<![CDATA[Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.]]>Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.

The username is admin and the password changes every day automatically to.. the current date.

Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.

]]>https://forum.fedi.dk/topic/02358124-96f5-48a5-95e3-d8461f6d3008/regarding-the-danfoss-fridge-thing-doing-the-rounds-in-the-media-there-s-several-thousand-of-them-that-are-directly-internet-facing.RSS for NodeFri, 23 Oct 2026 13:32:45 GMTMon, 12 Oct 2026 19:06:47 GMT60<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:58:37 GMT]]>@GossiTheDog

]]>https://forum.fedi.dk/post/https://mastodon.social/ap/users/117430151899507950/statuses/117430178125077178https://forum.fedi.dk/post/https://mastodon.social/ap/users/117430151899507950/statuses/117430178125077178Mon, 12 Oct 2026 21:58:37 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:53:51 GMT]]>@GossiTheDog

😂 🤣 😆 😀 💩

This one takes the prize for winning the Internet tonight. Kudos GossiTheDog 🏆️

]]>https://forum.fedi.dk/post/https://mastodon.online/users/carpetbomberz/statuses/117430159354256766https://forum.fedi.dk/post/https://mastodon.online/users/carpetbomberz/statuses/117430159354256766Mon, 12 Oct 2026 21:53:51 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:50:43 GMT]]>@0xabad1dea @GossiTheDog I've advocated in the past for this type of liability; more broadly phrased, dereliction of a public trust should be indictable on the rationale that between the hacker and the large corporate defender, one of these is much easier to deter.

The flagrantly negligent defender in whom public trust is placed also profits from their misdeeds. So the idea would be to fine e.g. banks who do things like lay off all their security teams and then get hacked.

]]>https://forum.fedi.dk/post/https://mastodon.falconk.rocks/users/falcon/statuses/117430147041215403https://forum.fedi.dk/post/https://mastodon.falconk.rocks/users/falcon/statuses/117430147041215403Mon, 12 Oct 2026 21:50:43 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:47:25 GMT]]>@funnymonkey @GossiTheDog

Who knew food safety and refrigeration were right up there with power generation and sewer treatment in the attack surface and threat to civil society? Man. The hits just keep on comin'. 🥴

]]>https://forum.fedi.dk/post/https://mastodon.online/users/carpetbomberz/statuses/117430134073338882https://forum.fedi.dk/post/https://mastodon.online/users/carpetbomberz/statuses/117430134073338882Mon, 12 Oct 2026 21:47:25 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:38:44 GMT]]>@GossiTheDog Well according to everyone who expresses that they have more skill than me, the more often the password changes the more unhackable it is. The only thing more secure than "daily" is "hourly".

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/jsmall/statuses/117430099930852809https://forum.fedi.dk/post/https://infosec.exchange/users/jsmall/statuses/117430099930852809Mon, 12 Oct 2026 21:38:44 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:37:49 GMT]]>@0xabad1dea@infosec.exchange @GossiTheDog@cyberplace.social The company that sold it, if the instructions failed to underline the importance of not doing so or changing the credentials (or made it impossible to change them) should also have such charges.

]]>https://forum.fedi.dk/post/https://udongein.xyz/objects/b1b3e664-e5e8-4348-b83b-fc583351e7d3https://forum.fedi.dk/post/https://udongein.xyz/objects/b1b3e664-e5e8-4348-b83b-fc583351e7d3Mon, 12 Oct 2026 21:37:49 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:34:48 GMT]]>@GossiTheDog

not the first time for Danfoss. They had a 06/06/2006 midnight incident, where ALL of their BRC-2000 controllers worldwide were programmed to hammer the motor contactors to burn up the AC motors. This company and their "security" is legendary...

They had a notice about this on their website for a few years, but likely did a document purge to prevent the endless subpoenas in the future...

