YHK - yet another hacker news clone

France's supermarket fridges were vulnerable online for months

63 points emot 2 hours ago 61 comments

Cameri 2 hours ago | parent

Does this amount to gross negligence?

emot 2 hours ago | parent

hard to say who’s to blame: stores, installers or the vendor. most of these dashboards sat online for months, only 195 of 1,331 had every fix, and 76% went offline within days of the attack (disconnecting was possible all along, it seems).

UltraSane 1 hour ago | parent

Not isolating the refrigerator API from the Internet seems very negligent.

seekup 1 hour ago | parent

even worse: it's grocer's negligence

SOLAR_FIELDS 1 hour ago | parent

Through my work I deal with grocery software and I can tell you that grocery software is ages behind the times. For most small retailers (small being a business owner with less than 10 stores in their retail chain, mostly local grocers) you are dealing with processes that would have been considered antique for the year 2000

josephg 1 hour ago | parent

It’s the same in a lot of sectors. Airlines. Electricity companies. Probably train lines. Banks. Fire services.

With all the disruption from AI on our industry, I can’t help but feel a little jealous.

SteveNuts 1 hour ago | parent

Maybe AI will be able to give us a better FTP server in these industries

procflora 28 minutes ago | parent

We already have that it's called SFTP. ;)

Wait what do you mean you want to use a key to log in, our stuff doesn't support that.

Gigachad 1 hour ago | parent

AI enabled hackers are going to break everything that’s connected to the internet forcing it to move in to the modern era.

josephg 49 minutes ago | parent

Disconnecting is also effective. Fridges don’t need to be on the internet.

chrisweekly 47 minutes ago | parent

into the modern era... ... or back into the dark ages

Kina 43 minutes ago | parent

What does AI have to do with this?

eterm 41 minutes ago | parent

AI is ruthlessly effective at finding vulnerabilities.

Gigachad 34 minutes ago | parent

So much security in the past relied on "no one would bother to look in to this". We now have armies of bots relentlessly scanning over everything which is the main reason everything has been getting hacked over the last few months.

Kina 21 minutes ago | parent

I think this is irrelevant.

There is no evidence AI was used to do this and it feels like a random way to force AI into the conversation? It’s just spectacularly negligent behavior by people who think that they don’t have to trouble themselves with security, but want the convenience of having their stuff on the Internet for remote management.

This is just like the OPM hack 10 years ago.

SOLAR_FIELDS 1 hour ago | parent

I am reminded of this every time I fly Southwest Airlines

31carmichael 40 minutes ago | parent

Electricity companies should be 100% air-gapped from any internet connection, whether or not they have outdated software.

procflora 30 minutes ago | parent

There is plenty of room for antiquated process and technology in utilities that has nothing to do with grid operations, trust me. :)

Gigachad 14 minutes ago | parent

You can do a one way link, sensors on infrastructure which emit data only but can not receive anything. Then another device like an ESP32 or whatever the industrial version is which reads the data and makes it available to the internet.

You now have the ability to remotely monitor the system but hacking it does not allow you to control anything. Though there is still a sizable amount of infrastructure which has no on site workers and needs to be remotely controlled.

kevin_thibedeau 1 hour ago | parent

I know someone at a 100 store operation and they're equally working in the stone age.

Thaxll 1 hour ago | parent

No one at Danfoss got alerts than sudently hundred of fridges entered defrost mode? Reminds me of those computer you see at stores running weird ms-dos software.

cwillu 1 hour ago | parent

“With our new internet-connected refrigerator line, you can get notifications online if a bunch of equipment malfunctions.”

“Why would a bunch of equipment malfunction?”

“Because you plugged it into the internet, you dolt.”

pixl97 14 minutes ago | parent

Many of these things have cycles where they clear frost or otherwise remove moisture from the system by getting hot. What you're talking about is something that could be common. It's the extended heating that starts causing problems, but if the software is taken over the alerts may no be sending.

Confiks 1 hour ago | parent

So the author charitably calls the 2025 vulnerability a "login bypass", but it's much worse than that. The firmware included a "datetime-based password" mechanism: a built-in backdoor password, like it's the 90s again.

The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food", which the attackers apparently took to be a good suggestion.

