You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
LinkedIn’s absolutely awash with security vendors posting brain-dead takes on the fridge thing as they have no idea, at all, what they’re talking about. It’s great as it’s a list of people not to hire.
You may be surprised to know the through line to the posts is.. AI. Remember when we had intelligence.
The manufacturer has confirmed this was caused by unpatched systems being internet-facing. The French government CERT has also issued an advisory saying the same. The patch in question removed the date-based backdoor password. https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-012/
German authorities are reminding orgs not to directly connect food cooling solutions to the Internet. https://www.allianz-fuer-cybersicherheit.de/SharedDocs/Downloads/Webs/ACS/DE/BSI-CS/BSI-CS_154.html
Danfoss are back in the news today over freezers defrosting in Europe again, e.g. in Sweden.
In Sweden, loads of the devices are directly internet attached using 4G modems. I've confirmed the devices aren't patched and exposing management interface.
Example Shodan searches to show how bad orgs at in terms of exposing freezer management interfaces to internet and not patching:
html:danfoss html:StoreView "2021"
html:danfoss html:StoreView "2022"
html:danfoss html:StoreView "2023"
html:danfoss html:StoreView "2024"
Riffing off the "Last modified" date, which gives indication of last patch date.
I've confirmed with folks the impacted freezers in the countries impacted today are all mgmt interface facing internet, same issue and vuln as last time.
Many of the freezers are end of life and have no patch available, they've just been left online to quite literally rot.
Got a feeling the Danfoss freezer thing is going to kick back off at some point.
This blog has a look at the firmware on well used devices and immediate finds new vulns, including with latest updates. Including preauth RCE.
https://www.midnightblue.nl/blog/multiple-rce-danfoss-aksm800a
Thankfully they withheld technical details. Lots of these freezers have still been left directly online.
"It turns out that stack canaries and Position Independent Executable (PIE) are not enabled. These mechanisms have been staples of memory corruption defenses for decades.
What's more worrying, is that multiple Danfoss business units (including Climate Solutions & Electronic Controllers) received IEC 62443-4-1 certification for Secure Product Development Lifecycle and this is prominently advertised as such."
@GossiTheDog that ... gives "internet of shite" a whole new meaning.
@GossiTheDog And... that is why your toilet seat is cleaner than your keyboard or mobile phone 🤣 😎
The jobs not finished until you do the paper work! 😉🤷♂️
Oct 13, 2026, 7:27 AMDon't forget to wash your hands afterwards! 😬
Yes Dad! 😔
@GossiTheDog You mustn't forget that we really do need the hype around the AI-threat. I mean... how else are we going to sell products countering the very-soon-to-come onslaught of autonomous AI-agent attacks that, unless countered, will entirely enslave and make a botnet of all computers on the internet.
@GossiTheDog
I went to linkedIn to see if I had any in my timeline.
This was a huge mistake. Looking at LinkedIn makes me want to vomit every time. (My timeline was all Nobel prize, CERN, and crap about robots.)
@GossiTheDog I'm a big fan of AI*
*) "actual intelligence"
@GossiTheDog And then we have you... who doesn't know either why only certain "French" supermarkets were hit with this problem and other supermarkets of the same supermarket chains and users of Danfoss equipment around the world weren't hit with this problem. If there are so many exposed fridges, then why only hit the French ones? There is a good chance this had nothing to do with the Danfoss vulnerability and was a hack of a management system at a French fridge service company.
@GossiTheDog what’re the odds that someone is looking for other, only slightly more complex, methods of compromise?
@GossiTheDog this is kind of funny but reminds me of the thing where we still take our shoes off at airport security. Like sure, you can prevent one particular incident from happening again but if you have to blast out a recommendation this specific then common sense has completely left the building
@GossiTheDog In a parallel universe: Authorities are forcing vendors of connected devices to be secure by default. And also liable if they aren’t.
@ujay68 @GossiTheDog In the current universe: Authorities are forcing residential PV systems to be connected to foreign cloud (so they can sell the green credit even after the locally consumed electricity) even though the modbus register documentation is publicly available from most manufacturers. 😬
Yesterday, it was HVAC control systems for two malls here in Sweden. Why does this keep happening? (Rhetorical.)
Oct 13, 2026, 4:50 PM@GossiTheDog ... or anything else that isn't a halfway decent firewall, I might add.
@GossiTheDog JFC 🤦
@GossiTheDog oh great, so we learned nothing. Checks out
Nov 2, 2026, 11:49 AM@GossiTheDog How do the even get 4G service that's not behind CGNAT?
Security? What is security?🤦
Can you spell it for me?
...
Nevere heard about it!
@GossiTheDog Note: none of the stores affected in Sweden used the store chain's internal network to connect their equipment.
Edit: see below, not the case here.
I'm only adding this for information as a fridge person, which I've said before.
The refrigeration system and its controls are not directly internet connected or required to be. The controllers affected use ModBus communication protocol, usually 485 flavour, to connect to computers running SCADA. This allows operators to change parameters, such as setpoint (temperature in the fridge), remotely and has many valid uses. This is how most industrial systems are run.
The problem is that the computers running the software are often connected to the internet. When an attacker gains access to the computer, they also gain access to the SCADA to communicate with the refrigeration controls exactly as designed.
Just as using SCADA to control refrigeration equipment is convenient, so is remote access so you do not have to physically get to the computer (connected by physical cables to the fridge controls) to make changes should they be needed. I would, and have recommended to industry in the past, isolate such computers from the internet entirely.
