So the author charitably calls the 2025 vulnerability a "login bypass", but it's much worse than that. The firmware included a "datetime-based password" mechanism: a built-in backdoor password, like it's the 90s again.
The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food", which the attackers apparently took to be a good suggestion.
As the firmware is open for anyone to download [2], blurring the affected function seems more like an invitation to find out more. I know I was curious when the news about the fridges in France broke. The function's actually called "check_code_of_the_day", and this is the implementation:
Through my work I deal with grocery software and I can tell you that grocery software is ages behind the times. For most small retailers (small being a business owner with less than 10 stores in their retail chain, mostly local grocers) you are dealing with processes that would have been considered antique for the year 2000
No one at Danfoss got alerts than sudently hundred of fridges entered defrost mode? Reminds me of those computer you see at stores running weird ms-dos software.
Over the past few years it has fluctuated but not the same continued growth as before. If you don't have a Shodan account you can see a chart on twitter:
To be fair, their entire threat model was likely "who TF would want to break in to change the settings on a thermostat on a fridge at a grocery store".
A valid question which has yet to be answered (at least not publicly).
It's a fridge. In a grocery store. You just get an employee to adjust the thermostat dial. How would the hackers demand payment if all you need to do is turn the dial back to "frozen"???
List of legitimate reasons for a refrigerator, an oven, a stove, a washing or drying machine, a microwave, a coffee maker, a sink, a garbage disposal, a toilet, a shower or bathtub, or any other home appliance to be connected to the internet:
hard to say who’s to blame: stores, installers or the vendor. most of these dashboards sat online for months, only 195 of 1,331 had every fix, and 76% went offline within days of the attack (disconnecting was possible all along, it seems).
The real question is: Why the fuck you need to connect your fridge to internet in the first place ?
They are embedded systems. That means (1) their software stack is much more primitive (so vulnerable) than your average laptop. (2) The hardware will certainly outlive the software update cycle.
This is the typical thing that should stay local and controlled through a mesh protocol like Matter or Zigbee AND a local Gate to avoid this kind of shitshow.
So the author charitably calls the 2025 vulnerability a "login bypass", but it's much worse than that. The firmware included a "datetime-based password" mechanism: a built-in backdoor password, like it's the 90s again.
The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food", which the attackers apparently took to be a good suggestion.
As the firmware is open for anyone to download [2], blurring the affected function seems more like an invitation to find out more. I know I was curious when the news about the fridges in France broke. The function's actually called "check_code_of_the_day", and this is the implementation:
[1] https://www.claroty.com/team82/research/freeze-the-controlle...[2] https://www.danfoss.com/en-us/service-and-support/downloads/...
Through my work I deal with grocery software and I can tell you that grocery software is ages behind the times. For most small retailers (small being a business owner with less than 10 stores in their retail chain, mostly local grocers) you are dealing with processes that would have been considered antique for the year 2000
It’s the same in a lot of sectors. Airlines. Electricity companies. Probably train lines. Banks. Fire services.
With all the disruption from AI on our industry, I can’t help but feel a little jealous.
Maybe AI will be able to give us a better FTP server in these industries
I know someone at a 100 store operation and they're equally working in the stone age.
Sadly, I guess they won't have to worry about patching this issue now that everything's been looted and burned down.
Possibly, for a brief moment, the food was nicely cooked.
No one at Danfoss got alerts than sudently hundred of fridges entered defrost mode? Reminds me of those computer you see at stores running weird ms-dos software.
“With our new internet-connected refrigerator line, you can get notifications online if a bunch of equipment malfunctions.”
“Why would a bunch of equipment malfunction?”
“Because you plugged it into the internet, you dolt.”
fridges are very reliable. but let's IoT them anyways so they can theoretically notify us if there is a problem.
so of course that creates/enables the problem and doesn't notify us.
deliciously ironic and rottingly sad.
this case was egregious - built-in backdoor pw - but that is downstream of the decisions to IoT them and to default them to listen on the network.
From 2017 through 2022 there was a large increase in the number of exposed refrigerators:
https://trends.shodan.io/search?query=http.favicon.hash:-853...
Over the past few years it has fluctuated but not the same continued growth as before. If you don't have a Shodan account you can see a chart on twitter:
https://x.com/shodanhq/status/2110526116679021055
When looters smash the glass door, it's pretty obvious the vulnerability has been there for YEARS!
I'm not one to draw causality, but this vulnerability seems to have had quite the effect on France
To be fair, their entire threat model was likely "who TF would want to break in to change the settings on a thermostat on a fridge at a grocery store".
A valid question which has yet to be answered (at least not publicly).
Some threat actor that demands quick payment or their perishables perish?
It's a fridge. In a grocery store. You just get an employee to adjust the thermostat dial. How would the hackers demand payment if all you need to do is turn the dial back to "frozen"???
Backdoors on French fridges? I think they have a bigger problem right now with their front doors.
List of legitimate reasons for a refrigerator, an oven, a stove, a washing or drying machine, a microwave, a coffee maker, a sink, a garbage disposal, a toilet, a shower or bathtub, or any other home appliance to be connected to the internet:
This is either a dupe or a followup of https://news.ycombinator.com/item?id=50055304 from 8 days ago with 1007 comments
Consider reading TFA
Does this amount to gross negligence?
even worse: it's grocer's negligence
hard to say who’s to blame: stores, installers or the vendor. most of these dashboards sat online for months, only 195 of 1,331 had every fix, and 76% went offline within days of the attack (disconnecting was possible all along, it seems).
Not isolating the refrigerator API from the Internet seems very negligent.
The real question is: Why the fuck you need to connect your fridge to internet in the first place ?
They are embedded systems. That means (1) their software stack is much more primitive (so vulnerable) than your average laptop. (2) The hardware will certainly outlive the software update cycle.
This is the typical thing that should stay local and controlled through a mesh protocol like Matter or Zigbee AND a local Gate to avoid this kind of shitshow.