Login
You're viewing the functional.cafe public feed.
  • Kevin BeaumontGossiTheDog@cyberplace.social
    Oct 12, 2026, 7:22 PM

    Also there’s loads of speculation about if it’s Russia, China, Iran.

    It’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.

    💬 6🔄 71⭐ 329

Replies

  • Kevin BeaumontGossiTheDog@cyberplace.social
    Oct 12, 2026, 7:27 PM

    You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.

    💬 8🔄 63⭐ 236
  • Kevin BeaumontGossiTheDog@cyberplace.social
    Oct 12, 2026, 8:18 PM

    LinkedIn’s absolutely awash with security vendors posting brain-dead takes on the fridge thing as they have no idea, at all, what they’re talking about. It’s great as it’s a list of people not to hire.

    You may be surprised to know the through line to the posts is.. AI. Remember when we had intelligence.

    Happy Party GIF by Justin
    💬 5🔄 54⭐ 239
  • 💬 3🔄 34⭐ 67
  • 💬 7🔄 51⭐ 111
  • Kevin BeaumontGossiTheDog@cyberplace.social
    Nov 2, 2026, 11:42 AM

    Danfoss are back in the news today over freezers defrosting in Europe again, e.g. in Sweden.

    In Sweden, loads of the devices are directly internet attached using 4G modems. I've confirmed the devices aren't patched and exposing management interface.

    Image attached toot
    💬 11🔄 75⭐ 102
  • Kevin BeaumontGossiTheDog@cyberplace.social
    Nov 2, 2026, 12:02 PM

    Example Shodan searches to show how bad orgs at in terms of exposing freezer management interfaces to internet and not patching:

    html:danfoss html:StoreView "2021"
    html:danfoss html:StoreView "2022"
    html:danfoss html:StoreView "2023"
    html:danfoss html:StoreView "2024"

    Riffing off the "Last modified" date, which gives indication of last patch date.

    💬 2🔄 20⭐ 70
  • Kevin BeaumontGossiTheDog@cyberplace.social
    Nov 2, 2026, 1:37 PM

    I've confirmed with folks the impacted freezers in the countries impacted today are all mgmt interface facing internet, same issue and vuln as last time.

    Many of the freezers are end of life and have no patch available, they've just been left online to quite literally rot.

    💬 9🔄 49⭐ 50
  • 💬 1🔄 5⭐ 0
  • Kevin BeaumontGossiTheDog@cyberplace.social
    Nov 13, 2026, 11:00 PM

    "It turns out that stack canaries and Position Independent Executable (PIE) are not enabled. These mechanisms have been staples of memory corruption defenses for decades.

    What's more worrying, is that multiple Danfoss business units (including Climate Solutions & Electronic Controllers) received IEC 62443-4-1 certification for Secure Product Development Lifecycle and this is prominently advertised as such."

    Image attached toot
    💬 3🔄 6⭐ 0
  • 💬 0🔄 0⭐ 18
  • 💬 0🔄 5⭐ 24
  • 💬 0🔄 0⭐ 7
  • 💬 1🔄 0⭐ 14
  • 💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Christoffer S.nopatience@swecyb.com
    Oct 12, 2026, 8:24 PM

    @GossiTheDog You mustn't forget that we really do need the hype around the AI-threat. I mean... how else are we going to sell products countering the very-soon-to-come onslaught of autonomous AI-agent attacks that, unless countered, will entirely enslave and make a botnet of all computers on the internet.

    💬 0🔄 1⭐ 12
  • Three plus or minus fiveThreeSigma@mastodon.online
    Oct 12, 2026, 10:05 PM

    @GossiTheDog
    I went to linkedIn to see if I had any in my timeline.

    This was a huge mistake. Looking at LinkedIn makes me want to vomit every time. (My timeline was all Nobel prize, CERN, and crap about robots.)

    💬 0🔄 1⭐ 14
  • 💬 0🔄 1⭐ 4
  • internetthoughtinternetthought@social.secret-wg.org
    Oct 13, 2026, 10:45 AM

    @GossiTheDog And then we have you... who doesn't know either why only certain "French" supermarkets were hit with this problem and other supermarkets of the same supermarket chains and users of Danfoss equipment around the world weren't hit with this problem. If there are so many exposed fridges, then why only hit the French ones? There is a good chance this had nothing to do with the Danfoss vulnerability and was a hack of a management system at a French fridge service company.