As the firmware is open for anyone to download [2], blurring the affected function seems more like an invitation to find out more. I know I was curious when the news about the fridges in France broke. The function's actually called "check_code_of_the_day", and this is the implementation:

  uchar check_code_of_the_day(LPCTSTR pass) {
    uchar uVar1;
    LPCTSTR pass_local;
    DATE_STRUCT date;
    INT32 tothex;
    INT32 hex;
    UTF8_STR buff;

    Get_syst_current_tds(&date);
    ftext_s(buff,0x1ff,"%02d%02d%02d%02d",date.month,date.day,date.year,date.month);
    sscanf(buff,"%lx",&tothex);
    ftext_s(buff,0x1ff,,date.day);
    sscanf(buff,"%lx",&hex);
    tothex = __aeabi_idiv(tothex,hex);
    ftext_s(buff,0x1ff,"%05ld",tothex % 100000);
    if ((((*pass == buff[0]) && (pass[1] == buff[1])) && (pass[2] == buff[2])) &&
       ((pass[3] == buff[3] && (pass[4] == buff[4])))) {
      uVar1 = '\x01';
    }
    else {
      uVar1 = '\0';
    }
    return uVar1;
  }
[1] https://www.claroty.com/team82/research/freeze-the-controlle...

[2] https://www.danfoss.com/en-us/service-and-support/downloads/...

missmewiththatl 1 hour ago | parent

I'm was super glad I could just copy/paste that code in my LLM-of-choice and it gave me a reasonable explanation of how to exploit it. Thank god an attacker couldn't do that.

xp84 1 hour ago | parent

Sadly, I guess they won't have to worry about patching this issue now that everything's been looted and burned down.

HPsquared 1 hour ago | parent

Possibly, for a brief moment, the food was nicely cooked.

tantalor 1 hour ago | parent

Intermediate value theorem

dointheatl 49 minutes ago | parent

> everything's been looted and burned down

There may yet be hope that a few stores survived. Possibly even a village or hamlet. In the vast rubblescape that is now France.

achillean 1 hour ago | parent

From 2017 through 2022 there was a large increase in the number of exposed refrigerators:

https://trends.shodan.io/search?query=http.favicon.hash:-853...

Over the past few years it has fluctuated but not the same continued growth as before. If you don't have a Shodan account you can see a chart on twitter:

https://x.com/shodanhq/status/2110526116679021055

fhdkweig 1 hour ago | parent

This is either a dupe or a followup of https://news.ycombinator.com/item?id=50055304 from 8 days ago with 1007 comments

tomalbrc 1 hour ago | parent

Consider reading TFA

drillsteps5 1 hour ago | parent

To be fair, their entire threat model was likely "who TF would want to break in to change the settings on a thermostat on a fridge at a grocery store".

A valid question which has yet to be answered (at least not publicly).

pstuart 1 hour ago | parent

Some threat actor that demands quick payment or their perishables perish?

drillsteps5 1 hour ago | parent

It's a fridge. In a grocery store. You just get an employee to adjust the thermostat dial. How would the hackers demand payment if all you need to do is turn the dial back to "frozen"???

Edit: Yes i know the commercial fridges do not have "dials" and it's more involved. Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.

masfuerte 1 hour ago | parent

> Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.

Sure, with time and expertise. How does the average employee adjust the virtual thermostat on fifty network-controlled fridges before the food goes bad?

drillsteps5 40 minutes ago | parent

I don't know about your grocery store but the ones I've been to have maybe 5 on the shopping floor and probably a few more in the back. They all have physical controls which (I'm assuming) override the controller if something goes wrong. So if big bad hacker says "I'm gon' turn y'all fridges off if you don't pay me" it's not a threat, it's a silly joke.

Unless of course they turn it off without telling the businesses so the products go bad because nobody's watching over the weekend or smth. But then again, why would someone want to do that. I wonder.

gz5 1 hour ago | parent

fridges are very reliable. but let's IoT them anyways so they can theoretically notify us if there is a problem.

so of course that creates/enables the problem and doesn't notify us.

deliciously ironic and rottingly sad.

this case was egregious - built-in backdoor pw - but that is downstream of the decisions to IoT them and to default them to listen on the network.

esikich 1 hour ago | parent

Electricity is expensive. Grocery stores work on extremely thin margins with stock that literally turns rotten. These are physical devices that need maintenance. Their failure is often catastrophic. Grocery store workers are not equipped to fix an HVAC system. Someone needs to monitor for preventative maintenance.

