was possible all along, it seems).
We'll never get past this as long "well you didn't update" is considered an acceptable rebuttal. The problem is created when vulnerable software is released. We would be better off slowing things down by a factor of a hundred or more rather than continuing the current approach of "update every day to fix the new vulnerabilities introduced by the last update that fixed the old vulnerabilities".
List of legitimate reasons for a refrigerator, an oven, a stove, a washing or drying machine, a microwave, a coffee maker, a sink, a garbage disposal, a toilet, a shower or bathtub, or any other home appliance to be connected to the internet:
There's something very wrong with the electrical grid if they need to stagger startups over all the shops combined. Staggering startup within a single shop can be done with a LAN.
This is the only one that requires remote write access, and only when "peak electricity rates" means a dynamic pricing system. But it doesn't actually need full Internet access. Instead, prices can be streamed via data diode to a local processor which calculates correct temperatures based on this information. This calculation should set reasonable limits on allowed temperature, so even if somebody sends false pricing information it's just going to waste some electricity and not destroy all the food.
>Optimize defrost cycles and compressor operation to save electricity
Assuming this means something different from "Reduce power usage during peak electricity rates", I don't see how it needs Internet access at all.
All the other points are monitoring tasks that can be done with read-only access via a separate data diode.
The exact meaning isn't important. The point is that something like RS-422 with the TX lines removed is perfectly adequate for receiving pricing updates. Anything more complex than that is adding unnecessary attack surface.
Remote diagnostics is the only one of these functions that can fairly be said to require an internet connection. There are many remote connectivity solutions for low bandwidth, low latency needs like these that pose nowhere near as much of a risk as an internet connection.
Even the remote diagnostics is of questionable value at best. You can do remote diagnostics just as well with a faxed printout of system information and having store staff do manual resets at needed. Remote diagnostics isn't going to solve anything that requires more than a reboot, like replacing a compressor coil, anyway, so you're going to need service staff driving to stores for these with or without the remote diagnostics.
So the author charitably calls the 2025 vulnerability a "login bypass", but it's much worse than that. The firmware included a "datetime-based password" mechanism: a built-in backdoor password, like it's the 90s again.
The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food", which the attackers apparently took to be a good suggestion.
As the firmware is open for anyone to download [2], blurring the affected function seems more like an invitation to find out more. I know I was curious when the news about the fridges in France broke. The function's actually called "check_code_of_the_day", and this is the implementation:
[1] https://www.claroty.com/team82/research/freeze-the-controlle...[2] https://www.danfoss.com/en-us/service-and-support/downloads/...
> The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food",
And it's _even worse_ than that. A famous french cybersecurity firm, Synacktiv, published a report in 2023 (!) about the code-of-the-day vulnerability, but it made less noise apparently [1]
[1] https://www.synacktiv.com/sites/default/files/2023-10/synack...
US bases were also attacked remotely this year too, but yet this attack was still "unprecedented" to the upper management of these grocer chains. Smells like incompetence to me personally.
"like it's the 90s again" - it probably was made in the 90s. Working with industrial systems it doesn't surprise me at all.
Thanks for the heads up, I had to laugh with the introduction paragraph, given the code example, and incident,
> Danfoss takes security seriously and as part of our continued improvements, new measures are being implemented. Please review below important security updates included in the latest AK-SM 800A software update that may impact your upgrade experience
> LPCTSTR
> firmware
Either said 'firmware' is a Windows app, or somebody has Stockholm syndrome
It's indeed Stockholm syndrome. It's (Ghidra decompiled) AArch32 firmware, but they define the datatype themselves with that name.
based
Reading the claroty article mentioning nginx, I think it's more likely that their decompiler is just setup to use windows semantics since that's probably a majority of what they analyze.
Iirc LPCTSTR is just an alias for const char* , lp being an anachromism of "long pointer" held over from the days when needing to do a distinction for "flat" 32bit pointers since there already was "near" and "far" pointers during the x86 16bit era.
It would be interesting to learn the history of this code as it seems to come from the US, based on the MMDDYY format used.
I mean, given the context, I'm just as inclined to think this was thought of as a form of obfuscation
I'm was super glad I could just copy/paste that code in my LLM-of-choice and it gave me a reasonable explanation of how to exploit it. Thank god an attacker couldn't do that.
This doesn’t require any fancy analysis. You can literally read the password off it — the last bit is an oddly decompiled string comparison.
Not everybody writes in the language they want to exploit I suppose, that's the great thing about LLMs!
on edit: even though I don't know C or C++ (I suppose it's C but can't be sure) I do think I can figure out what it's doing and how to guess what the password is, so that seems bad.
It’s the Windows dialect of C with Microsoft quasi-Hungarian-notation type names. Whole generations of programmers have grown up with these and all too many somehow think they make sense :)
But the relevant bit is at the end, from “if” to “return”, and should be pretty accessible to anyone familiar with an imperative language who can get past the general ugliness of the code. Once that’s figured out, you can recover the password by copying and executing the rest of the function.
Well most SWEs need an llm to spell their own name now.
That's not true, copy and paste hasn't fully atrophied for most people yet.
Claude disagreed with this take but I'm but I'm not sure it's true myself.
The fact that Russia has access to LLMs that could decompile and explain this firmware ( and possibly even translate the explanation to Russian! ) is just another proof that this was definitely part of the hybrid war and Europe needs to spend a few more tens of billions on weapons and possibly impose restrictions on open weight LLMs.