]]>https://forum.fedi.dk/post/https://lgbtqia.space/users/dianea/statuses/117430084456699119https://forum.fedi.dk/post/https://lgbtqia.space/users/dianea/statuses/117430084456699119Mon, 12 Oct 2026 21:34:48 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:22:54 GMT]]>@GossiTheDog This PR trick has been working so far, but if they keep overstepping their bounds this much, eventually they're going to tick off enough people enough that they start actually bringing in lawyers and realize "wait a minute, this is just a stunt. We can actually sue them."

]]>https://forum.fedi.dk/post/https://urusai.social/users/nazokiyoubinbou/statuses/117430037667288395https://forum.fedi.dk/post/https://urusai.social/users/nazokiyoubinbou/statuses/117430037667288395Mon, 12 Oct 2026 21:22:54 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:14:26 GMT]]>@GossiTheDog Aight, got it. Now, who’s gonna hook me up with that Jersey City delivery list? I’m tryna score 70% off all the frozen stuff before exp.date faint. C’mon, do me a solid, will ya?

]]>https://forum.fedi.dk/post/https://mastodon.social/users/mobidic/statuses/117430004359817675https://forum.fedi.dk/post/https://mastodon.social/users/mobidic/statuses/117430004359817675Mon, 12 Oct 2026 21:14:26 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:14:03 GMT]]>@GossiTheDog And who authorized that setting is still working? At any level higher than toilet cleaning?
Nothing to object with toilet cleaning, I do it myself. I'd like to know if that person is so underskilled as it looks, from my perspective of toilet cleaning, which actually stands out in the comparison.

]]>https://forum.fedi.dk/post/https://mastodon.gamedev.place/ap/users/116092650648397225/statuses/117430002847852293https://forum.fedi.dk/post/https://mastodon.gamedev.place/ap/users/116092650648397225/statuses/117430002847852293Mon, 12 Oct 2026 21:14:03 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:13:13 GMT]]>@GossiTheDog It's pretty consistent with most IP-enabled, quasi-industrial operational technology that I encounter, and demonstrates a lack of imagination on the part of OEM threat assessments, and a lack of competence in their security engineering.

]]>https://forum.fedi.dk/post/https://meow.social/users/tryst/statuses/117429999585932388https://forum.fedi.dk/post/https://meow.social/users/tryst/statuses/117429999585932388Mon, 12 Oct 2026 21:13:13 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:09:26 GMT]]>@0xabad1dea @GossiTheDog yes. this problem was extremely easy to anticipate and the only thing that ever caused people to get complacent was normalcy bias.

we like your way of putting it, the only possible excuse the people who left it open like that have is that they fucking act like children, and that's no excuse at all.

]]>https://forum.fedi.dk/post/https://adhd.irenes.space/users/ireneista/statuses/01M4RZ5TVM4YBT8TVGHTT3D5N9https://forum.fedi.dk/post/https://adhd.irenes.space/users/ireneista/statuses/01M4RZ5TVM4YBT8TVGHTT3D5N9Mon, 12 Oct 2026 21:09:26 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:08:08 GMT]]>@GossiTheDog one handed, on your phone 😉

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/webhat/statuses/117429979615355753https://forum.fedi.dk/post/https://infosec.exchange/users/webhat/statuses/117429979615355753Mon, 12 Oct 2026 21:08:08 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:06:47 GMT]]>@GossiTheDog someone needs to catch negligence charges for endangering the food supply chain of France by putting all the grocery store thermostats on the public internet for absolutely no fucking reason. we are too old for this behavior

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/0xabad1dea/statuses/117429974275269450https://forum.fedi.dk/post/https://infosec.exchange/users/0xabad1dea/statuses/117429974275269450Mon, 12 Oct 2026 21:06:47 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:02:47 GMT]]>@GossiTheDog

Screenshot of a Danfoss login page:

Danfoss
System Manager 800A

an input box with "admin" in it
an input box with 5 password dots in
a button saying "Sign In"

]]>https://forum.fedi.dk/post/https://floss.social/users/ami/statuses/117429958543361776https://forum.fedi.dk/post/https://floss.social/users/ami/statuses/117429958543361776Mon, 12 Oct 2026 21:02:47 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 21:02:06 GMT]]>@GossiTheDog « and I’m not constipated »

]]>https://forum.fedi.dk/post/https://social.sourcemac.fr/ap/users/117201937678305186/statuses/117429955913809581https://forum.fedi.dk/post/https://social.sourcemac.fr/ap/users/117201937678305186/statuses/117429955913809581Mon, 12 Oct 2026 21:02:06 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 20:55:10 GMT]]>@GossiTheDog and who in their right mind doesn't design a hard maximum temperature for a fridge thermostat of something resembling room temperature?

