Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
-
@GossiTheDog Some of these in the U.S. are running super old versions of
nginx, and are connected directly to a commercial grade ISP. Sheesh.@scottwilson that’s the vendor supplied version. You’ll find them in food production and such. It’s similar with Windfarms etc, they’re in 5G cell provider ranges in the US.
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog OMFG this is bad -
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog JFC!
-
To bypass login send a POST request to /xml.cgi, there’s a write up here: https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
@GossiTheDog Is this not what they meant by passwordless authentication? Have you not been entertained!?
-
You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
The jobs not finished until you do the paper work!
️ -
@GossiTheDog I know we’ve learned that enforced password rotation is bad security practice, but this is a whole other level
@slothrop @GossiTheDog "We're secure! We have daily password changes!"
-
Shodan search: html:danfoss product:"nginx"
The supermarket impacted today in France put all of their devices directly internet facing and all had the same password, today’s date.
https://beta.shodan.io/search?query=html%3Adanfoss+product%3A%22nginx%22
@GossiTheDog This is sad. In the 1 single minute I spent scrolling through the list of thousands....the count increased by one when I hit refresh.
-
@GossiTheDog How much safer are they if they're behind a NAT router?
@davetheresurrector @GossiTheDog You can almost guarantee that vendor rules said they had to be internet facing for 'vendor support'.
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
This seems to have been fixed and sorted out already in 2025. 🤭
CVE-2025-41450
CVE-2025-41451
CVE-2025-41452 -
This seems to have been fixed and sorted out already in 2025. 🤭
CVE-2025-41450
CVE-2025-41451
CVE-2025-41452@Erka ‘sorted out’
-
To bypass login send a POST request to /xml.cgi, there’s a write up here: https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
The article tells there is an algo (reverse engineered from binary accordinf to the screenshot) that depends only on the date. Not that the date is the value to enter like you suggest which is way easier. What to believe?
-
Also there’s loads of speculation about if it’s Russia, China, Iran.
It’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.
@GossiTheDog The Zersetzung Machine Just Works Like That
-
@Erka ‘sorted out’
@GossiTheDog With extreme low valuations of ’sorted out’ it seems.
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog Also, it is a fridge. Set the temperature once, and never change it again. No need for cyber.
-
The article tells there is an algo (reverse engineered from binary accordinf to the screenshot) that depends only on the date. Not that the date is the value to enter like you suggest which is way easier. What to believe?
@tuxicoman @GossiTheDog I was thinking the same
-
Shodan search: html:danfoss product:"nginx"
The supermarket impacted today in France put all of their devices directly internet facing and all had the same password, today’s date.
https://beta.shodan.io/search?query=html%3Adanfoss+product%3A%22nginx%22
-
The article tells there is an algo (reverse engineered from binary accordinf to the screenshot) that depends only on the date. Not that the date is the value to enter like you suggest which is way easier. What to believe?
@tuxicoman it’s a date, I’ve tested
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
-
@tuxicoman it’s a date, I’ve tested
If the string to compare with is the not masked one from the screenshot.
-
J jwcph@helvede.net shared this topic
