Yet another Hacker News

Fridges in French supermarkets hit by cyber attack

82 points cataflam 2 hours ago 39 comments

cataflam 2 hours ago | parent

Looks like that specific vulnerability was found this summer, disclosed in coordination with the vendor and at least some models were patched [0] (unclear if all models were), but from early reports:

- they either didn't warn their customers this was a critical security patch, - many of these fridges/freezers were directly accessible on the internet with their own 3G/4F SIM cards without further protection!

Crazy stuff

[0] https://www.claroty.com/team82/research/freeze-the-controlle...

Delphiza 1 hour ago | parent

That is a shocking read! check_code_of_day WTAF! How did Danfoss not go around to all customers and hand-install a patch for this.

stackskipton 1 hour ago | parent

Do you know how much that costs?!? What about our executive bonuses?

kingleopold 2 hours ago | parent

no more french fries!!!

ciupicri 1 hour ago | parent

> While they may be known across the world as ‘French fries’, there’s nothing French about them. The name ‘friet’ comes from patates frites, Belgian-French for ‘fried potatoes’. One possible explanation for the association could have been formed in the First World War, when American soldiers were introduced to ‘fried potatoes’ in Belgium, but thought they were in France because that was the language spoken in that region. Whether you call them Flemish or Belgian, our delicious fries are made from bintje potatoes per tradition, and are the tastiest you’ll find anywhere on the planet.

Source: https://www.visitflanders.com/en/discover-flanders/culinary-...

bronco21016 2 hours ago | parent

This is pretty interesting as the Danfoss vulnerability was suspected to be related to a similar situation that occurred across US military bases in late August 2026.

https://signalandsilence.substack.com/p/i-think-someone-hack...

Could this be the same group? Or someone inspired by reading that article? Or just entirely unrelated?

snapcaster 1 hour ago | parent

immediately thought of this article as well. really interesting. I could imagine someone using options/futures or other obscure financial instruments to make some money off this. hard to think of other motivations

deepfriedchokes 1 hour ago | parent

Perhaps they’re motivated by Europe’s support for Ukraine and the recent data center attacks in Russia?

nraynaud 56 minutes ago | parent

I think Russia is doing random stuff of the kind, my understanding is it’s just about sawing general chaos, not doing a strong action that would be discussed at a diplomatic level.

Delphiza 1 hour ago | parent

Previous discussion https://news.ycombinator.com/item?id=50055304

kstrauser 1 hour ago | parent

Good. I’m not happy that this happened. That’s a large financial loss. I don’t like thinking about all the good, edible food thrown away instead of nourishing people. But the infosec thing that keeps me up at night is the utter lack of SCADA security. “Relax! This dam won’t collapse as long as no one guesses our public IP address!”

Lots of industrial controls haven’t been updated since they were deployed in the 90’s. “And why should they be? If it ain’t broken…” Well, because they’re freaking broken!

So I’m glad that this happened in a tangible, public way people can easily understand without it involving something much more drastic. If your family asks about this, explain that you’re glad no one blew up a gas pipeline… yet.

Silhouette 48 minutes ago | parent

There is certainly a need to raise awareness of the danger of connected/online devices. If something is connected to the public Internet then it can be attacked. If something has built-in wireless connectivity then it can be attacked. Unfortunately it really is as simple as that. Safeguards are needed accordingly.

Connected vehicles are the example that terrifies me the most. There have been numerous examples of lax security in this area already and a fleet of rogue cars or delivery trucks could obviously cause huge amounts of damage, injury, and loss of life.

There's a legacy of openness in car tech and software that was never designed with robust security and isolation of critical components in mind. I've heard that this has started to change more recently and that's reassuring if true. But this still feels like an area with far too little regulation or oversight given the past choices of vehicle manufacturers and far too much rush to connect everything up remotely even for minor convenience reasons.

In some cases there also now seems to be legally mandated connectivity for things like automated emergency calls after an accident. This should at least have a genuine benefit in the unfortunate situation that it's needed - but until vehicle security looks more like Fort Knox than a sandcastle it might still prove to be a bad choice in the end.

drnick1 10 minutes ago | parent

> Connected vehicles are the example that terrifies me the most.

