Shodan search: html:danfoss product:"nginx"
The supermarket impacted today in France put all of their devices directly internet facing and all had the same password, today’s date.
https://beta.shodan.io/search?query=html%3Adanfoss+product%3A%22nginx%22
To bypass login send a POST request to /xml.cgi, there’s a write up here: https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
I’ve seen some breathless reporting in the media about the situation in France saying it’s the biggest cyber attack ever and the result of a swarm of Agentic AI bots.
Reality: no. It’s a complete lack of security controls and negligent product development by the vendor.
Also there’s loads of speculation about if it’s Russia, China, Iran.
It’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.
You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
LinkedIn’s absolutely awash with security vendors posting brain-dead takes on the fridge thing as they have no idea, at all, what they’re talking about. It’s great as it’s a list of people not to hire.
You may be surprised to know the through line to the posts is.. AI. Remember when we had intelligence.
The manufacturer has confirmed this was caused by unpatched systems being internet-facing. The French government CERT has also issued an advisory saying the same. The patch in question removed the date-based backdoor password. https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-012/
German authorities are reminding orgs not to directly connect food cooling solutions to the Internet. https://www.allianz-fuer-cybersicherheit.de/SharedDocs/Downloads/Webs/ACS/DE/BSI-CS/BSI-CS_154.html
Danfoss are back in the news today over freezers defrosting in Europe again, e.g. in Sweden.
In Sweden, loads of the devices are directly internet attached using 4G modems. I've confirmed the devices aren't patched and exposing management interface.
Example Shodan searches to show how bad orgs at in terms of exposing freezer management interfaces to internet and not patching:
html:danfoss html:StoreView "2021"
html:danfoss html:StoreView "2022"
html:danfoss html:StoreView "2023"
html:danfoss html:StoreView "2024"
Riffing off the "Last modified" date, which gives indication of last patch date.
I've confirmed with folks the impacted freezers in the countries impacted today are all mgmt interface facing internet, same issue and vuln as last time.
Many of the freezers are end of life and have no patch available, they've just been left online to quite literally rot.
Got a feeling the Danfoss freezer thing is going to kick back off at some point.
This blog has a look at the firmware on well used devices and immediate finds new vulns, including with latest updates. Including preauth RCE.
https://www.midnightblue.nl/blog/multiple-rce-danfoss-aksm800a
Thankfully they withheld technical details. Lots of these freezers have still been left directly online.
"It turns out that stack canaries and Position Independent Executable (PIE) are not enabled. These mechanisms have been staples of memory corruption defenses for decades.
What's more worrying, is that multiple Danfoss business units (including Climate Solutions & Electronic Controllers) received IEC 62443-4-1 certification for Secure Product Development Lifecycle and this is prominently advertised as such."
@GossiTheDog I mean, also some "credit" to people who thought connecting fridges to the internet was a good idea.
Oct 12, 2026, 11:07 PM
But... but... there's always someone in a supermarket! It's not like having a manager, who's already there, doing temperature checks a few times a day will cost much.
Sigh.
And if it's for monitoring when the shop is closed, it could be read only!
When it's set for the required temperature, no one needs to change it, unless you change the stuff inside it, which is a big operation in itself and doesn't happen often.
Even the productivity reason doesn't hold.
@Lily_and_frog @Aedius @bremner @GossiTheDog
Its mostly for maintenance people to do remote troubleshooting and optimisation. Thats hours of driving at least, and more if specialized service technicians are at supplier headquarters abroad.
A lot of equipment nowadays has such functions, quite often with a phone modem directly in the machine. Yes its a security risk, but also extremely useful
@Zamfr @Aedius @bremner @GossiTheDog
It's a fridge. It doesn't need optimisation. It can run for 20 years before the hardware breaks.
@Lily_and_frog
As someone who spent half his adult life working in the service industry... No one is manually checking those fridge temperatures, ever. Doesn't matter if it's the soda cooler in a shop's impulse buy gauntlet, or a meat storage walk-in.