    💬 0🔄 0⭐ 0
  • ChrispyWchrispywhite@mastodon.world
    Oct 13, 2026, 12:26 PM

    @GossiTheDog what’re the odds that someone is looking for other, only slightly more complex, methods of compromise?

    💬 0🔄 1⭐ 1
  • aburka 🫣aburka@hachyderm.io
    Oct 13, 2026, 2:04 PM

    @GossiTheDog this is kind of funny but reminds me of the thing where we still take our shoes off at airport security. Like sure, you can prevent one particular incident from happening again but if you have to blast out a recommendation this specific then common sense has completely left the building

    💬 0🔄 0⭐ 7
  • John Ulrikujay68@mastodon.world
    Oct 13, 2026, 4:42 PM

    @GossiTheDog In a parallel universe: Authorities are forcing vendors of connected devices to be secure by default. And also liable if they aren’t.

    💬 1🔄 0⭐ 3
  • Benedek KozmaCyberbeni@mastodon.art
    Oct 13, 2026, 5:35 PM

    @ujay68 @GossiTheDog In the current universe: Authorities are forcing residential PV systems to be connected to foreign cloud (so they can sell the green credit even after the locally consumed electricity) even though the modbus register documentation is publicly available from most manufacturers. 😬

    💬 0🔄 0⭐ 1
  • Tormodairwhale@beige.party
    Oct 13, 2026, 4:50 PM

    @GossiTheDog

    Yesterday, it was HVAC control systems for two malls here in Sweden. Why does this keep happening? (Rhetorical.)

    💬 0🔄 0⭐ 3
  • 💬 0🔄 0⭐ 3
  • 💬 0🔄 1⭐ 4
  • 💬 0🔄 0⭐ 4
  • 💬 0🔄 0⭐ 6
  • 💬 0🔄 0⭐ 4
  • 💬 0🔄 0⭐ 3
  • 💬 0🔄 0⭐ 0
  • Piranhallamasecuredllama@infosec.exchange
    Nov 2, 2026, 1:59 PM

    @GossiTheDog

    Edit: see below, not the case here.

    I'm only adding this for information as a fridge person, which I've said before.

    The refrigeration system and its controls are not directly internet connected or required to be. The controllers affected use ModBus communication protocol, usually 485 flavour, to connect to computers running SCADA. This allows operators to change parameters, such as setpoint (temperature in the fridge), remotely and has many valid uses. This is how most industrial systems are run.

    The problem is that the computers running the software are often connected to the internet. When an attacker gains access to the computer, they also gain access to the SCADA to communicate with the refrigeration controls exactly as designed.

    Just as using SCADA to control refrigeration equipment is convenient, so is remote access so you do not have to physically get to the computer (connected by physical cables to the fridge controls) to make changes should they be needed. I would, and have recommended to industry in the past, isolate such computers from the internet entirely.

    When you lose food at this stage of the supply chain, all the embedded carbon goes with it so it's a much bigger disaster than a large corporation losing a few grands worth of stock.

    💬 0🔄 1⭐ 1
  • 💬 1🔄 0⭐ 2
  • OverSoftOverSoft@infosec.exchange
    Nov 2, 2026, 2:49 PM

    @dani @GossiTheDog

    Although I don't follow the "the mass-media are all lying" narrative that a lot of the uninformed Facebook lovers do, I have learned in the past 10 years that the media is uninformed in a LOT of things.

    I used to take their word for news items, but since they started reporting on cyber incidents (such as the PHP issue a few weeks ago or now this) I KNOW that they're just spewing guesses and have zero actual insight in the issues at hand.

    They speculate and the people they invoke as being the "experts in their field" are often just other journalists that have been put in a certain box. Heck, the "cyber security correspondent" for the BBC literally didn't know what PHP was.

    Today, they're all going deep down the rabbit hole of "it was Russia" on this issue when clearly, it's just badly secured IoT devices that nearly anyone with a laptop can access and control. There's ZERO proof for any Russian involvement, it could just as easily be a 13 year old kid that was browsing Shodan and thought: "ha, this will be funny".

    Btw, if you try and comment on these articles, your reply either doesn't get posted at all or it gets removed very quickly. Apparently they don't like you calling them out on these things...

    💬 0🔄 1⭐ 1
  • Hopeless Noosphere Situation Goblin :catte: :asexual_flag:cyberquixote@infosec.exchange
    Nov 2, 2026, 3:32 PM

    @OverSoft @dani @GossiTheDog

    Always has been about information control and manipulation. We should of been doing more checks instead of just trusting, and bad actors know this.