That's not a solution. Russia can just take the next LLM rolling out of China. The fix is to not be stupid and fix our broken infrastructure. Especially, IT infrastructure, but also things like idiotically Internet-connected fridges of supermarkets apparently.
Internet-connected fridges are fine. Sometimes you want to control your fridges remotely and the internet is perfect for that.
But use strong cryptography (tls1.3) and authentication (oidc)
There are zero reasons you should not be using VPN or at least IP whitelisting for that. Especially in the industrial settings.
> at least IP whitelisting
home or mobile users often have dynamic IPs and thus can't be "whitelisted". Why would you not want someone on their phone access the controls?
And VPNs are just external authentication & encryption mechanisms, you might as well implement those properly inside the application and forego VPN entirely.
Application and VPN work on totally different OSI layers, so what other comment already pointed out - it's defence in dept that exactly is meant to prevent such cases: when one control fails, other might save the day. IP whitelisting is mostly suitable for centralised command center and fixed locations which might have been sufficient in this case, as I really don't believe that these fridges were individually and manuallly controlled by human users via their phones rather than some server and automation.
> home or mobile users often have dynamic IPs and thus can't be "whitelisted". Why would you not want someone on their phone access the controls?
points vaguely at the exploit and how easy it is to find the targets.
If "change it from their phone" is a requirement, they can connect the phone to shop's network, or VPN from phone to HQ then bounce to the controller.
It is security by obfuscation, yes, but it is somewhat effective at low cost.
> And VPNs are just external authentication & encryption mechanisms, you might as well implement those properly inside the application and forego VPN entirely.
The controllers go out of support after some years. They work just fine, so replacing one if possible is costly and seen as unnecessary.
Putting it between $50 VPN box decouples "keeping VPN software up to date" and "keeping the controller up to date". It also gives your IT a single type of VPN config to support rather than being controller dependent.
I think the commenter above is making the point that this should be defence-in-depth.
Yes, of course use good encryption and auth{n,z}, but _also_ layer on restrictions at the network layer to stop general traffic from even getting there.
There is not good reason to control commercial fridges from home or from a mobile device.
There are rarely good reasons to control domestic fridges remotely. Why would you want to trigger defrosting when you are not there?
I have actually never had the urge to control any fridge remotely, and I believe the world can live without this feature.
None of what you said follows, and I can't tell whether it's a joke.
I am amazed and disappointed anyone here thought this was not sarcasm.
The wording reads like sarcasm to me.
It probably was Russia - just on the balance of probability - and defense spending is unrelated to this.
The solution is for supermarkets to stop being moronic by putting refrigerators on the internet.
They hopefully get sued into oblivion
What the hell is up with that comparison at the end?! Seems... overly verbose?
Most likely this is decompiled and not the way it was originally written.
Yep, and you can prompt something like "the function was a decompiled version, translate it into a readable version", if you don't like reading [probably] ghidra output.
The programmer probably wrote memcmp(pass, buf, 5) which compilers will often fold into an inlined loop, or a few comparisons if they know the 3rd arg.
The weird thing is it didn't emit a 32-bit load+compare for the first 4 bytes, this could probably be done with 2 comparsions. Idk. Maybe weird CPU with stricter alignment rules.
It's a fridge. Who knows what microcontroller CPU is there, and which toolchain they use.
Through my work I deal with grocery software and I can tell you that grocery software is ages behind the times. For most small retailers (small being a business owner with less than 10 stores in their retail chain, mostly local grocers) you are dealing with processes that would have been considered antique for the year 2000
It’s the same in a lot of sectors. Airlines. Electricity companies. Probably train lines. Banks. Fire services.
With all the disruption from AI on our industry, I can’t help but feel a little jealous.
AI enabled hackers are going to break everything that’s connected to the internet forcing it to move in to the modern era.
Disconnecting is also effective. Fridges don’t need to be on the internet.
That's not clear. Perhaps the savings made by having connected fridges over the year has offset the hacking event waste, so overall it could still be worth it. Now they need to apply security patches, and possibly only use the connection for monitoring (read-only) and have a kind of "2FA" / physical presence required when sending commands from the web
What savings?
Shifting when they consume electricity to take advantage of price differences during the day?
I would think that might have an impact on the temperature inside said fridges.
Yes, fridges don't have constant temperatures anyway. So you can shift when they run around a bit.
Not having to pay some token fine multiplied by however many times your employees didn't perfectly pencil whip the temp checks in the 3yr record retention period when you sell some bad fish and get audited as part of the investigation into that.
Not having to pay extra employees to maintain the fridges I guess
Yes they do if you operate a massive national chain and would like to minimize deadly health incidents due to avoidable human error.
Europe doesn't need to continue using fax machines and bury its head in the sand.
There's also the option to adopt digital technology and just not be an idiot about it this time since the price of intelligence is now effectively 0.
Or, France can continue preventing any productivity increases from technology and watch its social systems continue to collapse.
They don't need to be on internet. They just need to be available remotely. Simple VPN would've solved the issue entirely (...well, up to the moment when they won't update that, but updating VPN is far cheaper than commercial refrigerator controller I'd imagine)
What does AI have to do with this?
So much security in the past relied on "no one would bother to look in to this". We now have armies of bots relentlessly scanning over everything which is the main reason everything has been getting hacked over the last few months.
I'm really hoping that if it comes to pass, millions of AI-based hacking agents running amok on the internet, exploiting every single thing they can find, will at long last finally cause companies to get their shit together and secure their systems.
Imagine if your neighborhood had a million autonomous door-opening drones randomly flying around identifying doors and entering them. It wouldn't take long for everyone to lock their doors.
