Discussion
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
@mattblaze @GossiTheDog P@$$w0rdFall2019
@mattblaze it appears to have been a support backdoor, there’s a patch now which removes it entirely
@GossiTheDog someone needs to catch negligence charges for endangering the food supply chain of France by putting all the grocery store thermostats on the public internet for absolutely no fucking reason. we are too old for this behavior
@GossiTheDog
Well, it's not "123456"!😱🤷🏼♂️🤦🏼♂️
In a few years it will be 01/23/45 though
Shodan search: html:danfoss product:"nginx"
The supermarket impacted today in France put all of their devices directly internet facing and all had the same password, today’s date.
https://beta.shodan.io/search?query=html%3Adanfoss+product%3A%22nginx%22
To bypass login send a POST request to /xml.cgi, there’s a write up here: https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
I’ve seen some breathless reporting in the media about the situation in France saying it’s the biggest cyber attack ever and the result of a swarm of Agentic AI bots.
Reality: no. It’s a complete lack of security controls and negligent product development by the vendor.
@GossiTheDog "You'll never guess what"
Also there’s loads of speculation about if it’s Russia, China, Iran.
It’s likely a bored teen in their underpants in between Roblox sessions. Not a joke.
Install bonfire.cafe
Get the full app experience
@GossiTheDog Everything else aside, what on earth were they thinking with the date-based password? It's like someone heard that "static passwords are bad" and completely misunderstood the point.