Example Shodan searches to show how bad orgs at in terms of exposing freezer management interfaces to internet and not patching:
html:danfoss html:StoreView "2021"
html:danfoss html:StoreView "2022"
html:danfoss html:StoreView "2023"
html:danfoss html:StoreView "2024"
Riffing off the "Last modified" date, which gives indication of last patch date.
I've confirmed with folks the impacted freezers in the countries impacted today are all mgmt interface facing internet, same issue and vuln as last time.
Many of the freezers are end of life and have no patch available, they've just been left online to quite literally rot.
Got a feeling the Danfoss freezer thing is going to kick back off at some point.
This blog has a look at the firmware on well used devices and immediate finds new vulns, including with latest updates. Including preauth RCE.
https://www.midnightblue.nl/blog/multiple-rce-danfoss-aksm800a
Thankfully they withheld technical details. Lots of these freezers have still been left directly online.
"It turns out that stack canaries and Position Independent Executable (PIE) are not enabled. These mechanisms have been staples of memory corruption defenses for decades.
What's more worrying, is that multiple Danfoss business units (including Climate Solutions & Electronic Controllers) received IEC 62443-4-1 certification for Secure Product Development Lifecycle and this is prominently advertised as such."
@GossiTheDog Note: none of the stores affected in Sweden used the store chain's internal network to connect their equipment.
Edit: see below, not the case here.
I'm only adding this for information as a fridge person, which I've said before.
The refrigeration system and its controls are not directly internet connected or required to be. The controllers affected use ModBus communication protocol, usually 485 flavour, to connect to computers running SCADA. This allows operators to change parameters, such as setpoint (temperature in the fridge), remotely and has many valid uses. This is how most industrial systems are run.
The problem is that the computers running the software are often connected to the internet. When an attacker gains access to the computer, they also gain access to the SCADA to communicate with the refrigeration controls exactly as designed.
Just as using SCADA to control refrigeration equipment is convenient, so is remote access so you do not have to physically get to the computer (connected by physical cables to the fridge controls) to make changes should they be needed. I would, and have recommended to industry in the past, isolate such computers from the internet entirely.
When you lose food at this stage of the supply chain, all the embedded carbon goes with it so it's a much bigger disaster than a large corporation losing a few grands worth of stock.
@GossiTheDog Funnily enough, the media are still reporting it as a cyberattack, even though access is wide open to any script kiddie.
Although I don't follow the "the mass-media are all lying" narrative that a lot of the uninformed Facebook lovers do, I have learned in the past 10 years that the media is uninformed in a LOT of things.
I used to take their word for news items, but since they started reporting on cyber incidents (such as the PHP issue a few weeks ago or now this) I KNOW that they're just spewing guesses and have zero actual insight in the issues at hand.
They speculate and the people they invoke as being the "experts in their field" are often just other journalists that have been put in a certain box. Heck, the "cyber security correspondent" for the BBC literally didn't know what PHP was.
Today, they're all going deep down the rabbit hole of "it was Russia" on this issue when clearly, it's just badly secured IoT devices that nearly anyone with a laptop can access and control. There's ZERO proof for any Russian involvement, it could just as easily be a 13 year old kid that was browsing Shodan and thought: "ha, this will be funny".
Btw, if you try and comment on these articles, your reply either doesn't get posted at all or it gets removed very quickly. Apparently they don't like you calling them out on these things...
Nov 2, 2026, 3:32 PMAlways has been about information control and manipulation. We should of been doing more checks instead of just trusting, and bad actors know this.
They may not be right out lying but many who are large enough use their power and influence to get the benefit of maximum value extraction, at the end of the day their contribution to the overall public good is debatable, not assured.
Well the contents won't be very fresh in a short while. Even if the firmware isn't 🙁
@GossiTheDog this sounds like a job for EU regulators to step in and force the vendor to release some kind of fix.
@alienghic @GossiTheDog
EU regulators: Younglings under the age of 16 are no longer allowed to buy frozen foods (including ice cream). Everybody else is required to scan their ID when opening freezers in supermarkets.
#DystopEU
I suspect a patch that makes the refrigerator's WebUI read only would be easier for everyone involved.
@alienghic @GossiTheDog
But the childreeeen1!11
@alienghic @GossiTheDog it is also and foremost the responsibility of these supermarket chains, the companies affected today are multinationals listed on the stockmarkets so they cannot say they don't have the means (the store managers can say they don't have the knowledge, this is not a store manager's job)
@alienghic @GossiTheDog
By the way: This regulation does already exist. It's called #CRA, Cyber Resilience Act.
Unfortunately it does not regulate existing/brownfield installations, only new sales.
@GossiTheDog Having to log in to the manufacturer's website for anything is just so shit, I got so much stuff I don't use for this very reason (seemed like a good idea at the time), and I'm not too keen on passing that to some poor soul.
I may some day make videos about how to reuse those devices (like D-Link or Blink cameras).
@GossiTheDog according to some of the reporting I read ( https://news.err.ee/1610183296/hackers-raised-freezer-temperature-at-selver-supermarket-to-50-c) this seems to be opportunistic attack targetting systems for which replacement has been ordered but left exposed/operating until it arrives (perhaps in hopes that noone will find them?).
At least in some cases (e.g. here in Estonia) people have been at least keeping an eye on the vulnerable machines and caught the tampering just minutes after, so there were no actual loss of produce.
@GossiTheDog left to rot like the food in them is now? ;)
@GossiTheDog they’re just learning from the security product vendors
Nov 14, 2026, 12:58 AM@GossiTheDog Decades is right. I used canaries for stacks and memory blocks back in the ‘70’s when I first started programming in assembler. Never triggered one though, fortunately.
@GossiTheDog this will never change as long as certification bodies aren't liable for the shit they're rubber stamping
@GossiTheDog have you seen VNC Resolver tho. so many controls just waiting to be abused.