I don't disagree with you. But let's expand.. Imagine every neighborhood had autonomous brick throwing drones randomly smashing windows. Imagine every neighborhood had autonomous flame throwing drones randomly setting fires. Imagine every neighborhood and autonomous gun shooting drones randomly killing. Imagine every neighborhood and autonomous grenade lobbing drones randomly blowing up walls.
You can not defend everything. At some point you have to realize the world works because not every exploitable thing is exploited and we live in a civil society (most of us anyway).
I get it, the internet makes things different. But your analogy doesn't work You can not build a building that can not be destroyed.
"Every neighbourhood" is still a local problem, and can be solved locally. A grenade-lobbing device in australia can not reach 1 Microsoft Way, Redmond with multiple hits per second, nor do we have the resources to produce such artillery at the rate of multiple per second. Any analogy that you want to extend into the real world has to acknowledge these real-world limitations in more than just a footnote, or it's not a useful simile.
My hope and what I see happening is that the major players in the software space are frantically patching as many bugs as they can right now to keep ahead of attackers, and we come out the other end with incredibly robust software.
All the unsupported iot stuff will be obliterated by malicious bots, but the next generation of iot will be both more robust and less directly exposed to the internet. Like how Matter devices sit behind a hub rather than directly connecting to the internet.
>Imagine if your neighborhood had a million autonomous door-opening drones randomly flying around identifying doors and entering them. It wouldn't take long for everyone to lock their doors.
Pretty interesting example, because I'd like to live in a society where I don't have to lock my doors, because it's safe and I trust people around me. Releasing drone police randomly opening doors in the name of security sounds like a strict downgrade, not "a good thing because people will learn".
Recommend you unironically disconnect from the Internet.
and don’t live in a city.
I don't fully understand what you suggest. I live in a big city. It's very safe here - I am not afraid of walking alone in the night, neither is my wife. Theft is a problem, but not huge - I leave my bike unchained when going into a store, and chained outside overnight, for example. I lost my LED bike lights twice though, weird thing to steal but I guess they're very easy to detach. I also leave my apartment door unlocked when I'm inside, including overnight.
Of course, as you said, in a city I will never feel safe enough to leave a door unlocked when leaving my apartment - big cities are big, and even 0.1% of bad apples may spoil things for everyone. But wanting a safer and more high-trust society sounds like a good thing, right? How would disconnecting from the internet help me.
I just figured you might do something that gets you closer to the things you want,
while still living in the real world.
I don’t really “hope and dream” for stuff like feeling safe.
Especially when it can be had for so much less than the not-feeling-safe options.
(and yes, people randomly taking my things makes me feel unsafe.)
Disconnecting from the Internet makes it harder for people to break into your hardware.
> Releasing drone police randomly opening doors in the name of security sounds like a strict downgrade
This is happening on the Internet hourly, and it’s not the police. Well, sometimes. But mostly not.
I think this is irrelevant.
There is no evidence AI was used to do this and it feels like a random way to force AI into the conversation? It’s just spectacularly negligent behavior by people who think that they don’t have to trouble themselves with security, but want the convenience of having their stuff on the Internet for remote management.
This is just like the OPM hack 10 years ago.
No AI is needed for that. The Morris Worm was 38 years ago. Various MS Worms were as common as MS Windows 20-ish years ago. Anyone who's glanced over web server logs in the WordPress era knows about automated scanning for its myriad flaws.
Though one could argue that "AI" is needed, currently, for an editor to decide that a story about a hack is worth publishing.
(Yes, current-day AI's do shift the equilibrium. Somewhat. The French fridges would not be news if the situation was anywhere near as bad as the doomsayers seem eager to proclaim.)
AI is ruthlessly effective at finding vulnerabilities.
It's not so much that it's ruthlessly effective, it's more that it doesn't care about all the tedium of applying all the known techniques to all possible targets.
into the modern era... ... or back into the dark ages
Maybe AI will be able to give us a better FTP server in these industries
We already have that it's called SFTP. ;)
Wait what do you mean you want to use a key to log in, our stuff doesn't support that.
what do you mean "your ssh client deprecated that protocol", we use it everywhere!
I am reminded of this every time I fly Southwest Airlines
Electricity companies should be 100% air-gapped from any internet connection, whether or not they have outdated software.
Unfortunately this isn’t possible. If we spent billions upgrading electricity infrastructure, sure. But it’s much cheaper overall to make smart use of solar panels and batteries that are already being installed in the grid. And that requires a smart grid, full of networked equipment.
For example, during peak sunlight times, many neighbourhoods now generate more solar than they use. Without a sink for that power, voltages would go haywire on power lines and damage equipment. So the grid uses control boxes to manage how much power each house is allowed to send back to the grid. And all that needs compute, live metering and so on.
So... how do you feel about apps[0] that let you automate pushing electricity to the grid from your own home battery based on wholesale electricity prices?
Nothing could possibly go wrong?!?...
[0] https://www.amber.com.au/
You can do a one way link, sensors on infrastructure which emit data only but can not receive anything. Then another device like an ESP32 or whatever the industrial version is which reads the data and makes it available to the internet.
You now have the ability to remotely monitor the system but hacking it does not allow you to control anything. Though there is still a sizable amount of infrastructure which has no on site workers and needs to be remotely controlled.
There is plenty of room for antiquated process and technology in utilities that has nothing to do with grid operations, trust me. :)
Air-gapping is a start.
Critical National Infrastructure should go further, as Iran found out with Stuxnet.
