Shodan search: html:danfoss product:"nginx"
The supermarket impacted today in France put all of their devices directly internet facing and all had the same password, today’s date.
https://beta.shodan.io/search?query=html%3Adanfoss+product%3A%22nginx%22
To bypass login send a POST request to /xml.cgi, there’s a write up here: https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
I’ve seen some breathless reporting in the media about the situation in France saying it’s the biggest cyber attack ever and the result of a swarm of Agentic AI bots.
Reality: no. It’s a complete lack of security controls and negligent product development by the vendor.
Also there’s loads of speculation about if it’s Russia, China, Iran.
It’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.
You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
LinkedIn’s absolutely awash with security vendors posting brain-dead takes on the fridge thing as they have no idea, at all, what they’re talking about. It’s great as it’s a list of people not to hire.
You may be surprised to know the through line to the posts is.. AI. Remember when we had intelligence.
The manufacturer has confirmed this was caused by unpatched systems being internet-facing. The French government CERT has also issued an advisory saying the same. The patch in question removed the date-based backdoor password. https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-012/
German authorities are reminding orgs not to directly connect food cooling solutions to the Internet. https://www.allianz-fuer-cybersicherheit.de/SharedDocs/Downloads/Webs/ACS/DE/BSI-CS/BSI-CS_154.html
This incident didn’t just impact one French company, btw. It’s multiple orgs. The media is focused on the supermarket as they’re the big one who disclosed publicly.
I was being too glib with zero skill in this thread, as it evidently needs some skill. I’m tempted to do a write up but a bit worried about defrosting cold storage warehouses 😅
Oct 12, 2026, 7:19 PM@GossiTheDog I mean, also some "credit" to people who thought connecting fridges to the internet was a good idea.
Oct 12, 2026, 11:07 PM
But... but... there's always someone in a supermarket! It's not like having a manager, who's already there, doing temperature checks a few times a day will cost much.
Sigh.
And if it's for monitoring when the shop is closed, it could be read only!
When it's set for the required temperature, no one needs to change it, unless you change the stuff inside it, which is a big operation in itself and doesn't happen often.
Even the productivity reason doesn't hold.
@Lily_and_frog @Aedius @bremner @GossiTheDog
Its mostly for maintenance people to do remote troubleshooting and optimisation. Thats hours of driving at least, and more if specialized service technicians are at supplier headquarters abroad.
A lot of equipment nowadays has such functions, quite often with a phone modem directly in the machine. Yes its a security risk, but also extremely useful
@Aedius @bremner @GossiTheDog until it goes wrong and spoils millions of $ in food that is
@kcpoole @Aedius @bremner @GossiTheDog
It didn't go wrong.
It worked as designed.
The design was insane, but worked perfectly.
@GossiTheDog that ... gives "internet of shite" a whole new meaning.
@GossiTheDog And... that is why your toilet seat is cleaner than your keyboard or mobile phone 🤣 😎
The jobs not finished until you do the paper work! 😉🤷♂️
Oct 13, 2026, 7:27 AMDon't forget to wash your hands afterwards! 😬
Yes Dad! 😔
@GossiTheDog You mustn't forget that we really do need the hype around the AI-threat. I mean... how else are we going to sell products countering the very-soon-to-come onslaught of autonomous AI-agent attacks that, unless countered, will entirely enslave and make a botnet of all computers on the internet.
@GossiTheDog I don't see the brain-dead takes from people I shouldn't hire. Can you share?
@GossiTheDog
I went to linkedIn to see if I had any in my timeline.
This was a huge mistake. Looking at LinkedIn makes me want to vomit every time. (My timeline was all Nobel prize, CERN, and crap about robots.)
Oct 13, 2026, 2:03 AM@GossiTheDog Brain head vendors are the norm, though.
Oct 13, 2026, 2:05 AMpass the dab rig
Oct 13, 2026, 2:58 AM@cyberquixote @GossiTheDog Eh.. close enough for government work.
@GossiTheDog I'm a big fan of AI*
*) "actual intelligence"
@GossiTheDog And then we have you... who doesn't know either why only certain "French" supermarkets were hit with this problem and other supermarkets of the same supermarket chains and users of Danfoss equipment around the world weren't hit with this problem. If there are so many exposed fridges, then why only hit the French ones? There is a good chance this had nothing to do with the Danfoss vulnerability and was a hack of a management system at a French fridge service company.
