Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
-
@AlisonW @GossiTheDog real security relies on the blatant disregard of ISO 8601
@dylan @GossiTheDog
My favourite discussion -
You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
LinkedIn’s absolutely awash with security vendors posting brain-dead takes on the fridge thing as they have no idea, at all, what they’re talking about. It’s great as it’s a list of people not to hire.
You may be surprised to know the through line to the posts is.. AI. Remember when we had intelligence.
-
@slothrop @GossiTheDog "We're secure! We have daily password changes!"
@tony @slothrop @GossiTheDog Box: checked
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog Danfoss?! More like Defrost.
-
Shodan search: html:danfoss product:"nginx"
The supermarket impacted today in France put all of their devices directly internet facing and all had the same password, today’s date.
https://beta.shodan.io/search?query=html%3Adanfoss+product%3A%22nginx%22
@GossiTheDog The hack is coming from inside the store!
-
LinkedIn’s absolutely awash with security vendors posting brain-dead takes on the fridge thing as they have no idea, at all, what they’re talking about. It’s great as it’s a list of people not to hire.
You may be surprised to know the through line to the posts is.. AI. Remember when we had intelligence.
@GossiTheDog You mustn't forget that we really do need the hype around the AI-threat. I mean... how else are we going to sell products countering the very-soon-to-come onslaught of autonomous AI-agent attacks that, unless countered, will entirely enslave and make a botnet of all computers on the internet.
-
Also there’s loads of speculation about if it’s Russia, China, Iran.
It’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.
@GossiTheDog First thing I thought when I heard about this was “Advanced Persistent Teenagers at it again!”
It’s a teenager kind of attack. A target no adult would think about because adults have forgotten all of the open targets that we’ve been safely (de facto) been ignoring forever. -
To bypass login send a POST request to /xml.cgi, there’s a write up here: https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
@GossiTheDog Chances of customers updating the firmware in the last few months.
vs Chances they will update it now? -
I’ve seen some breathless reporting in the media about the situation in France saying it’s the biggest cyber attack ever and the result of a swarm of Agentic AI bots.
Reality: no. It’s a complete lack of security controls and negligent product development by the vendor.
@GossiTheDog It's like the excuse of all excuses. Remember APTs back in the early 2000s (maybe it was the early 2010s), and everybody got so sick of that term because that's what everybody would say: "Oh, we were breached. It must have been an APT." No, your security just sucks. Now it's, "Oh, we've been breached. It was an agentic storm of rogue AI." No, your security just sucks.
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog You could store random data in an array of these across the world by setting the temperature & then watching the current temperatures fluctuate around those & use it as a source of entropy. Obviously only use three or four time zones that are in the middle of the day at a time.
New worst way to generate key pairs?
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog I just assumed there were a handful of bored script kiddies with Yandex being on fire...
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog Wait till someone tells them boilers use the same system.
Oh noooossss security something something...
-
LinkedIn’s absolutely awash with security vendors posting brain-dead takes on the fridge thing as they have no idea, at all, what they’re talking about. It’s great as it’s a list of people not to hire.
You may be surprised to know the through line to the posts is.. AI. Remember when we had intelligence.
@GossiTheDog I don't see the brain-dead takes from people I shouldn't hire. Can you share?
-
I’ve seen some breathless reporting in the media about the situation in France saying it’s the biggest cyber attack ever and the result of a swarm of Agentic AI bots.
Reality: no. It’s a complete lack of security controls and negligent product development by the vendor.
@GossiTheDog I'm not a security professional but... sounds like the kind of thing that should live on an isolated network?
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog a cookie to the genius that had this idea xD
-
Also there’s loads of speculation about if it’s Russia, China, Iran.
It’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.
@GossiTheDog Sometimes a teen wonders what if they did decide to connect to one of the random unprotected industrial controls they see on @vncresolver, what sort of trouble could be caused.
-
@GossiTheDog "System Manager AK-SM 800A software package v4.0x and above enhances your product's security features to meet internationally recognized regulations. Danfoss is now defaulting to a strong security posture and is following secure by design principles."
Snark aside, the list of security features they tout as being available with the new v4 in 'strict' mode is rather terrifying.
@fuzzyfuzzyfungus @GossiTheDog So.. with strict mode disabled (which was default until a certain version), they allow HTTP connections, use plaintext authentication, and don't sanitise inputs.
And they admit this..
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog
Why are those on the internet or connected to thr network anyway? I mean yes, you could query its temperature and run a monitoring system that alerts you when one of the fridges becomes too warm due to a malfunction. But for that readonly access is enough. Why is the temperature remote writeable?? And what else can be done with the access? Only temperature? What is the regular usecase here? -
Also there’s loads of speculation about if it’s Russia, China, Iran.
It’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.
Yeah, well the difference to "throw-away agents" is smaller than one might think these days. And the simultaneous "IT issue" in NL is ... an interesting coincidence.
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
Do you know what Danfoss also produces: home thermostat applications. Incl. ones that are app-controlled, so internet-facing. Hmm.
https://www.danfoss.com/en/products/dhs/smart-heating/solutions/danfoss-tpone-s/#tab-overview