Grocery stores can be as behind the times as they want. I'm worried about hospital fridges.
Other than computer security, by what standards ?
They are clearly making money just fine and in very low margin business. Moving cash registers to some electron app and vibecoding inventory management coz current system's app windows are ugly would improve it by 0 to negative %
I know someone at a 100 store operation and they're equally working in the stone age.
This isn’t grocery software, it’s a microcontroller for controlling a refrigeration system. The same controller is used in non-grocery refrigeration installations.
The real problem is devices like this should NOT be connected to the internet and at worst air gapped. Theres no reason including cost that a separate computer just for the fridges etc is not sitting in the office of the supermarket. Pretty sure the destoyed goods and close time cost far more than the extra cheapo computer.
Handling food related stuff, at least in my country, requires tracking and registering temperature for the fridge. It needs to be documented. Either you have a probe that you bring to computer to read data.. or you send it somewhere.
I don't know lot about fridge internet tech, but I can see that communication is needed to send this data. Having a hub to be able to do it is probably introduces complexity, but also maybe viable solution.
We had a blackout for a prolonged period of time (not 24hrs, but was 12+). Next day thee shop had all the freezers empty. If the "food and safety administration" on your audit catches that you still sold food when temp dropped under x for period of time, I bet you get into trouble.
You also get into trouble if you don't have records to show.
There is a very significant difference between _monitoring_ the equipment and _controlling_ the equipment. I get it why monitoring the equipment remotely provides a number of significant advantages, I'm in data analytics. I do not see how putting control systems online gains enough advantages to outweigh the risks. Fridges in a grocery stores is probably a weak example, but similar incidents with power systems, hospital/healthcare devices, and the like can actually endanger human lives.
There was far more serious incident very recently where hackers gained control or attempted to gain control of a propulsion system of an oil tanker. Resulting in a military operation to take it back. People need to start treating these risks more seriously.
Edit: Here's the link to the article:
https://news.ycombinator.com/item?id=49954466
The one good reason is that there is nobody skilled left in the office of the supermarket. The days of people with the skills to hit a supermarket HVAC system with a hammer are long gone. When the fridges are on the fritz, the minimum-wage shelf packer goes and packs shelves as far away from the fridge as possible.
My belief is that is more about convenience than anything else.
It is also worth looking at why this is so, which most likely stems from the lack of technically inclined staff in every location and the cost of having a tech going from store to store everyday to deal with POS, back office computers, amd any other kind of device.
Now, can you secure all this? For the most part yes, but it is quite expensive to do it. Maybe they will do it now or they will go with “it cannot happen to us twice” thinking and not do anything substantial about it.
It's not just about having tech inclined staff, but just the whole staffing strategy in general. Most grocery stores et. al. try to staff as cheaply as possible and try to have their workers do as much as possible during their shift. This means that there's no extra time available that they're not shelving products, or sitting at the register.
Rather than have extra staff at the store to do stuff like monitor fridge performance, it's better to have them report stuff centrally and have someone or some tool monitoring thousands of fridges across the entire chain. This way you can send out repair teams and plan maintenance more efficiently.
We all have fridges in our homes.
Why would managing fridge temps be a job that requires more than a few minutes a day at most ?
How hard could it be ?
Most fridges at home don't have hot gas defrost cycles, toxic Ammonia refrigerants and store tens of thousands of euros worth of food in at any time.
They usually require scheduled service teams maintaining them who have tight SLAs (because a supermarket without fridges loses a lot of money per day) so making sure you have remote access to it so you can bring the right parts with you is probably useful.
I suspect when you load a big fridge with lots of room temperature product (does that happen?) the fridge struggles to maintain adequate cold. Though that still seems like something the fridge itself could handle locally.
Surely, these fridges weren't doing inventory tracking? (Or were they?)
Don't forget the fridge is also opened probably 3 times a minute on average during business hours. The use profile is entirely different to home.
Exactly.
If a fridge is being opened frequently, the amount doesnt matter but lets pretend frequently means many times an hour, shouldnt a human be able to spot the fridge is warming up because it doesnt look or feel as cold as normally ?
Or perhaos they could look at a thermometer...
Sounds fun. Perhaps you would like to volunteer for thermometer duty at your local supermarket.
If there were actually people wandering around supermarkets manually checking fridge temperatures in 2026, everyone on HN would be saying how easy it it ought to be be to avoid all this pointless manual labor using modern technology.
Because being smart is not about avoiding work, its about failing well when things go pear shaped.
Its the same thign that separate good cars from the best. They both drive well enough at normal speeds in normal conditions. The best cars save your life when the others make you a cripple or dead in some unfortunate chance bad luck event.
Supermarkets operate on razor thin margins. They rely on being smart and avoiding work to make a profit. I don't think they are going to be persuaded to do a bunch of extra manual work, and tolerate increased electricity bills, just on the off chance that there's a once-in-a-generation cyber attack.
I think, in classic HN style, you're massively underestimating the complexity of a domain that you have no experience with. There's a whole academic literature on optimizing this:
https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=supe...
The software running on fridges should, obviously, be secure (just like any other software should), but air gapping the fridges, and winding the technological clock back a couple of decades, isn't a realistic proposal.
Fridges are manually checked where I work. And logged. It is very, very, pointless manual labor, but big.corp won't pay for an offsite solution. Approx 3,000 walk-in fridges across the company, about 1,000 of them also have walk-in freezers.
Home fridge, like all home appliances, is basically a toy version of the professional one.
