Yet another Hacker News

Show HN: Coldframe, a honeypot that poses as a supermarket fridge controller

67 points hedgerow-dev 1 hour ago 15 comments

I built Coldframe, a honeypot that pretends to be a supermarket refrigeration controller. Inspired by the events on industrial fridge installations in the past weeks, I wanted to see what people would try against a convincing fake.

To learn more about this I built a honeypot that resembled perfectly the Danfoss AK-SM 800A and Dixell XWEB interfaces. Both of them are recognized on Shodan as real ones (an not as honeypots). It’s one Python file using only the standard library, and it builds on eppser/danfoss-ak-sm-decoy and public research by Synacktiv, Claroty and Ironhackers.

Things that were fun to get right:

- Matching real units. I used Shodan records of real devices to match header order, page titles, certificate fields and TLS versions. The Danfoss persona sends nginx headers in the same order as a real AK-SM 800A. The Dixell persona sends no Server header and pads its page to exactly 8,202 bytes.

- Recognising exploit attempts. It recognises CVE-2025-41450, the Danfoss “code of the day” login bypass, and records whether the submitted code is correct for today. It also tags attempts targeting three other Danfoss CVEs and the XWEB vulnerabilities.

- Letting them in. Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first. Nothing behind it is real.

Two instances have been live for a day. So far they’ve only seen generic scanners and Shodan’s crawler, which is called refrigerator.census.shodan.io.

Feedback welcome, especially from anyone who has seen these devices in the field!

xrd 1 hour ago | parent

Wait, I recall reading the threads about someone speculating there was a hack. Some people suggested it could just be that a large percentage of refrigeration units received a software update at the same time which resembled a hack.

Is there a definitive story that someone actually did hack these units on a grand scale?

eterm 42 minutes ago | parent

There have been (at least) two separate waves to this now, which makes the "innocent broken update" speculation much less likely?

Bengalilol 42 minutes ago | parent

Now, as of November 2026, it is confirmed as a hack.

Confirmed exploits, many manufacturers, experts, …

hedgerow-dev 20 minutes ago | parent

My view is that some companies installing this have not implemented any defense in depth and cut corners all around. Installing a firewall with a simple vpn service would probably have prevented lots of pain (unfrosting). In general we also see almost every security expert working at banks or other high paying companies and not for supermarkets. My feeling is that this 'niche' is probably interesting to spend some 'tokens' and time on.

raizer88 39 minutes ago | parent

This type of attack lasted few days in different countries, quite hard to believe the fridge manufacturer could keep pushing these updates after all the news around.

embedding-shape 21 minutes ago | parent

> Is there a definitive story that someone actually did hack these units on a grand scale?

Given the scope here (see map at https://en.wikipedia.org/wiki/2026_French_supermarket_refrig...), it'd either be individual hackers getting inspired from their neighbor hackers, or one actor targeting European countries.

Although seemingly the hack wasn't so sophisticated, maybe it's truly just some kids fucking around with what they see being open, and maybe just want to target European countries for the "lulz" or whatever, who knows.

hedgerow-dev 18 minutes ago | parent

It's most certainly a form or hybrid warfare. While being very easy to perform, it's still quite effective. Empty supermarkets and supply chains being disturbed. Hopefully this is a wakeup call for the industry.

noir_lord 5 minutes ago | parent

> Hopefully this is a wakeup call for the industry.

Would be nice but none of the other <waves at cybersecurity for the last decade> events has been.

It seems like something horrific is going to have to happen before this is taken as seriously by government and private orgs as it should have been, that seems to be how it works with other stuff historically.

jknoepfler 5 minutes ago | parent

Fwiw, the first thread I recall was a speculative blog post about commissary freezers for the US military: https://news.ycombinator.com/item?id=49508506

supriyo-biswas 42 minutes ago | parent

I would be very skeptical of anyone relying on Shodan data. At one point I was trying to write honeypots myself by replicating wifi cameras, but almost all the ones on the internet I found were honeypots of some sort, and the ones that weren't were already hacked and had their web pages replaced. In retrospect it would have probably been better to get a vulnerable device myself and probe it.

If I were you, I would probably ensure that the fridges you used have residential or commercial (aka non-DC) IP addresses. Maybe Shodan uses this data for their "honeypot" label, my experience was some time ago so no idea though.

hedgerow-dev 23 minutes ago | parent

At this point the honeypot I'm running is not marked as honeypot. Guess that it's a good sign?

supriyo-biswas 16 minutes ago | parent

What I meant is that I'd find some way of ensuring that I'd want to ensure that the responses you're serving up are real. If you are happy with what you have, we're good.

IshKebab 40 minutes ago | parent

The hilarious thing about this is that there was an initial hack, and then like a month later another one that was equally successful. Who could have possibly seen that coming lol.

> Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first.

I think we're past the point where it's reasonable to expect people to not use AI for code, but their prose still sucks balls. You should at least write your submission here yourself, come on.

hedgerow-dev 19 minutes ago | parent

I agree, I rushed this one a bit. Glad to share with the industry at least.

uptrails 5 minutes ago | parent

> The hilarious thing about this is that there was an initial hack, and then like a month later another one that was equally successful. Who could have possibly seen that coming lol.

How many information security or IT people do you imagine a typical European grocery store employs?

That's the thing: we build IoT technology that requires constant unobvious maintenance, and we then sell it to people who can't possibly do this kind of maintenance. This is on us, not them.