France's supermarket fridges were vulnerable online for months

Cameri

Does this amount to gross negligence?

SOLAR_FIELDS

Through my work I deal with grocery software and I can tell you that grocery software is ages behind the times. For most small retailers (small being a business owner with less than 10 stores in their retail chain, mostly local grocers) you are dealing with processes that would have been considered antique for the year 2000

Thaxll

No one at Danfoss got alerts than sudently hundred of fridges entered defrost mode? Reminds me of those computer you see at stores running weird ms-dos software.

Confiks

So the author charitably calls the 2025 vulnerability a "login bypass", but it's much worse than that. The firmware included a "datetime-based password" mechanism: a built-in backdoor password, like it's the 90s again. The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food", which the attackers apparently took to be a good suggestion. As the firmware is open for anyone to download [2], blurring the affected function seems more like an invitation to find out more. I know I was curious when the news about the fridges in France broke. The function's actually called "check_code_of_the_day", and this is the implementation: uchar check_code_of_the_day(LPCTSTR pass) { uchar uVar1; LPCTSTR pass_local; DATE_STRUCT date; INT32 tothex; INT32 hex; UTF8_STR buff; Get_syst_current_tds(&date); ftext_s(buff,0x1ff,"%02d%02d%02d%02d",date.month,date.day,date.year,date.month); sscanf(buff,"%lx",&tothex); ftext_s(buff,0x1ff,,date.day); sscanf(buff,"%lx",&hex); tothex = __aeabi_idiv(tothex,hex); ftext_s(buff,0x1ff,"%05ld",tothex % 100000); if ((((*pass == buff[0]) && (pass[1] == buff[1])) && (pass[2] == buff[2])) && ((pass[3] == buff[3] && (pass[4] == buff[4])))) { uVar1 = '\x01'; } else { uVar1 = '\0'; } return uVar1; } [1] https://www.claroty.com/team82/research/freeze-the-controlle... [2] https://www.danfoss.com/en-us/service-and-support/downloads/...

achillean

From 2017 through 2022 there was a large increase in the number of exposed refrigerators: https://trends.shodan.io/search?query=http.favicon.hash:-853... Over the past few years it has fluctuated but not the same continued growth as before. If you don't have a Shodan account you can see a chart on twitter: https://x.com/shodanhq/status/2110526116679021055

fhdkweig

This is either a dupe or a followup of https://news.ycombinator.com/item?id=50055304 from 8 days ago with 1007 comments

drillsteps5

To be fair, their entire threat model was likely "who TF would want to break in to change the settings on a thermostat on a fridge at a grocery store". A valid question which has yet to be answered (at least not publicly).

gz5

fridges are very reliable. but let's IoT them anyways so they can theoretically notify us if there is a problem. so of course that creates/enables the problem and doesn't notify us. deliciously ironic and rottingly sad. this case was egregious - built-in backdoor pw - but that is downstream of the decisions to IoT them and to default them to listen on the network.

NordStreamYacht

Backdoors on French fridges? I think they have a bigger problem right now with their front doors.

anonym29

List of legitimate reasons for a refrigerator, an oven, a stove, a washing or drying machine, a microwave, a coffee maker, a sink, a garbage disposal, a toilet, a shower or bathtub, or any other home appliance to be connected to the internet:

joshuat

I'm not one to draw causality, but this vulnerability seems to have had quite the effect on France

paustint

When looters smash the glass door, it's pretty obvious the vulnerability has been there for YEARS!

willvk

So this is the real reason they're rioting. I'd be pissed too.

l-mdev

suck it jian yang

Grimeton

>85% ran software with known security flaws. That includes 527 older controllers Danfoss no longer supports. Only 195 had every known fix. As long as the fridges are used the controller has to be supported. This isn't a raspberry pi $50 a pop...

theteapot

How did these fridges even get public IP addresses?

MiroslavPokorny

The real problem is devices like this should NOT be connected to the internet and at worst air gapped. Theres no reason including cost that a separate computer just for the fridges etc is not sitting in the office of the supermarket. Pretty sure the destoyed goods and close time cost far more than the extra cheapo computer.