@internetthought they didn’t just hit the French ones, FWIW. A vast majority of the directly internet exposed ones were in France.
Oct 13, 2026, 1:57 PM@GossiTheDog @internetthought that might just be market dominance, or the fact that danfoss france or their reseller had noone deciding this was a bad idea, or their counterparts at the supermarket chains not giving a merde... I mean, look at @vncresolver 's posts and cry.
@GossiTheDog Where can I find information about other fridges that were hit? And why were the fast majority of internet exposed ones in France?
@GossiTheDog my apologies, I thought everyone was jumping too quickly to conclusions, because the issue appeared to be only limited to France, but it does appear to be wider spread. So much for "clues" then (see Terry Pratchett quote). I have a bias against cyber attack messaging, when often the alleged attack is human stupidity, misconfiguration, mother nature etc. and not a Neo-like leet h@ckx0r... Oh well, a few supermarkets got a slightly more expensive cybersecurity drill 😋
@GossiTheDog how does patched/unpatched fit in? How does it matter when no exploit was used?
Or did I miss something?
@AwkwardTuring the date based password thing has a patch to remove the ‘feature’
@GossiTheDog ah! That feature was built-in! I didn't expect that. Gets better by the hour! Ty
@AwkwardTuring yeah it’s likely a support backdoor
@GossiTheDog @AwkwardTuring I can imagine a tech showing up to fix something and asking the assistant to the assistant manager for the admin password. I'm sure an endless array of blank looks prompted the backdoor.
@GossiTheDog what’re the odds that someone is looking for other, only slightly more complex, methods of compromise?
Oct 13, 2026, 5:57 PM@GossiTheDog What a meltdown...
Oct 14, 2026, 4:57 PM> running a cryptocurrency miner
ahh, so that's how they got the fridges warm 😜
@GossiTheDog Are you sure they were mining crypto? In the article they say that is unlikely: 'The devices are low-powered and on slow cellular links, which rules out crypto mining and makes them poor for denial-of-service.'
Did an LLM mess up the summary? 🙃
@zsapi no, it means I can’t read 🤣
@GossiTheDog HOW? How does a supermarket do this? I know NAT is not a firewall, but still the fridges won’t be detected or accessible from a simple port scan if behind a router. So what went wrong here?
@GossiTheDog In a parallel universe: Authorities are forcing vendors of connected devices to be secure by default. And also liable if they aren’t.
Yesterday, it was HVAC control systems for two malls here in Sweden. Why does this keep happening? (Rhetorical.)
Oct 13, 2026, 4:50 PM@GossiTheDog ... or anything else that isn't a halfway decent firewall, I might add.
Oct 12, 2026, 9:02 PM@GossiTheDog « and I’m not constipated »
@GossiTheDog one handed, on your phone 😉
Oct 12, 2026, 9:13 PM@GossiTheDog It's pretty consistent with most IP-enabled, quasi-industrial operational technology that I encounter, and demonstrates a lack of imagination on the part of OEM threat assessments, and a lack of competence in their security engineering.
😂 🤣 😆 😀 💩
This one takes the prize for winning the Internet tonight. Kudos GossiTheDog 🏆️
@GossiTheDog friend if you're crapping out shell scripts you may want to see a doctor
@GossiTheDog my coworker has informed me that they can't write bash scripts without claude. so
@GossiTheDog these are those Advanced Persistent Teenagers you warned us about, aren't they?
@fartnuggets @GossiTheDog roflol
Oct 12, 2026, 7:46 PM@GossiTheDog The Zersetzung Machine Just Works Like That
@GossiTheDog First thing I thought when I heard about this was “Advanced Persistent Teenagers at it again!”
It’s a teenager kind of attack. A target no adult would think about because adults have forgotten all of the open targets that we’ve been safely (de facto) been ignoring forever.
@GossiTheDog Sometimes a teen wonders what if they did decide to connect to one of the random unprotected industrial controls they see on @vncresolver, what sort of trouble could be caused.
Oct 12, 2026, 8:48 PMYeah, well the difference to "throw-away agents" is smaller than one might think these days. And the simultaneous "IT issue" in NL is ... an interesting coincidence.