When you lose food at this stage of the supply chain, all the embedded carbon goes with it so it's a much bigger disaster than a large corporation losing a few grands worth of stock.
@GossiTheDog Funnily enough, the media are still reporting it as a cyberattack, even though access is wide open to any script kiddie.
Although I don't follow the "the mass-media are all lying" narrative that a lot of the uninformed Facebook lovers do, I have learned in the past 10 years that the media is uninformed in a LOT of things.
I used to take their word for news items, but since they started reporting on cyber incidents (such as the PHP issue a few weeks ago or now this) I KNOW that they're just spewing guesses and have zero actual insight in the issues at hand.
They speculate and the people they invoke as being the "experts in their field" are often just other journalists that have been put in a certain box. Heck, the "cyber security correspondent" for the BBC literally didn't know what PHP was.
Today, they're all going deep down the rabbit hole of "it was Russia" on this issue when clearly, it's just badly secured IoT devices that nearly anyone with a laptop can access and control. There's ZERO proof for any Russian involvement, it could just as easily be a 13 year old kid that was browsing Shodan and thought: "ha, this will be funny".
Btw, if you try and comment on these articles, your reply either doesn't get posted at all or it gets removed very quickly. Apparently they don't like you calling them out on these things...
Nov 2, 2026, 3:32 PMAlways has been about information control and manipulation. We should of been doing more checks instead of just trusting, and bad actors know this.
They may not be right out lying but many who are large enough use their power and influence to get the benefit of maximum value extraction, at the end of the day their contribution to the overall public good is debatable, not assured.
Well the contents won't be very fresh in a short while. Even if the firmware isn't 🙁
@GossiTheDog this sounds like a job for EU regulators to step in and force the vendor to release some kind of fix.
@alienghic @GossiTheDog
EU regulators: Younglings under the age of 16 are no longer allowed to buy frozen foods (including ice cream). Everybody else is required to scan their ID when opening freezers in supermarkets.
#DystopEU
I suspect a patch that makes the refrigerator's WebUI read only would be easier for everyone involved.
@alienghic @GossiTheDog
But the childreeeen1!11
@alienghic @GossiTheDog it is also and foremost the responsibility of these supermarket chains, the companies affected today are multinationals listed on the stockmarkets so they cannot say they don't have the means (the store managers can say they don't have the knowledge, this is not a store manager's job)
@alienghic @GossiTheDog
By the way: This regulation does already exist. It's called #CRA, Cyber Resilience Act.
Unfortunately it does not regulate existing/brownfield installations, only new sales.
@GossiTheDog Having to log in to the manufacturer's website for anything is just so shit, I got so much stuff I don't use for this very reason (seemed like a good idea at the time), and I'm not too keen on passing that to some poor soul.
I may some day make videos about how to reuse those devices (like D-Link or Blink cameras).
@GossiTheDog according to some of the reporting I read ( https://news.err.ee/1610183296/hackers-raised-freezer-temperature-at-selver-supermarket-to-50-c) this seems to be opportunistic attack targetting systems for which replacement has been ordered but left exposed/operating until it arrives (perhaps in hopes that noone will find them?).
At least in some cases (e.g. here in Estonia) people have been at least keeping an eye on the vulnerable machines and caught the tampering just minutes after, so there were no actual loss of produce.
@GossiTheDog left to rot like the food in them is now? ;)
@GossiTheDog they’re just learning from the security product vendors
Nov 14, 2026, 12:58 AM@GossiTheDog Decades is right. I used canaries for stacks and memory blocks back in the ‘70’s when I first started programming in assembler. Never triggered one though, fortunately.
@GossiTheDog this will never change as long as certification bodies aren't liable for the shit they're rubber stamping
@GossiTheDog have you seen VNC Resolver tho. so many controls just waiting to be abused.
@GossiTheDog Belgium and Luxemburg too
Nov 2, 2026, 12:08 PM@GossiTheDog "Hey Boss, have you heard that a couple of freezers defrosted in France due to a cyber attack?"
"Yeah, heard about it. It's actually the same models we use in our supermarkets. I am glad Sweden is not France."
"But should we do anything about it?"
'I said, Sweden is not France!"
@GossiTheDog Is this why the UK government are warming us all to stockpile food?
Just in case the freezers at the local Tescos goes tits-up and there's a shortage of frozen pizzas?
@GossiTheDog This seems appropriate
@GossiTheDog On Als people don't lock their front doors. Apparently.
Nov 2, 2026, 5:44 PM@GossiTheDog Please, my friend, we want to buy a shelter for my family to protect us from the rain and cold. The price of a tent here is $700, so please give me money to buy this tent.https://chuffed.org/project/208485-give-waleeds-family-a-chance-to-live
@GossiTheDog What’s everybody going do about all the vehicles that they could stop on the railroad tracks?
What’s the reason I don’t buy a new car.
Oct 13, 2026, 3:13 PM@GossiTheDog so is the password… password now? 🤣
@cdlhamma @GossiTheDog What gets me about this “hack” have they never heard of VPNs?
You would hope in 2026 nobody is working in IT that thinks surfacing anything especially critical to the entire web is a good idea much less that they would work for a major retailer 🤦♂️
Oct 12, 2026, 9:02 PM@GossiTheDog « and I’m not constipated »
@GossiTheDog one handed, on your phone 😉