The only person who looks at the thermometers is the health inspector, right before they hand you a violation notice because your prep fridge's condenser has had it's airflow so choked with dust buildup that it's been unable to get the temperature below 55° F despite the compressor running non-stop for months.
@Lily_and_frog @Aedius @bremner @GossiTheDog
Its typically a few chillers on the roof (with their conpressors), some distribution pipes and valves, a series of cold units with their individual temp control units, some logging and alarms, a little network between them.
Its not crazy difficult and usually keeps working but there is enough that sometimes something breaks, or a setting goes wrong, etc.
@Lily_and_frog @Aedius @bremner @GossiTheDog its then very useful if a manager can pick up the phone, and someone looks at it remotely, identify the problem, perhaps fix it, or directly send maintenance with the right replacement components.
Quite often, that works even without the manager having to pick up the phone.
It means stuff gets fixed quicker, than if you first have to wait for someone to do diagnosis
@Aedius @bremner @GossiTheDog until it goes wrong and spoils millions of $ in food that is
@kcpoole @Aedius @bremner @GossiTheDog
It didn't go wrong.
It worked as designed.
The design was insane, but worked perfectly.
@bremner From my days working with SCADA, many of the operators assume nobody would be interested in their pump station/substation/HVAC/etc. @GossiTheDog
@GossiTheDog that ... gives "internet of shite" a whole new meaning.
@GossiTheDog And... that is why your toilet seat is cleaner than your keyboard or mobile phone 🤣 😎
The jobs not finished until you do the paper work! 😉🤷♂️
Oct 13, 2026, 7:27 AMDon't forget to wash your hands afterwards! 😬
Yes Dad! 😔
@GossiTheDog You mustn't forget that we really do need the hype around the AI-threat. I mean... how else are we going to sell products countering the very-soon-to-come onslaught of autonomous AI-agent attacks that, unless countered, will entirely enslave and make a botnet of all computers on the internet.
@GossiTheDog
I went to linkedIn to see if I had any in my timeline.
This was a huge mistake. Looking at LinkedIn makes me want to vomit every time. (My timeline was all Nobel prize, CERN, and crap about robots.)
@GossiTheDog I'm a big fan of AI*
*) "actual intelligence"
@GossiTheDog And then we have you... who doesn't know either why only certain "French" supermarkets were hit with this problem and other supermarkets of the same supermarket chains and users of Danfoss equipment around the world weren't hit with this problem. If there are so many exposed fridges, then why only hit the French ones? There is a good chance this had nothing to do with the Danfoss vulnerability and was a hack of a management system at a French fridge service company.
@GossiTheDog what’re the odds that someone is looking for other, only slightly more complex, methods of compromise?
@GossiTheDog this is kind of funny but reminds me of the thing where we still take our shoes off at airport security. Like sure, you can prevent one particular incident from happening again but if you have to blast out a recommendation this specific then common sense has completely left the building
@GossiTheDog In a parallel universe: Authorities are forcing vendors of connected devices to be secure by default. And also liable if they aren’t.
@ujay68 @GossiTheDog In the current universe: Authorities are forcing residential PV systems to be connected to foreign cloud (so they can sell the green credit even after the locally consumed electricity) even though the modbus register documentation is publicly available from most manufacturers. 😬
Yesterday, it was HVAC control systems for two malls here in Sweden. Why does this keep happening? (Rhetorical.)
Oct 13, 2026, 4:50 PM@GossiTheDog ... or anything else that isn't a halfway decent firewall, I might add.
@GossiTheDog JFC 🤦
@GossiTheDog oh great, so we learned nothing. Checks out
Nov 2, 2026, 11:49 AM@GossiTheDog How do the even get 4G service that's not behind CGNAT?
Security? What is security?🤦
Can you spell it for me?
...
Nevere heard about it!
@GossiTheDog Note: none of the stores affected in Sweden used the store chain's internal network to connect their equipment.
Edit: see below, not the case here.
I'm only adding this for information as a fridge person, which I've said before.