    They may not be right out lying but many who are large enough use their power and influence to get the benefit of maximum value extraction, at the end of the day their contribution to the overall public good is debatable, not assured.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Dianealienghic@timeloop.cafe
    Nov 2, 2026, 3:28 PM

    @GossiTheDog this sounds like a job for EU regulators to step in and force the vendor to release some kind of fix.

    💬 3🔄 0⭐ 1
  • M Schommermusevg@23.social
    Nov 2, 2026, 3:56 PM

    @alienghic @GossiTheDog
    EU regulators: Younglings under the age of 16 are no longer allowed to buy frozen foods (including ice cream). Everybody else is required to scan their ID when opening freezers in supermarkets.
    #DystopEU

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Random Sapiensrandom_sapiens@mastodon-belgium.be
    Nov 2, 2026, 4:41 PM

    @alienghic @GossiTheDog it is also and foremost the responsibility of these supermarket chains, the companies affected today are multinationals listed on the stockmarkets so they cannot say they don't have the means (the store managers can say they don't have the knowledge, this is not a store manager's job)

    💬 0🔄 0⭐ 0
  • M Schommermusevg@23.social
    Nov 2, 2026, 5:17 PM

    @alienghic @GossiTheDog
    By the way: This regulation does already exist. It's called #CRA, Cyber Resilience Act.
    Unfortunately it does not regulate existing/brownfield installations, only new sales.

    💬 0🔄 0⭐ 0
  • Dan :tux:WastelandWandrr@freeradical.zone
    Nov 2, 2026, 5:45 PM

    @GossiTheDog Having to log in to the manufacturer's website for anything is just so shit, I got so much stuff I don't use for this very reason (seemed like a good idea at the time), and I'm not too keen on passing that to some poor soul.
    I may some day make videos about how to reuse those devices (like D-Link or Blink cameras).

    💬 0🔄 0⭐ 0
  • Flakiflaki@flaki.social
    Nov 2, 2026, 8:34 PM

    @GossiTheDog according to some of the reporting I read ( news.err.ee/1610183296/hackers) this seems to be opportunistic attack targetting systems for which replacement has been ordered but left exposed/operating until it arrives (perhaps in hopes that noone will find them?).

    At least in some cases (e.g. here in Estonia) people have been at least keeping an eye on the vulnerable machines and caught the tampering just minutes after, so there were no actual loss of produce.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Tom SheppardTom@social.twsheppard.com
    Nov 14, 2026, 12:58 AM

    @GossiTheDog Decades is right. I used canaries for stacks and memory blocks back in the ‘70’s when I first started programming in assembler. Never triggered one though, fortunately.

    💬 0🔄 0⭐ 0
  • wall-ewall_e@ioc.exchange
    Nov 14, 2026, 8:15 AM

    @GossiTheDog this will never change as long as certification bodies aren't liable for the shit they're rubber stamping

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 3
  • lbcp 🦖 :opensuse:lbcp@social.linux.pizza
    Nov 2, 2026, 12:08 PM

    @GossiTheDog "Hey Boss, have you heard that a couple of freezers defrosted in France due to a cyber attack?"

    "Yeah, heard about it. It's actually the same models we use in our supermarkets. I am glad Sweden is not France."

    "But should we do anything about it?"

    'I said, Sweden is not France!"

    💬 0🔄 6⭐ 23
  • Dave 🐶Cyberoutsider@infosec.exchange
    Nov 2, 2026, 12:33 PM

    @GossiTheDog Is this why the UK government are warming us all to stockpile food?

    Just in case the freezers at the local Tescos goes tits-up and there's a shortage of frozen pizzas?

    💬 0🔄 0⭐ 0
  • 💬 0🔄 11⭐ 21
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • BeachbumBeachbum@mastodon.sdf.org
    Nov 3, 2026, 3:22 AM

    @GossiTheDog What’s everybody going do about all the vehicles that they could stop on the railroad tracks?
    What’s the reason I don’t buy a new car.

    💬 0🔄 0⭐ 1
  • 💬 0🔄 0⭐ 2
  • Ben Gillam :awesome:bengillam@mastodon.social
    Oct 15, 2026, 8:32 PM

    @cdlhamma @GossiTheDog What gets me about this “hack” have they never heard of VPNs?

    You would hope in 2026 nobody is working in IT that thinks surfacing anything especially critical to the entire web is a good idea much less that they would work for a major retailer 🤦‍♂️

    💬 0🔄 1⭐ 2
  • 💬 0🔄 0⭐ 2