Fortunately, there is a straightforward solution. Find the cellular modem fuse and pull it. You now have a modern, but fully offline car. Security aside, connected cars are absolutely awful for your privacy.

chrisjj 1 hour ago | parent

> The software allows retailers to manage their cold units remotely.

Will they never learn?

card_zero 57 minutes ago | parent

If they didn't do it that way, some bad things would happen: sometimes a fridge would fail and the food in that fridge would spoil.

Freak_NL 52 minutes ago | parent

* Fridges are welcome to send a panic message.

* Fridges are read-only through their remote interface.

Both of these can be true if you must connect them to the internet.

mrguyorama 8 minutes ago | parent

That's funny, last I checked my fridge keeps food reliably cold with no internet connection, and most supermarkets have people around all the time to notice such a failure, a plan around such a failure, and expect to have such a failure periodically since fridges break down anyway.

Meanwhile you can use analog gauges if you need perfect max temperature monitoring.

That's what always pisses me off about this. Someone brought up "Hey, if we connect this to the internet to enable that feature, someone will start hacking fridges and hurting our customers, and I don't think the stupid page with a temperature graph on it is worth that tradeoff", and some ass told them to get over it and implement it.

Raymond Chen used to write about feature development at Microsoft, specifically how every single new feature idea started from a negative position, since it requires support and testing and engineering and thought, and has future repercussions, so it's often not a good idea to just add box checking features.

Microsoft believed this in the 90s. For things like UI functionality. That's the effort and thought and restraint required to have a consistent UI, for things to be thought out.

Somehow, between then and now, the industry threw all that thought away, and now everything has 400 totally unused, half implemented, utterly broken features.

Why are we here? "Move fast and break things" just breaks everything eventually. Someone, somewhere, eventually has to fix stuff.

lxgr 55 minutes ago | parent

To not control any industrial processes remotely? I hope you realize that requiring that would make solar and wind farms completely non-viable, among many, many other things.

iAMkenough 37 minutes ago | parent

I'm interested to know how many "legacy" controllers no longer patched by the manufacturer are operating solar and wind farms today.

If it's a lot, maybe the manufacturers should be compelled to provide security patches if remote control is required to operate their products. For the sake of national security, of course.

iugtmkbdfil834 36 minutes ago | parent

Surely, there must be a way that does not force the devices onto world wide web..

sgc 23 minutes ago | parent

Seems like 95% of devices could be managed with a hardware filter that only allows through a handful of very rudimentary signals (more like Morse code than a full digital transmission), and then of course a properly designed on-device API that defines those signals and doesn't allow you to trigger a defrost remotely, when that should only ever be done with somebody physically present for example.

SoftTalker 34 minutes ago | parent

Remote control does not mean "has a public IP address."

Yes you might need to be able to centrally monitor and manage things but that should be happening on a private network.

lightedman 1 hour ago | parent

Of all the things to put on a network, this ranks as one of the dumbest, ever. You don't need control of the unit done over a network, just the data on whether it is working or not. Anything else is simply asking for someone else to come along and break your stuff.

To boot, refrigeration has been wholly automatic for decades. It literally runs itself. It doesn't need any network connectivity other than to say "I work" and "I'm broken" and that's it. Allowing control commands to be sent over the network is, yet again, just asking for trouble.

darth_avocado 54 minutes ago | parent

Dupe: https://news.ycombinator.com/item?id=50057956

iugtmkbdfil834 39 minutes ago | parent

Maybe, just maybe, fridges shouldn't be online. Cue immediate responses of: but don't you understand, management can now monitor it 24/7 and adjust in real time. To which I have about the same response:

Maybe they shouldn't.

c0balt 31 minutes ago | parent

I would maybe tone that down that sentiment a bit and limit the adjustement.

You actually do want to be able to monitor them remotely, like most industrial/commercial refrigeration, to detect failures faster and more reliably. They should still be at least secured with normal auth/autz in addition to perimeter security, though.

If I can know when a fridge failed within the hour (even at night) then I can also dispatch a technician same/next day more easily.

iugtmkbdfil834 26 minutes ago | parent

There is value in nuance and debating whether the solution should be scaled down to say a store ( or only available on local vlan or something), but I think the value of discussing that is kinda diminishing, when, apparently, the controls for all stores can be done from the same hit.

