This is a most excellent place for technology news and articles.
Hacked? This term applied to this is an insult. The user name was "admin", and the password changed daily - it was the current date.
This is not hacking, this is a complete and utter failure on behalf of the company who set this up, and their fault entirely.
Password changed daily
Wow, that's crazy security practice!
it was the current date
Oh.....
// TODO: Change this to a time based crypto key deriving algo before release
char *passwd = curr_date
Somewhere in France an extremely frightened thirteen year old hasn't touch anything electronic in a week.
Do you have a source on this? The other article I had seen on this said the password changed daily and was algorithmically based on the date. So if someone analyzed past passwords they could derive future passwords, but not that it was literally the date.
https://cyberplace.social/@GossiTheDog/117429502412235079
https://ironhackers.es/en/danfoss-ak-sm-800a-cve-2025-41450/
The “code of the day”
Many industrial devices include a service access so the vendor’s technician can get in without the customer’s password. A classic —and dangerous— way to implement it is the code of the day: a code that changes every day according to a formula that, in theory, only the vendor knows.
The problem shows up when that “secret formula” is the only thing protecting access (security by obscurity) and it can also be recovered from the firmware itself. That is exactly what happens here: sm_app ships unobfuscated, with function and variable names in plain sight. The one that validates the code is called, literally, check_code_of_day.
'date+123' would be an algorithm based on the date. Given non techie users, it was probably something like that.
It's not even social engineering.
I keep trying to tell the school administration the same thing each time my special needs kid wanders into some gapping security hole and they call it hacking.
Don’t connect your critical appliances to the internet…
Some fun reading for anyone interested https://cyberplace.social/@GossiTheDog/117429502412235079
Wow. Shit like that makes me think we all fucked up by not having licensing or certification for software engineers like we have with civil engineers. They've got a lot a lot of balls claiming they were “hacked” when every unit had the same easily guessable credentials.
Good point. It‘s bit like saying someone broke in when you let the door open. Here I suspected someone in this story used AI and that was the problem but no. They were just recklessly clumsy.
But the door was locked! I locked it real good! They broke in, I was robbed!
Oh, the key? I keep that well secured under the doormat. Also all the houses use the same key so they don't get mixed up, pretty convinient eh?
The issue is not that it was connected to the internet, the issue is that it should have been connected to a private VPN network so that monitoring can happen remotely but still securely (not to mention keeping fw updated and changing default passwords)
Yeah, this is such basic stuff. This wasn't "a large hack", it is a case of "the network guys there are hacks".
If I remember correctly, my understanding is that the fridges were running an ancient version of nginx, had the username admin, ~~no password~~ the password is reset daily to .. the current date and based on the information printed before logging in were easily found with a search engine.
The "hack" can apparently be achieved with a single line of bash, using curl to make the connection.
I'll see if I can find the thread that discussed/announced it, but as an ICT professional, this doesn't appear to be a "hack", rather a set of unlocked doors that someone bored enough tried the knob on.
Edit:
Sorry, remembered the password incorrectly.
Source: https://cyberplace.social/@GossiTheDog/117429502412235079
Most hacks are either this or being given the keys to said door by manipulating a key owner
Sorry, remembered the password incorrectly.
Don't quit your job to become a hacker.
Stop. Putting. Internet. In Everything.
The S in IoT stands for security.
Why do you need a web enabled fridge/freezer? I want a SNMP/Trap (one way, exit only) alarm when temp is getting near outside the "safe zone". One way, I set the numbers local, can't be changed otherwise.
Its simple (as am I), why does it need to be on the "cloud"??? AM I TAKING CRAZY PILLS?
Management wanted a killswitch they could control. Then they lost control.
This is one of those moments, like buying a new car that all the "bells"and whistles" in the end work against you.
“The things you own end up owning you.”
-T Durden
I'm going thru this right now. I spent most of my life being able to move in 24 hours. Now I have to plan, I have to check local laws, I feel a slave to things I "own". Point is the same w/ this. Your unnecessary web enabled device "own" them too.
I feel you with the “move in 24 hours”. I made multiple international moves with one or two suitcases and an easyjet flight. Now with a family and years of accumulated possessions, last move took months of planning and a moving truck.
Companies are impressed by developers that only know how to build pretty dashboards by just installing every npm package under the sun, opening all of the ports on everything, and requiring a connection to the cloud to make their front-end work. There may even be someone working for the company that explains the problems, but those people get ignored.
AI is just making this mentality worse.
or replace obsolete unsupported systems
Company expects you to replace perflectly working appliance because they can't be bothered with supporting it after an arbitrary amount of time. So typical
True. But I'd still have them on my VPN and not internet accessible. Still not bulletproof, but much better.
Yea your have a secure net, if you don't want a VPN for each site, you at least make them connect via a VPN in a head office.
122F?! Why the hell would a fridge have that setting?
Also, don't make appliances that connect to the Internet. That's fist fucking stupid. Of course some kid is going fuck shit up. There are Black Swan Events and then there are Common Pigeon Events.
Probably not a setting but the limit of the internal sensor. Pretty sure the cyberattack just switched all the fridges to defrost mode.
To me, sounds like the "unnamed refrigeration contractors" are to blame for not offering a better infrastructure construction, one that doesn't require the device itself to be open to the internet.
Hacked? This term applied to this is an insult. The user name was "admin", and the password changed daily - it was the current date.
This is not hacking, this is a complete and utter failure on behalf of the company who set this up, and their fault entirely.
Plus hooking these systems to the public internet. Noone prevented these fuckwits from isolating these systems properly outside of "we do not give a fuck" or "VPNs are arcane magic for me"
So the insurance companies will probably give the supermarkets the middle finger since they didn't do basic stuff like updating their appliances.
Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures.
Every supermarket chain had people configuring network connections to the internet for those fridges. Every chain fucked this up themselves.
haha "not cool"
that's grade A reporting
Another keyboard-chair interface weakness attack
Great pun! Came here to say they're not dunking on hackers... They're making a cooling pun about refrigerators! Hilarious.
I feel like I need more context. Like, there had to have been a benefit to having your fucking fridges on a network, right?
Like were dumb fridges worse in some way? Did this allow for them to have more control over all the fridges?
Like just why are we connecting fridges to the internet?! I really feel like I need more of an answer to why we did this and how we got here.
It wasn't me. Honestly.