There is a video game where you can unlock a thermostat which grants you extra points if you go back to it and readjust the temperature once in a while. Everyone hated it and kept mentioning just how ludicrous it is that a device called a "Thermal Static" somehow works by inputting thermal changes as opposed to thermal targets, prompting the developer to agree that was the stupidest idea they had and they would be changing it.
This game is nsfw.
Are you implying french fridge makers in real life are stupider than porn?
You don't take into account more complex situations where retail store is managing remotely say 50,000 fridges, adjusting regionally based on local stock, temperatures, weather forecast, incoming holidays and probably 100 other factors that outsiders have no clue about yet it allows them to have those razor thin margins that keeps them afloat.
Current security model is clearly not adequate but it would be nice if folks recognized that world is more complex than ie their home situation or some very simple use case they can come up with in their head.
I'd be more worried about the site with one fridge cutting corners than the one with 50,000.
It's the complexity of the world which should drive you towards keeping this stuff offline.
Hell, I used to manage some VoIP switches which would hard-lock if you hit them with `nmap -A`. More people need to learn this lesson.
A single fridge can be managed with a manual maximum recording thermometer. It records the highest temp reached. Check it daily, if the high temp is over 40F, throw everything away.
If you connect them to the internet you can control them remotely, there is nothing wrong with doing that.
yes, but why do they need to be exposed to the internet?
So you can control them over a network that you are almost always connected to, even if you are at home or mobile
you can keep them on a VPN and connect to that VPN yourself from anywhere, without exposing them to the possibility of anyone connecting to them directly from the internet.
You are just exposing the application to the internet with extra steps in between
If the application is properly secured (strong encryption, strong authentication) there is no point for the VPN
and if the application isn't configured correctly, the vpn/internal network might not be configured correctly either.
The extra steps are useful to have here. Assuming the application implemented in some ad-hoc firmware is secure enough when there trivial ways to add another more standardized layer of defense is simply negligence.
Or it should/could be connected, but in a read-only mode (eg monitor the data). And control could require someone on the location doing a physical button (pushing an "authorize command" button physically behind the fridge, or in a local control room, or something)
I don't think the company which installed the fridges would be tech savvy enough for that nor the supermarkets
Not tech savvy enough to push a button?
$1 charge for pushing the button. $999 charge for knowing which button to push.
I love customers that aren't tech savvy.
Of course it should be connected! Must be! How else would a manager sell customers data in real time to anyone who wants to buy it?
It's so boring to just sell fridges, let's spy on customers and sell that data! /s
Sad world of greedy things.
The shit will go on until those who makes such decisions start going to jail regularly.
Not only that its a stupid game.
How can the market support so many sources all selling customer data ?
The price has to crash because of the inbalance of data vs customers.
Source they were selling this fridge data in real-time? Can you post a link where I can buy it?
What customer data is this even giving me? How do I get someone's personal information based on the temperature of the drinks fridge in Store #138 in Nantes?
I guess my big question here is why these endpoints were exposed to the Internet in the first place. I thought pretty much everyone these days put all their infrastructure in a private IP range behind a NAT firewall. I can't imagine throwing critical infrastructure up naked onto the Internet, whether I knew of a specific security issue with the firmware or not.
fridges are very reliable. but let's IoT them anyways so they can theoretically notify us if there is a problem.
so of course that creates/enables the problem and doesn't notify us.
deliciously ironic and rottingly sad.
this case was egregious - built-in backdoor pw - but that is downstream of the decisions to IoT them and to default them to listen on the network.
Electricity is expensive. Grocery stores work on extremely thin margins with stock that literally turns rotten. These are physical devices that need maintenance. Their failure is often catastrophic. Grocery store workers are not equipped to fix an HVAC system. Someone needs to monitor for preventative maintenance.
I can't understand the mindset that would treat this as a trivial problem. What's sad is your confidence in giving this situation a 5 second take and declaring the whole thing stupid. Yes, security was clearly an issue, but saying that monitoring of critical infrastructure is sad is bizarre.
Remote monitoring by itself is not a problem, but remote control is and has no benefits. You can't change the temperature of or defrost a freezer without removing everything from it, and if you can remove everything from it someone is already there the change the settings. And it takes extra work to enable remote controlling of a refrigerator system over just providing temperature readings.
And it still isn't going to save electricity. The only thing it can do is warn of a failure and tell you that you got like 20 minutes to start moving food before it has to be trashed for exceeding safe food handling temperatures.
I mean, say you have 30 grocery stores, are you saying you shouldn't be able to build templates to deploy? You gonna have a guy drive all over the place updating schedules 24/7?
Why would you need to dynamically change the temperature?
Because the things you have in the fridge change. The opening and closing of the doors change. The actual equipment changes. Store hours change. Holidays happen. Sports games happen. Weather happens.
To be honest, a grocery store is one of the most dynamic systems I can think of.
Edit: A bang-bang thermostat is not an appropriate solution for a grocery store.
That's called a thermostat and doesn't require remote control. The frozen food needs to be at the correct temperature all the time, regardless of external factors.
> Because the things you have in the fridge change.
Are the contents of the fridge also being adjusted via remote management tools?
>are you saying you shouldn't be able to build templates to deploy
There's making a meeting out of something that should have been an email and then there's making a software project out of something that should have been an email.
The email is gonna go to the managers DL and it's gonna say "hey assholes the new temp is X set your shit to that" but in professional corporate speak and the managers will use their screwdrivers, take off one access panel and turn a dial ever so slightly" and I'll be able to see they've all done it right from my read-only monitoring system. And this has the side effect of keeping food from going bad in bulk because of a bug or fat finger or "Russian hackers" or whatever. The cost of the labor will almost certainly be cheaper than the cost of the software project amortized over its life.