]]>https://forum.fedi.dk/post/https://mastodon.online/users/zymurgic/statuses/117429928621329611https://forum.fedi.dk/post/https://mastodon.online/users/zymurgic/statuses/117429928621329611Mon, 12 Oct 2026 20:55:10 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 20:55:00 GMT]]>@GossiTheDog I KNOW -_-

]]>https://forum.fedi.dk/post/https://infosec.exchange/ap/users/117426421404593650/statuses/117429927981553024https://forum.fedi.dk/post/https://infosec.exchange/ap/users/117426421404593650/statuses/117429927981553024Mon, 12 Oct 2026 20:55:00 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 20:54:12 GMT]]>@GossiTheDog

https://social.claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers

]]>https://forum.fedi.dk/post/https://cyberplace.social/users/Enerby/statuses/117429924797821829https://forum.fedi.dk/post/https://cyberplace.social/users/Enerby/statuses/117429924797821829Mon, 12 Oct 2026 20:54:12 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 20:52:41 GMT]]>@GossiTheDog
This seems fine.

]]>https://forum.fedi.dk/post/https://freeradical.zone/users/funnymonkey/statuses/117429918848212121https://forum.fedi.dk/post/https://freeradical.zone/users/funnymonkey/statuses/117429918848212121Mon, 12 Oct 2026 20:52:41 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 20:51:28 GMT]]>@GossiTheDog And some sandwiches went to waste. Judging from the symptoms as described in the press they had their fridges connected to the open internet.

Everything that really matters is minimised in public discourse, sidelined, or made look negligible.

All the things caused by negligence, bad decisionmaking, and terrible ideas get a free pass.

]]>https://forum.fedi.dk/post/https://oldbytes.space/users/haitchfive/statuses/117429914105336936https://forum.fedi.dk/post/https://oldbytes.space/users/haitchfive/statuses/117429914105336936Mon, 12 Oct 2026 20:51:28 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 20:50:41 GMT]]>@GossiTheDog

Do you know what Danfoss also produces: home thermostat applications. Incl. ones that are app-controlled, so internet-facing. Hmm.

https://www.danfoss.com/en/products/dhs/smart-heating/solutions/danfoss-tpone-s/#tab-overview

]]>https://forum.fedi.dk/post/https://mastodon.social/users/knud/statuses/117429910974683291https://forum.fedi.dk/post/https://mastodon.social/users/knud/statuses/117429910974683291Mon, 12 Oct 2026 20:50:41 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 20:48:05 GMT]]>@GossiTheDog

Yeah, well the difference to "throw-away agents" is smaller than one might think these days. And the simultaneous "IT issue" in NL is ... an interesting coincidence.

]]>https://forum.fedi.dk/post/https://mastodon.social/users/knud/statuses/117429900741915604https://forum.fedi.dk/post/https://mastodon.social/users/knud/statuses/117429900741915604Mon, 12 Oct 2026 20:48:05 GMT<![CDATA[Reply to Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. on Mon, 12 Oct 2026 20:46:43 GMT]]>@GossiTheDog
Why are those on the internet or connected to thr network anyway? I mean yes, you could query its temperature and run a monitoring system that alerts you when one of the fridges becomes too warm due to a malfunction. But for that readonly access is enough. Why is the temperature remote writeable?? And what else can be done with the access? Only temperature? What is the regular usecase here?

]]>https://forum.fedi.dk/post/https://social.linux.pizza/users/momo/statuses/117429895427702265https://forum.fedi.dk/post/https://social.linux.pizza/users/momo/statuses/117429895427702265Mon, 12 Oct 2026 20:46:43 GMT