Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
-
I’ve seen some breathless reporting in the media about the situation in France saying it’s the biggest cyber attack ever and the result of a swarm of Agentic AI bots.
Reality: no. It’s a complete lack of security controls and negligent product development by the vendor.
@GossiTheDog "but... but... we couldn't update the security because they were so old." YYSW
-
@GossiTheDog Wasn't it the internet connected fridges that let the group into Target years ago?
No. It was an HVAC system. Same penetration scenario and just as stupid though.
Lived in an apartment building about 6 blocks from Target headquarters at the time. Lot of Target employees (including IT) lived there.
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog That is harder than password 123456
https://cybersecuritynews.com/admin-password-danish-data-breach/
-
I’ve seen some breathless reporting in the media about the situation in France saying it’s the biggest cyber attack ever and the result of a swarm of Agentic AI bots.
Reality: no. It’s a complete lack of security controls and negligent product development by the vendor.
@GossiTheDog oh good another BS phrase corps can use “A.I. did it” so what “artificial washing” now?
-
Also there’s loads of speculation about if it’s Russia, China, Iran.
It’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.
You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog which date format, though? My password is four zeros, but I won't tell you in what order
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog I was just teaching my young kids about "attack surfaces" lmao and this popped up, right on time. I've long ago banned all IoT trash from this network and we will never look back. This is hilarious, tho.
-
You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
@GossiTheDog that ... gives "internet of shite" a whole new meaning.
-
Also there’s loads of speculation about if it’s Russia, China, Iran.
It’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.
@GossiTheDog these are those Advanced Persistent Teenagers you warned us about, aren't they?
-
Shodan search: html:danfoss product:"nginx"
The supermarket impacted today in France put all of their devices directly internet facing and all had the same password, today’s date.
https://beta.shodan.io/search?query=html%3Adanfoss+product%3A%22nginx%22
@GossiTheDog Some of these in the U.S. are running super old versions of
nginx, and are connected directly to a commercial grade ISP. Sheesh. -
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog How much safer are they if they're behind a NAT router?
-
You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
-
You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
@GossiTheDog And... that is why your toilet seat is cleaner than your keyboard or mobile phone
-
@GossiTheDog Some of these in the U.S. are running super old versions of
nginx, and are connected directly to a commercial grade ISP. Sheesh.@scottwilson that’s the vendor supplied version. You’ll find them in food production and such. It’s similar with Windfarms etc, they’re in 5G cell provider ranges in the US.
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog OMFG this is bad -
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog JFC!
-
To bypass login send a POST request to /xml.cgi, there’s a write up here: https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
@GossiTheDog Is this not what they meant by passwordless authentication? Have you not been entertained!?
-
You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
The jobs not finished until you do the paper work!
️ -
@GossiTheDog I know we’ve learned that enforced password rotation is bad security practice, but this is a whole other level
@slothrop @GossiTheDog "We're secure! We have daily password changes!"
-
Shodan search: html:danfoss product:"nginx"
The supermarket impacted today in France put all of their devices directly internet facing and all had the same password, today’s date.
https://beta.shodan.io/search?query=html%3Adanfoss+product%3A%22nginx%22
@GossiTheDog This is sad. In the 1 single minute I spent scrolling through the list of thousands....the count increased by one when I hit refresh.