The refrigeration system and its controls are not directly internet connected or required to be. The controllers affected use ModBus communication protocol, usually 485 flavour, to connect to computers running SCADA. This allows operators to change parameters, such as setpoint (temperature in the fridge), remotely and has many valid uses. This is how most industrial systems are run.
The problem is that the computers running the software are often connected to the internet. When an attacker gains access to the computer, they also gain access to the SCADA to communicate with the refrigeration controls exactly as designed.
Just as using SCADA to control refrigeration equipment is convenient, so is remote access so you do not have to physically get to the computer (connected by physical cables to the fridge controls) to make changes should they be needed. I would, and have recommended to industry in the past, isolate such computers from the internet entirely.
When you lose food at this stage of the supply chain, all the embedded carbon goes with it so it's a much bigger disaster than a large corporation losing a few grands worth of stock.
@GossiTheDog Funnily enough, the media are still reporting it as a cyberattack, even though access is wide open to any script kiddie.
Although I don't follow the "the mass-media are all lying" narrative that a lot of the uninformed Facebook lovers do, I have learned in the past 10 years that the media is uninformed in a LOT of things.
I used to take their word for news items, but since they started reporting on cyber incidents (such as the PHP issue a few weeks ago or now this) I KNOW that they're just spewing guesses and have zero actual insight in the issues at hand.
They speculate and the people they invoke as being the "experts in their field" are often just other journalists that have been put in a certain box. Heck, the "cyber security correspondent" for the BBC literally didn't know what PHP was.
Today, they're all going deep down the rabbit hole of "it was Russia" on this issue when clearly, it's just badly secured IoT devices that nearly anyone with a laptop can access and control. There's ZERO proof for any Russian involvement, it could just as easily be a 13 year old kid that was browsing Shodan and thought: "ha, this will be funny".
Btw, if you try and comment on these articles, your reply either doesn't get posted at all or it gets removed very quickly. Apparently they don't like you calling them out on these things...
Nov 2, 2026, 3:32 PMAlways has been about information control and manipulation. We should of been doing more checks instead of just trusting, and bad actors know this.
They may not be right out lying but many who are large enough use their power and influence to get the benefit of maximum value extraction, at the end of the day their contribution to the overall public good is debatable, not assured.
Well the contents won't be very fresh in a short while. Even if the firmware isn't 🙁
@GossiTheDog this sounds like a job for EU regulators to step in and force the vendor to release some kind of fix.
@alienghic @GossiTheDog
EU regulators: Younglings under the age of 16 are no longer allowed to buy frozen foods (including ice cream). Everybody else is required to scan their ID when opening freezers in supermarkets.
#DystopEU
I suspect a patch that makes the refrigerator's WebUI read only would be easier for everyone involved.
@alienghic @GossiTheDog
But the childreeeen1!11
@alienghic @GossiTheDog it is also and foremost the responsibility of these supermarket chains, the companies affected today are multinationals listed on the stockmarkets so they cannot say they don't have the means (the store managers can say they don't have the knowledge, this is not a store manager's job)
@alienghic @GossiTheDog
By the way: This regulation does already exist. It's called #CRA, Cyber Resilience Act.
Unfortunately it does not regulate existing/brownfield installations, only new sales.
@GossiTheDog Having to log in to the manufacturer's website for anything is just so shit, I got so much stuff I don't use for this very reason (seemed like a good idea at the time), and I'm not too keen on passing that to some poor soul.
I may some day make videos about how to reuse those devices (like D-Link or Blink cameras).
@GossiTheDog according to some of the reporting I read ( https://news.err.ee/1610183296/hackers-raised-freezer-temperature-at-selver-supermarket-to-50-c) this seems to be opportunistic attack targetting systems for which replacement has been ordered but left exposed/operating until it arrives (perhaps in hopes that noone will find them?).
At least in some cases (e.g. here in Estonia) people have been at least keeping an eye on the vulnerable machines and caught the tampering just minutes after, so there were no actual loss of produce.
@GossiTheDog left to rot like the food in them is now? ;)