Monitoring doesn't have to leave a way to enter the system automatically.
Alerts can be sent, and HVAC operators could have a process where they open a support ticket to get temporary access during scheduled windows by store managers.
I remember setting this up years ago for an hospital. Some third party suppliers could obtain RDP access to some VDI who could only accept a limited number of ips but they had to open a ticket and give a reason to get access. It wasn't a 365/24/7. Monitoring could still be sent any time.
It sounds like you have a brand new solution for an entire industry!
Somehow grocery stores existed long before we started even thinking about connecting everything to the Internet.
> workers are not equipped to fix an HVAC system.
But they are perfectly capable of checking the temperature. After all the fridges and freezers are restocked multiple times a day so even if one failed it wouldn't have time to get warm before someone should notice.
Ad there are other ways of monitoring such as having an audible or visual alarm.
Do you think grocery stores are 24/7? How often do you think these checks happen? Do you think it's the best way for those employees to spend their time? How often would these checks need to be performed to show statistical significance? Do you have reason to believe these things have never been thought about by people who run grocery stores? What are the labor requirements in a grocery store to run effectively?
They don't have to be 24/7 for multiple daily checks upon refilling to happen.
These checks do not need to happen 24 times a day. It is in fact perfectly acceptable for the workers to check it in the morning. I swear to god HN is inventing issues that dont exist to defend overengineered solutions.
Also, offline fridges are completely normal.
Workers, or humans in general, are not very reliable. Especially for a maintenance / checking task that's almost always feels pointless because the freezer will have the right temperature: people strapped for time will skip that step.
Moving the check online doesn't remove the unreliable human, it just switches it from a stock person to an it person, or whoever receives the email in their inbox.
> restocked multiple times a day
[citation needed]
Where I live, stores don't open on Sundays. Many apparently do in France, but I imagine not all of them. So there are potentially 24 + 12 hours where nobody's there to check stuff
I wish I could upvote this comment more
good points and all the more reason to monitor in reliable, safe manner?
This isn't your single compressor/evaporator/condenser coil appliance that sits in your kitchen. These are far larger and more complex systems.
The AK-SM 800A can control 170 different refrigeration devices. This is more akin to the entire freezer section (and probably meat and dairy) in your supermarket.
How is it a bad idea to want to automate maintenance of the fridges? It doesn’t require a bad implementation.
No one is saying anything against automation or monitoring per se. It's rather the idea to connect them to the Internet, that's highly questionable. They could be closed circuit streaming data into the back office of the grocery store and one look at a monitor would be enough to tell all is well. It doesn't have to be on the wide open Internet. And if somehow someone feels it must be visible online, then they can put a camera there to view the screen that shows the monitoring.
None of it requires connecting the very fridges to the Internet.
OP literally is criticizing the very idea of remote control.
Something like tailscale, iroh, Defguard securing these so that they’re accessible over the internet but only by authorized users works just fine.
Your suggestion doesn’t work if I want to actually do the control remotely. It only allows for remote status viewing.
But look, we can sell this "IoT-ready!Now!" version of our fridges for 1.5x as much! Who cares about long term damage to reputation? Next quarter's numbers dictate we have to go for this strategy.
To be fair, their entire threat model was likely "who TF would want to break in to change the settings on a thermostat on a fridge at a grocery store".
A valid question which has yet to be answered (at least not publicly).
If 'who TF' includes "everyone on the internet", then there are more than enough people who would do it to prove a point, for bragging rights, just for kicks, or because they want to cause as much damage as possible. The only question is how large is the intersection of that group and those with the ability and awareness to do it (something that is growing with the increased capabilities of LLMs).
Well _obviously_ there were enough people willing to go into the trouble of doing that. Because someone(s) actually did.
I'm just saying it wasn't a high value target like a bank. Which is what they counted on.
Some threat actor that demands quick payment or their perishables perish?
It's a fridge. In a grocery store. You just get an employee to adjust the thermostat dial. How would the hackers demand payment if all you need to do is turn the dial back to "frozen"???
Edit: Yes i know the commercial fridges do not have "dials" and it's more involved. Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.
> Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.
Sure, with time and expertise. How does the average employee adjust the virtual thermostat on fifty network-controlled fridges before the food goes bad?
I don't know about your grocery store but the ones I've been to have maybe 5 on the shopping floor and probably a few more in the back. They all have physical controls which (I'm assuming) override the controller if something goes wrong. So if big bad hacker says "I'm gon' turn y'all fridges off if you don't pay me" it's not a threat, it's a silly joke.
Unless of course they turn it off without telling the businesses so the products go bad because nobody's watching over the weekend or smth. But then again, why would someone want to do that. I wonder.
not if you set it to defrost at 1AM. the food's gonna be cooked by the time someone comes in
Clearly, somebody TF had a strong enough motivation to do it. Not for ransom (unless stores are hiding part of story) just for the lolz or directed harm.
Could be competition, could be lonely angry incel hacker, could be state actor (ie russia would not be out of picture given their past actions and current war they wage against entire western culture, but they are far from the only ones).
Leave phpbb forum unguarded, it will get hacked quickly. What gain? None apart from hoping to mine some crypto or be part of botnet. Still, will happen reliably.
That's true, however (phbb/mediawiki/wordpress/etc)'s exploits are very well documented and widely available for people to use simply due to popularity of these software. Which is not true for much more obscure software running on these controllers. So breaking into these was not not only low value but also high effort.