But to address your specific point:

being able to monitor does not ( or at least should not ) automatically equal put it on the web

mrweasel 8 minutes ago | parent

This still shouldn't be online. They can be networked, if you need remote monitoring, but that's different from being online (at least in my definition).

Obviously it's a question of cost and convenience, and just dumping your appliance on the internet and make it phone home is going to be the cheaper option. If you want security those appliances goes on a separate network, which cannot reach the internet.

stymaar 3 minutes ago | parent

If what's needed is the ability to monitor them, then why are these things remote-controllable?!

Obviously read-only access to some sensor is not the same attack surface as having the ability to remotely shut-down the refrigeration.

raverbashing 29 minutes ago | parent

Monitor yes

Adjust: possibly, withing a range

Shutting down: Big no no

isoprophlex 27 minutes ago | parent

well they weren't shut down. just adjusted. and the adjustment range apparently went up all the way to +50 centigrade...

27183 29 minutes ago | parent

Monitoring would be one thing, but there's almost no conceivable reason to allow setting the temperature or triggering a defrost cycle remotely. When was the last time you changed the temperature setting on your fridge or freezer? It's something you set once when you install it and then never touch again.

This kind of inspector gadget "smart tech" lunacy has infected basically all consumer products. It's got to stop.

drnick1 14 minutes ago | parent

> This kind of inspector gadget "smart tech" lunacy has infected basically all consumer products. It's got to stop.

Absolutely, and this is why I refuse to connect any home appliances to the Internet. I have a limited number of Zigbee devices, and they are managed through Home Assistant and can't access the Internet.

27183 10 minutes ago | parent

Yes, I have similar strategy. But in all cases I'd prefer to just buy analog appliances. There's no good reason to put a digital computer in a refrigerator. A bimetallic thermostat does the job just fine.

jgerrish 17 minutes ago | parent

Like the other poster mentioned, blanket statements like this ignore the incredibly smart people at major international corporations and their strategies.

I have a smart fridge and washer. I won't name names. But for several years they were never connected or online at all (unless they was compromised and I didn't know). I connected them and one of the first updates included in the washer was changing the default wash cycle from something like 110 minutes to 46 or something. I don't remember all the values if I'm honest.

There are executives who have spreadsheets and charts of how much water that saved per household over varying periods of time. How much it would save with greater adoption. And the unsaid message, or maybe they'll be explicit, of how many people are going to face tragic water supply issues in the future.

It's a powerful message, even if we know it's cyncical and calculated to push not just washers, but firmware security systems and institutions to govern those systems.

And yes, compromised systems can also be used to build zombie networks to push horrible content.

I feel horrible that this critically important surface issue of water supply is used to push other agendas. I honestly wish I could do other work not related to it.

iugtmkbdfil834 8 minutes ago | parent

<< ignore the incredibly smart people at major international corporations and their strategies.

Ignore may be a tad strong. I am merely asking for hardware that is subject to my control to be within my control. I think somewhere along the way executives got a little to comfortable saying 'they will buy what we give them'.

More to the point, maybe there is exactly too many smart people with agendas that don't seem to align well with my current needs vis-a-vis fridges:

I want something that keeps things cool with minimum of fuss and does not die upon update.

In short, that executive should be fired as they are not doing their job: they are actively undermining their own market.

tintor 5 minutes ago | parent

Agree. I don't want fridge company or anyone else to turn my fridge into residential proxy with its access sold to the highest bidder to build web scrapers.

isoprophlex 24 minutes ago | parent

Interestingly, a major Dutch supermarket was also hit by a yet-undescribed cyberattack, prompting them to basically shut down every IT system. So not a hack of a control system, sounds more like an ordinary ransomware attack... but still tantalizing that two EU countries have their food supplies targeted the same day... the day of a big NATO "russia we dont mess around" conference, too.

bertram_gilfoyl 8 minutes ago | parent

This thing is addressing problems that don't exist. It's solutionism at its worst. We are dumbing down machines that are inherently superior.