Danfoss A/S

He has a stronger opinion on this.

He said on Mastodon, regarding the Danfoss fridge thing, a lot of the fridges used Danfoss control software.

Regarding the Danfoss fridge thing, doing the rounds in the media, there's several thousand of them that are directly internet facing.

The username is admin.

The password changes every day automatically to...

Uh, but, but no matter what, those all have little clicks on devices that are like snap disk devices that w- when that evaporator reaches a certain temperature, it kicks it out of defrost.

I understand that these are all using Danfoss controls that are able to be controlled remotely 'cause it's good for the r- supermarket to be able to, like, control the temperature up and down, and somebody hacked into that.

There is no way that hacking into that would override the defrost termination.

And, and even if we take that as the example, you're talking about freezers, and you're talking about a freezer in an overnight, right? Because they were at the grocery store till they went home at the end of that night, 9:00, 10:00, maybe 11:00, right?

Yeah

... dollars worth of stuff.

And Danfoss said that, Danfoss said that these were systems that hadn't been updated too, so.

Yes.

No ransom note, no stolen card numbers.

French officials say the weak point was software from the Danish firm Danfoss, and Danfoss says the affected units were running outdated firmware.

A security firm had published research on vulnerabilities in one of its controllers back in August.

That leaves the question the insurance trade press is already asking.

If software destroys physical inventory, is that a cyber loss, a property loss, or an expensive argument between two insurers? Every grocer, pharmacy, and cold storage warehouse with a remote maintenance login now has to answer that before the next one.

And it wasn't only France.

A threat analyst at the security firm Sequoia says stores in Spain, Portugal, Poland, Germany, and Belgium were hit too.

The hackers may not have demanded a ransom, but the insurance adjusters are certainly going to make somebody suffer.

Uh, I actually got some angry email for saying that I was trafficking rumor when it wasn't, uh, when it wasn't confirmed.

But, you know, all of this has come after in August, uh, some, uh, vulnerability, vulnerabilities were disclosed in, uh, Danfoss, like, freezer controllers that are, that are usually connected to the internet, and then lo and behold, uh, freezers start having this sort of stuff happen to them.

What do we know about this particular one, though? 'Cause it looks, it looks bad, right? 'Cause this is a big supermarket chain, a lot of food has been destroyed.

Yeah, this is a big chain and it's affected hundreds of stores, and, uh, I, I, I think the thing that, you know, f- casual observers might not get about this is that supermarkets operate on just-in-time inventory and such razor-thin margins that any sort of event like this of having to, you know, throw out food not only is a huge financial impact to them, but this, this will take weeks, if not months, to actually restore the supply chain properly.

So it's going to have a huge impact for people.

From the technical side, uh, there's a lot of conjecture as to exactly how these Danfoss, um, controllers were compromised.

What we do know is there was a lot of refrigerators, all these controllers were exposed directly on the internet.

Um, it could have been some of the bugs that were reported.

Food spoilage and fires were reported after attackers manipulated refrigeration controllers across more than 700 French retailers.

The affected equipment was running old versions of Danfoss control software.

and temperatures in some refrigerators and freezers reportedly rose as high as 122 degrees Fahrenheit overnight.

France's National Cybersecurity Agency has now been directed to investigate.

And so I strongly believe, although some may dispute this because we don't have concrete evidence, but the French start did come out and say these were unpatched devices.

Well, if you look at Clarity's research on the Danfoss refrigeration units.

they found a vulnerability that was essentially a backdoor.

I use that term somewhat loosely.

So you're able to see how many of the certain controller there are.

So we know that there's about 3000 of these Danfoss controllers out there again.

So there's many, many more vulnerable as well.

So anyone run any script kitty running a script can look for the vulnerabilities.

So you're able to see how many of a certain controller there are.

So we know that there's about three thousand of these Danfoss controllers out there, um, again.

So there's many, many more vulnerable as well.

So anyone run-- any script kitty running a script c-can look for the vulnerabilities.