>85% ran software with known security flaws. That includes 527 older controllers Danfoss no longer supports. Only 195 had every known fix.
As long as the fridges are used the controller has to be supported.
This isn't a raspberry pi $50 a pop...
Those fridges are from the 90s. You cant reasonably support it that long. It's not even just software. The PLC is fixed hardware, you can't simply patch that.
You can replace the PLC. It's not like a modern PLC couldn't be made to control a 1990s fridge. The question is "Who will pay for the upgrade". DanFoss sure as hell won't. The stores won't, because they've already paid for the fridge.
Honestly I feel like this should fall under a support contract. The pricing structure could be similar to that of Microsoft. Support is fairly cheap, X number of years included in the purchase price, once the product reaches EOL the price goes up dramatically each year.
There's a massive problem in how we think about these products collectively. They are inherently insecure, they will be attacked and preventing it is expensive. You could build a safer alternative, but you'd be priced out of the market instantly by less safe, but more convenient alternatives.
I work in the industry. Usually customers are sold new PLCs for exorbitant prices as an "upgrade". Service contracts are only for know-how maintenance. Support cases get billed in addition to that.
This is how it's done everywhere I worked. You can patch some bugs for cheap in the software, but you can't fix hardware limitations. I know companies that use PLCs that still don't support encryption despite the upcoming EU regulations.
The companies either don't care or are too greedy to spend money on this.
In that case you maybe shouldn't put them online protected by nothing but 30 year old security.
Why can't you support it that long?
You couldn't read more than 2 sentences?
"The PLC is fixed hardware, you can't simply patch that."
Oh yes you can patch it - that's how I got the 20 year old laminator working where I work. If the hardware is still good you can absolutely change firmware if you have the PLC control software (like RockWell ControlFlash) or know how to manipulate the ladder logic directly.
You can change firmware aka how it behaves but you can't change it's capabilities.
Sure you can. Code is code. I took a machine without brush cleaning for transfer sheets and hand-tapped, mounted motors and controllers and brush assemblies, ran the connections into the PLC, install and connect the power relays, reflashed the PLC firmware with custom code, BAM it works.
As long as you have room in memory, you can add functionality.
Things will only meaningfully change when insurance companies stop paying out when reasonable steps weren't taken by companies to protect themselves.
As someone who has worked with small and medium sized businesses, reasonable is extremely variable. I'm dealing with a small business right now that can't upgrade their perfectly good computers because of TPM issues. On one hand, I kind of get the reasoning behind it, but how can you hold a business of 10 people accountable for not knowing how to buy a computer that will be reasonably future proof? Every business needs IT on hand? I think that's asking too much. On the otherhand, you should know the tools you need to run your business. There's no fine line.
I think if you can afford computers for your business but you can't afford to keep them secure, then you can't afford computers for your business.
What about plumbing and electrical? Do you need to employ those as well?
No, but you do need to keep them secure. The argument goes towards computers as appliances, which I wholly support.
TPM issues is a M$ invented shit. They shouldn't be running anything past Windows 10 anyway, and Windows 10 I believe, at least the normal versions are EOL already? But yeah businesses will do stupid things like installing Windows 11, and if they don't have dedicated staff to handle shit, they won't even know better what they should be doing. Plus their software may have idiotic requirements on top, that don't really make switching easy.
Insurance does actually tend to put cybersecurity requirements on to businesses they insure, the problem is that it's pretty hard to write cybersecurity requirements that actually result in secure IT systems as opposed to just a bunch of compliance work.
In theory, an insurance company could inspect and pen-test.
In practice, that would run into (probably, IANAL) legal issues, cost & staffing issues, and the narrow worldviews and business models of the insurance industry.
Oh, great idea. We should do that for software: force manufacturers to support their software with bugfixes as long as it is in use. And just bugfixes, the marketing department can stay out of it.
This will never fly. Some devices can be used for tens of years and they may face vulnerabilities that the hardware cannot support any kind of software fix for them. Imagine the world moves to TLS2 or whatever something new will be called and the hardware you have is too slow for it.
On the other hand, saying an industrial device should receive security updates for 10-15 years instead 5 or whatever happens this days it will be a major step forward. This will incentivise vendors to use better hardware with room to grow, not just the cheapest components possible.
Or, make componente modular so that you can upgrade just the control unit instead of the whole fridge or whatever.
The EU's CRA does mandate this kind of thing. It states 5 years minimum, but it needs to be longer if it's expected that the product remains in use for longer, and you need to commit to it in advance and tell customers (at the point of sale: so printed on the box or on the product listing).
No one at Danfoss got alerts than sudently hundred of fridges entered defrost mode? Reminds me of those computer you see at stores running weird ms-dos software.
“With our new internet-connected refrigerator line, you can get notifications online if a bunch of equipment malfunctions.”
“Why would a bunch of equipment malfunction?”
“Because you plugged it into the internet, you dolt.”
Many of these things have cycles where they clear frost or otherwise remove moisture from the system by getting hot. What you're talking about is something that could be common. It's the extended heating that starts causing problems, but if the software is taken over the alerts may no be sending.
I'm not one to draw causality, but this vulnerability seems to have had quite the effect on France
You are mistaken.
From 2017 through 2022 there was a large increase in the number of exposed refrigerators:
https://trends.shodan.io/search?query=http.favicon.hash:-853...
