I've confirmed with folks the impacted freezers in the countries impacted today are all mgmt interface facing internet, same issue and vuln as last time.
Many of the freezers are end of life and have no patch available, they've just been left online to quite literally rot.
@GossiTheDog No sympathy for the companies. They knew and did nothing to mitigate.
@GossiTheDog Note: none of the stores affected in Sweden used the store chain's internal network to connect their equipment.
Edit: see below, not the case here.
I'm only adding this for information as a fridge person, which I've said before.
The refrigeration system and its controls are not directly internet connected or required to be. The controllers affected use ModBus communication protocol, usually 485 flavour, to connect to computers running SCADA. This allows operators to change parameters, such as setpoint (temperature in the fridge), remotely and has many valid uses. This is how most industrial systems are run.
The problem is that the computers running the software are often connected to the internet. When an attacker gains access to the computer, they also gain access to the SCADA to communicate with the refrigeration controls exactly as designed.
Just as using SCADA to control refrigeration equipment is convenient, so is remote access so you do not have to physically get to the computer (connected by physical cables to the fridge controls) to make changes should they be needed. I would, and have recommended to industry in the past, isolate such computers from the internet entirely.
When you lose food at this stage of the supply chain, all the embedded carbon goes with it so it's a much bigger disaster than a large corporation losing a few grands worth of stock.
@securedllama that isn't the case in this one - the models are fridge all have ethernet ports and a webUI for management, people are connecting those directly to the internet.
@GossiTheDog must be the Danfoss system then, which does have ethernet ports. Yikes.
Thanks for the additional info on connectivity.
@GossiTheDog @securedllama good lord.
@GossiTheDog @securedllama this is self inflicted right, these fridges could be on an internal network
@wronglang @GossiTheDog having been totally wrong in my original post with regards to these systems I'll go for two in a row.
As far as I am aware these management systems can be operated on internal networks. They do not actually require an internet connection to work as refrigeration controls. There's no doubt a load of extra features with web access though so they get connected. That and most people don't care 🙁
@securedllama @GossiTheDog thanks, I'm just flabbergasted as a very non specialist that anybody thought this was gonna work out long term...
Well ok, not completely a non specialist, I do write data management and security plans. Still.. 🫣
Nov 2, 2026, 8:55 PM@GossiTheDog @securedllama are they also wasting IPv4 public IP’s? Or are these at least using the unlimited IPv6 address space? :excuseme:
@bryan @GossiTheDog IPv4 from the documentation I've had a quick look through. I was curious earlier.
All examples given are IPv4 with no mention of IPv6. Happy to be proven wrong though.
@securedllama @bryan yeah 100% IPv4. I don’t think the vendor even supports IPv6.
@securedllama @GossiTheDog I've gotten pushback over the years on this take, but it proves itself over and over.
If a communication interface was designed with the explicit assumption that it only be used on a trusted bus/network, then there needs to be some technical mitigation against connecting that interface to a wider untrusted network. Physical barrier (its internal to the device) or some sort of even stupid basic shared authentication. Something, anything to make it harder to slap it on shodan. Because if it's trivially easy to attach to the internet then it will be done for convenience. The number of rs-232 to Ethernet bridges that I've seen connecting things that should absolutely NOT be online is scary.
Easier said than done for building scale things running modbus. Is there any talk of a standard technical barrier like that in the industrial automation industry?
@GossiTheDog Funnily enough, the media are still reporting it as a cyberattack, even though access is wide open to any script kiddie.
Although I don't follow the "the mass-media are all lying" narrative that a lot of the uninformed Facebook lovers do, I have learned in the past 10 years that the media is uninformed in a LOT of things.
I used to take their word for news items, but since they started reporting on cyber incidents (such as the PHP issue a few weeks ago or now this) I KNOW that they're just spewing guesses and have zero actual insight in the issues at hand.