I can't understand the mindset that would treat this as a trivial problem. What's sad is your confidence in giving this situation a 5 second take and declaring the whole thing stupid. Yes, security was clearly an issue, but saying that monitoring of critical infrastructure is sad is bizarre.

hmartin 56 minutes ago | parent

I wish I could upvote this comment more

ninalanyon 42 minutes ago | parent

> workers are not equipped to fix an HVAC system.

But they are perfectly capable of checking the temperature. After all the fridges and freezers are restocked multiple times a day so even if one failed it wouldn't have time to get warm before someone should notice.

Ad there are other ways of monitoring such as having an audible or visual alarm.

esikich 38 minutes ago | parent

Do you think grocery stores are 24/7? How often do you think these checks happen? Do you think it's the best way for those employees to spend their time? How often would these checks need to be performed to show statistical significance? Do you have reason to believe these things have never been thought about by people who run grocery stores? What are the labor requirements in a grocery store to run effectively?

AngryData 27 minutes ago | parent

Remote monitoring by itself is not a problem, but remote control is and has no benefits. You can't change the temperature of or defrost a freezer without removing everything from it, and if you can remove everything from it someone is already there the change the settings. And it takes extra work to enable remote controlling of a refrigerator system over just providing temperature readings.

And it still isn't going to save electricity. The only thing it can do is warn of a failure and tell you that you got like 20 minutes to start moving food before it has to be trashed for exceeding safe food handling temperatures.

esikich 5 minutes ago | parent

I mean, say you have 30 grocery stores, are you saying you shouldn't be able to build templates to deploy? You gonna have a guy drive all over the place updating schedules 24/7?

gz5 21 minutes ago | parent

good points and all the more reason to monitor in reliable, safe manner?

vlovich123 51 minutes ago | parent

How is it a bad idea to want to automate maintenance of the fridges? It doesn’t require a bad implementation.

icehawk 37 minutes ago | parent

This isn't your single compressor/evaporator/condenser coil appliance that sits in your kitchen. These are far larger and more complex systems.

The AK-SM 800A can control 170 different refrigeration devices. This is more akin to the entire freezer section (and probably meat and dairy) in your supermarket.

NordStreamYacht 1 hour ago | parent

Backdoors on French fridges? I think they have a bigger problem right now with their front doors.

anonym29 1 hour ago | parent

List of legitimate reasons for a refrigerator, an oven, a stove, a washing or drying machine, a microwave, a coffee maker, a sink, a garbage disposal, a toilet, a shower or bathtub, or any other home appliance to be connected to the internet:

icehawk 23 minutes ago | parent

The device in the article isn't a home appliance.

joshuat 1 hour ago | parent

I'm not one to draw causality, but this vulnerability seems to have had quite the effect on France

paustint 1 hour ago | parent

When looters smash the glass door, it's pretty obvious the vulnerability has been there for YEARS!

tantalor 59 minutes ago | parent

Why bother breaking through the glass front, when most places of business have a very obvious back door just waiting.

willvk 55 minutes ago | parent

So this is the real reason they're rioting. I'd be pissed too.

throwaway27448 53 minutes ago | parent

Sadly no, it's just the same old incoherence over the point of the state

l-mdev 54 minutes ago | parent

suck it jian yang

Grimeton 47 minutes ago | parent

>85% ran software with known security flaws. That includes 527 older controllers Danfoss no longer supports. Only 195 had every known fix.

As long as the fridges are used the controller has to be supported.

This isn't a raspberry pi $50 a pop...

jacquesm 45 minutes ago | parent

Oh, great idea. We should do that for software: force manufacturers to support their software with bugfixes as long as it is in use. And just bugfixes, the marketing department can stay out of it.

eterm 42 minutes ago | parent

Things will only meaningfully change when insurance companies stop paying out when reasonable steps weren't taken by companies to protect themselves.

esikich 28 minutes ago | parent

As someone who has worked with small and medium sized businesses, reasonable is extremely variable. I'm dealing with a small business right now that can't upgrade their perfectly good computers because of TPM issues. On one hand, I kind of get the reasoning behind it, but how can you hold a business of 10 people accountable for not knowing how to buy a computer that will be reasonably future proof? Every business needs IT on hand? I think that's asking too much. On the otherhand, you should know the tools you need to run your business. There's no fine line.