Nov 4, 2026, 8:38 AMNot really surprising at all, given the state of the embedded market, but turns out that the Danfoss freezer control systems that got hacked are Linux based. You can build insecure infrastructure on top of any OS of your choosing. The entire industry needs a reckoning.
Nov 4, 2026, 10:13 AMShodan still shows a shitload of these devices directly connected to the public internet, so attackers can hit them without needing to bounce through anything else first. Some of them are connected to cellular networks, so there's no level of local network security policy that'll save them. A whole bunch of poor decisions bringing us to this place.
@mjg59 fifteen years of shodan safaris failed to convince anyone except the attackers
@mjg59 are they being actively cracked into or is it a "standard" case of default or bad credentials to an unprotected management interface? I do not follow technical news but from the generalist press news it seemed the latter.
Nov 4, 2026, 8:46 AM@palin The credentials rotated every day according to a predictable algorithm, so there's some degree of active cracking
@palin @mjg59 There's details of the vulnerability here: https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
If you set an additional parameter on the web interface login form, you could log in with a password derived from the current day, irrespective of how the owner had configured the device. It's essentially a back door created by the manufacturer, presumably intended for use by their support technicians.
Nov 4, 2026, 9:22 AM@palin @mjg59 I guess it depends on how you define "OS". It's software that is preinstalled on the device, is central to the functionality of the device, and is upgraded as part of the firmware.
So while it isn't a kernel vulnerability, I'd probably still class it as an operating system vulnerability for the device.
Nov 4, 2026, 11:45 AM
Nov 4, 2026, 9:13 AM@mjg59 I did wonder that with their 'danux' download.
Nov 4, 2026, 9:15 AM@mjg59 TBF they did deprecate the password based interface 18 months ago. Nobody updated.
Then there was a massive breach last month. Nobody updated.
Guess what will happen this time..
@mjg59 I suspect it will take some extraordinarily catastrophic event followed by govt regulation, if there is a govt left, or anything to regulate.
Nov 4, 2026, 9:45 AM@xjamesmorris We're now at the point where it is very cheap to point a model at a firmware image and have it give you the entry points. The overwhelming majority of the embedded industry is not ready for this in the slightest, and it's going to take years to get from where we are to where we should be. I agree it's unlikely to happen without regulation, and I fear we're too late to get that out there without a lot of damage happening first.
@mjg59 yes, especially with something like Raptor, which knows which tools to use for what and is quite happy to keep trying different approaches. In one instance, I was able to determine it would cost about $30 per 'exploitation' of a set of findings in a mature, security-critical body of code. That's not an exploit in common terms, but a working proof of a single bug in isolation. Note: I'm not an expert in this area, just using/building tooling to check my own work, so YMMV.
@mjg59 In terms of regulation, I'm thinking in terms of what it took to regulate automotive safety, but imagine ten thousand vehicles crashing at the same instant every few seconds worldwide.
@mjg59 @xjamesmorris NIS2 (for users) and CRA (for makers) are supposedly a step in that direction…
@mjg59 an IT manager from retail I worked with used to say “we buy IT like we buy peas”
@mjg59 Even on mobile, there are providers that can isolate your traffic (I think A&A have an option for that).
@mjg59 Given the attack on French blood banks this weekend, I really hope there will be a change in practices and a better security around it.
@mjg59 Not sure why whether it was on Linux or anything else even came into the discussion. Yeah, you can build an insecure infrastructure on literally anything. If the software being run itself is the issue, the OS can't do much about it.
If anyone assumes a thing being on Linux (or MacOS, or anything else for that matter) is automatically secure, they have a very very dangerous mindset that is not ok.