They speculate and the people they invoke as being the "experts in their field" are often just other journalists that have been put in a certain box. Heck, the "cyber security correspondent" for the BBC literally didn't know what PHP was.
Today, they're all going deep down the rabbit hole of "it was Russia" on this issue when clearly, it's just badly secured IoT devices that nearly anyone with a laptop can access and control. There's ZERO proof for any Russian involvement, it could just as easily be a 13 year old kid that was browsing Shodan and thought: "ha, this will be funny".
Btw, if you try and comment on these articles, your reply either doesn't get posted at all or it gets removed very quickly. Apparently they don't like you calling them out on these things...
Nov 2, 2026, 3:32 PMAlways has been about information control and manipulation. We should of been doing more checks instead of just trusting, and bad actors know this.
They may not be right out lying but many who are large enough use their power and influence to get the benefit of maximum value extraction, at the end of the day their contribution to the overall public good is debatable, not assured.
Ok Sunrise TV team , it is 4am. This freezer cyber hack thingy is an interesting story, I think we schedule in the full 10 minutes between breaks at the 7.20 slot.
Now who we get on to talk to us?
Anyone have any phone numbers for IT security people that are going to answer their phone at this time of the morning?
Umm how much would one of them even cost us?
Or should we just go with Frank?
Frank? Who is Frank?
You know that guy that we get in whenever Apple releases a new product.He was rewriting corporate PR release for a IT magazine for a while, then did the same for a blog, before moving to YouTube.
Will Frank be able to handle this security stuff?
It is just computers, how hard can it be? If we ring him now, he lives nearby, so will be in the studio in a hour and can google it or chapgptt it or what ever people do to learn these days.
Ok call Frank.
@SuperMoosie @dani @GossiTheDog
I lolled, but you’ve probably hit it exactly on the nose.
Also Frank is easy because he is already in the accounts payable system and he likes coming on, because it promotes his brand.
Well the contents won't be very fresh in a short while. Even if the firmware isn't 🙁
@GossiTheDog this sounds like a job for EU regulators to step in and force the vendor to release some kind of fix.
@alienghic @GossiTheDog
EU regulators: Younglings under the age of 16 are no longer allowed to buy frozen foods (including ice cream). Everybody else is required to scan their ID when opening freezers in supermarkets.
#DystopEU
I suspect a patch that makes the refrigerator's WebUI read only would be easier for everyone involved.
@alienghic @GossiTheDog
But the childreeeen1!11
@musevg @alienghic @GossiTheDog better make it 21.
@alienghic @GossiTheDog it is also and foremost the responsibility of these supermarket chains, the companies affected today are multinationals listed on the stockmarkets so they cannot say they don't have the means (the store managers can say they don't have the knowledge, this is not a store manager's job)
@alienghic @GossiTheDog
By the way: This regulation does already exist. It's called #CRA, Cyber Resilience Act.
Unfortunately it does not regulate existing/brownfield installations, only new sales.
@GossiTheDog I am an artist so I don't know much, but I guess all this would be avoided if instead of just opening the device to the internet, you make them available on a local network that an operator can ssh into? If that's true, it seems extremely negligent
@GossiTheDog Having to log in to the manufacturer's website for anything is just so shit, I got so much stuff I don't use for this very reason (seemed like a good idea at the time), and I'm not too keen on passing that to some poor soul.
I may some day make videos about how to reuse those devices (like D-Link or Blink cameras).
@GossiTheDog according to some of the reporting I read ( https://news.err.ee/1610183296/hackers-raised-freezer-temperature-at-selver-supermarket-to-50-c) this seems to be opportunistic attack targetting systems for which replacement has been ordered but left exposed/operating until it arrives (perhaps in hopes that noone will find them?).
At least in some cases (e.g. here in Estonia) people have been at least keeping an eye on the vulnerable machines and caught the tampering just minutes after, so there were no actual loss of produce.
@flaki they’re end of life kit, very easy to find
@GossiTheDog left to rot like the food in them is now? ;)