Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
-
LinkedIn’s absolutely awash with security vendors posting brain-dead takes on the fridge thing as they have no idea, at all, what they’re talking about. It’s great as it’s a list of people not to hire.
You may be surprised to know the through line to the posts is.. AI. Remember when we had intelligence.
@GossiTheDog I don't see the brain-dead takes from people I shouldn't hire. Can you share?
-
I’ve seen some breathless reporting in the media about the situation in France saying it’s the biggest cyber attack ever and the result of a swarm of Agentic AI bots.
Reality: no. It’s a complete lack of security controls and negligent product development by the vendor.
@GossiTheDog I'm not a security professional but... sounds like the kind of thing that should live on an isolated network?
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog a cookie to the genius that had this idea xD
-
Also there’s loads of speculation about if it’s Russia, China, Iran.
It’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.
@GossiTheDog Sometimes a teen wonders what if they did decide to connect to one of the random unprotected industrial controls they see on @vncresolver, what sort of trouble could be caused.
-
@GossiTheDog "System Manager AK-SM 800A software package v4.0x and above enhances your product's security features to meet internationally recognized regulations. Danfoss is now defaulting to a strong security posture and is following secure by design principles."
Snark aside, the list of security features they tout as being available with the new v4 in 'strict' mode is rather terrifying.
@fuzzyfuzzyfungus @GossiTheDog So.. with strict mode disabled (which was default until a certain version), they allow HTTP connections, use plaintext authentication, and don't sanitise inputs.
And they admit this..
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog
Why are those on the internet or connected to thr network anyway? I mean yes, you could query its temperature and run a monitoring system that alerts you when one of the fridges becomes too warm due to a malfunction. But for that readonly access is enough. Why is the temperature remote writeable?? And what else can be done with the access? Only temperature? What is the regular usecase here? -
Also there’s loads of speculation about if it’s Russia, China, Iran.
It’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.
Yeah, well the difference to "throw-away agents" is smaller than one might think these days. And the simultaneous "IT issue" in NL is ... an interesting coincidence.
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
Do you know what Danfoss also produces: home thermostat applications. Incl. ones that are app-controlled, so internet-facing. Hmm.
https://www.danfoss.com/en/products/dhs/smart-heating/solutions/danfoss-tpone-s/#tab-overview
-
I’ve seen some breathless reporting in the media about the situation in France saying it’s the biggest cyber attack ever and the result of a swarm of Agentic AI bots.
Reality: no. It’s a complete lack of security controls and negligent product development by the vendor.
@GossiTheDog And some sandwiches went to waste. Judging from the symptoms as described in the press they had their fridges connected to the open internet.
Everything that really matters is minimised in public discourse, sidelined, or made look negligible.
All the things caused by negligence, bad decisionmaking, and terrible ideas get a free pass.
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog
This seems fine. -
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
-
Also there’s loads of speculation about if it’s Russia, China, Iran.
It’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.
@GossiTheDog I KNOW -_-
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog and who in their right mind doesn't design a hard maximum temperature for a fridge thermostat of something resembling room temperature?
-
You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
@GossiTheDog « and I’m not constipated »
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog
#Alt4You
Screenshot of a Danfoss login page:Danfoss
System Manager 800Aan input box with "admin" in it
an input box with 5 password dots in
a button saying "Sign In" -
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog someone needs to catch negligence charges for endangering the food supply chain of France by putting all the grocery store thermostats on the public internet for absolutely no fucking reason. we are too old for this behavior
-
You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
@GossiTheDog one handed, on your phone
-
@GossiTheDog someone needs to catch negligence charges for endangering the food supply chain of France by putting all the grocery store thermostats on the public internet for absolutely no fucking reason. we are too old for this behavior
@0xabad1dea @GossiTheDog yes. this problem was extremely easy to anticipate and the only thing that ever caused people to get complacent was normalcy bias.
we like your way of putting it, the only possible excuse the people who left it open like that have is that they fucking act like children, and that's no excuse at all.
-
You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
@GossiTheDog It's pretty consistent with most IP-enabled, quasi-industrial operational technology that I encounter, and demonstrates a lack of imagination on the part of OEM threat assessments, and a lack of competence in their security engineering.
-
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@GossiTheDog And who authorized that setting is still working? At any level higher than toilet cleaning?
Nothing to object with toilet cleaning, I do it myself. I'd like to know if that person is so underskilled as it looks, from my perspective of toilet cleaning, which actually stands out in the comparison.