Over the past few years it has fluctuated but not the same continued growth as before. If you don't have a Shodan account you can see a chart on twitter:
https://x.com/shodanhq/status/2110526116679021055
For people who are saying the infrastructure not be connected to the internet are missing the advantages. I think the real solution is being able to protect using the latest and greatest security protocols. I understand that it will be hard for manufacturers and small groceries to keep track of that, but I think its a good opportunity for a security layer that is maintained by 3p. I am sure there already are and this incident hopefully will be a wake up call.
Security through obscurity is dead. I used to let my straggly collection of home servers and rented VPSs chug along with outdated firmware and security settings I only loosely understood, comfortable in the knowledge that: 1) Nobody cared about my servers 2) They weren't connected to anything important
But because of AI, (1) is no longer true. And if you believe Anthropic's murmurings about self-replicating LLMs, (2) may not be relevant either. I have had to pre-emptively get a frontier LLM to systematically fix and harden all of my hobby instances. On the bright side - also because of LLMs - it was very easy. There is really no excuse for outdated security anymore, when an LLM can one-shot harden almost any service.
It is kind of horrifying to figure out what happens if an LLM first successfully builds a self-replicating hive mind.
I mean it used to be utterly impossible, but now? Hard to tell.
The S in loT Stands for Security
When looters smash the glass door, it's pretty obvious the vulnerability has been there for YEARS!
Why bother breaking through the glass front, when most places of business have a very obvious back door just waiting.
How did these fridges even get public IP addresses?
They probably just didn't think anyone would want to hack that
Does this amount to gross negligence?
even worse: it's grocer's negligence
You seem to set great store in your buns; take care, they may go bad
Not isolating the refrigerator API from the Internet seems very negligent.
The refrigeration business does not really overlap with infosec or IT in general.
It does now.
hard to say who’s to blame: stores, installers or the vendor. most of these dashboards sat online for months, only 195 of 1,331 had every fix, and 76% went offline within days of the attack (disconnecting was possible all along, it seems).
Reason 732 on why I want the “dumbest” fridge possible, not some “smart” fridge with an app.
This is either a dupe or a followup of https://news.ycombinator.com/item?id=50055304 from 8 days ago with 1007 comments
Consider reading TFA
I read both. They seem related to me. They are both about supermarket fridges getting hacked over the internet.
I like similar articles' discussions to be linked together. I didn't see a link, so I added one. I don't see why I am getting all the angry downvotes.
suck it jian yang
LLMs are writing better code than professional 90s and early 2000s developers. That's for sure.
It really depends how they are prompted really.
As usual no?
We'll never get past this as long "well you didn't update" is considered an acceptable rebuttal. The problem is created when vulnerable software is released. We would be better off slowing things down by a factor of a hundred or more rather than continuing the current approach of "update every day to fix the new vulnerabilities introduced by the last update that fixed the old vulnerabilities".
List of legitimate reasons for a refrigerator, an oven, a stove, a washing or drying machine, a microwave, a coffee maker, a sink, a garbage disposal, a toilet, a shower or bathtub, or any other home appliance to be connected to the internet:
Allegedly they needed to stagger compressor startups. Motors, even fully electronically controlled ones, can draw a huge current on startups.
There's something very wrong with the electrical grid if they need to stagger startups over all the shops combined. Staggering startup within a single shop can be done with a LAN.
The device in the article isn't a home appliance.
Makes no difference. A super market should be able to air gap all their smart devices and include a non internet connected computer.
- Monitor temperatures and get alerts before food spoils
- Get notified if a compressor fails, refrigerant leaks, or a door gets left open
- Catch failing fans, compressors, or defrost heaters before they break
- Automatically log temperatures for food safety inspections
- Optimize defrost cycles and compressor operation to save electricity
- Let technicians diagnose problems remotely instead of driving to the store
- Reduce power usage during peak electricity rates
- Monitor fridges and freezers across multiple stores from one place
- Track energy usage and equipment performance over time
- Get alerts when power goes out or equipment doesn't restart properly
>Reduce power usage during peak electricity rates
This is the only one that requires remote write access, and only when "peak electricity rates" means a dynamic pricing system. But it doesn't actually need full Internet access. Instead, prices can be streamed via data diode to a local processor which calculates correct temperatures based on this information. This calculation should set reasonable limits on allowed temperature, so even if somebody sends false pricing information it's just going to waste some electricity and not destroy all the food.
>Optimize defrost cycles and compressor operation to save electricity
Assuming this means something different from "Reduce power usage during peak electricity rates", I don't see how it needs Internet access at all.
All the other points are monitoring tasks that can be done with read-only access via a separate data diode.
"full Internet access" is a term you brought here out of nowhere and is what your whole faulty premise hinges on.
The exact meaning isn't important. The point is that something like RS-422 with the TX lines removed is perfectly adequate for receiving pricing updates. Anything more complex than that is adding unnecessary attack surface.
Remote diagnostics is the only one of these functions that can fairly be said to require an internet connection. There are many remote connectivity solutions for low bandwidth, low latency needs like these that pose nowhere near as much of a risk as an internet connection.
Even the remote diagnostics is of questionable value at best. You can do remote diagnostics just as well with a faxed printout of system information and having store staff do manual resets at needed. Remote diagnostics isn't going to solve anything that requires more than a reboot, like replacing a compressor coil, anyway, so you're going to need service staff driving to stores for these with or without the remote diagnostics.
So this is the real reason they're rioting. I'd be pissed too.
Sadly no, it's just the same old incoherence over the point of the state
Backdoors on French fridges? I think they have a bigger problem right now with their front doors.