This is pretty interesting as the Danfoss vulnerability was suspected to be related to a similar situation that occurred across US military bases in late August 2026.<p><a href="https://signalandsilence.substack.com/p/i-think-someone-hacked-the-commissary" rel="nofollow">https://signalandsilence.substack.com/p/i-think-someone-hack...</a><p>Could this be the same group? Or someone inspired by reading that article? Or just entirely unrelated?
Looks like that specific vulnerability was found this summer, disclosed in coordination with the vendor and at least some models were patched [0] (unclear if all models were), but from early reports:<p>- they either didn't warn their customers this was a critical security patch,
- many of these fridges/freezers were directly accessible on the internet with their own 3G/4F SIM cards without further protection!<p>Crazy stuff<p>[0] <a href="https://www.claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers" rel="nofollow">https://www.claroty.com/team82/research/freeze-the-controlle...</a>
Previous discussion <a href="https://news.ycombinator.com/item?id=50055304">https://news.ycombinator.com/item?id=50055304</a>
Dupe: <a href="https://news.ycombinator.com/item?id=50057956">https://news.ycombinator.com/item?id=50057956</a>
Good. I’m not happy that this happened. That’s a large financial loss. I don’t like thinking about all the good, edible food thrown away instead of nourishing people. But the infosec thing that keeps me up at night is the utter lack of SCADA security. “Relax! This dam won’t collapse as long as no one guesses our public IP address!”<p>Lots of industrial controls haven’t been updated since they were deployed in the 90’s. “And why should they be? If it ain’t broken…” Well, because <i>they’re freaking broken!</i><p>So I’m glad that this happened in a tangible, public way people can easily understand without it involving something much more drastic. If your family asks about this, explain that you’re glad no one blew up a gas pipeline… yet.
There is certainly a need to raise awareness of the danger of connected/online devices. If something is connected to the public Internet then it can be attacked. If something has built-in wireless connectivity then it can be attacked. Unfortunately it really is as simple as that. Safeguards are needed accordingly.<p>Connected vehicles are the example that terrifies me the most. There have been numerous examples of lax security in this area already and a fleet of rogue cars or delivery trucks could obviously cause huge amounts of damage, injury, and loss of life.<p>There's a legacy of openness in car tech and software that was never designed with robust security and isolation of critical components in mind. I've heard that this has started to change more recently and that's reassuring if true. But this still feels like an area with far too little regulation or oversight given the past choices of vehicle manufacturers and far too much rush to connect everything up remotely even for minor convenience reasons.<p>In some cases there also now seems to be legally mandated connectivity for things like automated emergency calls after an accident. This should at least have a genuine benefit in the unfortunate situation that it's needed - but until vehicle security looks more like Fort Knox than a sandcastle it might still prove to be a bad choice in the end.
> The software allows retailers to manage their cold units remotely.<p>Will they never learn?
To not control any industrial processes remotely? I hope you realize that requiring that would make solar and wind farms completely non-viable, among many, many other things.
If they didn't do it that way, some bad things would happen: sometimes a fridge would fail and the food in that fridge would spoil.
Of all the things to put on a network, this ranks as one of the dumbest, ever. You don't need control of the unit done over a network, just the data on whether it is working or not. Anything else is simply asking for someone else to come along and break your stuff.<p>To boot, refrigeration has been wholly automatic for decades. It literally runs itself. It doesn't need any network connectivity other than to say "I work" and "I'm broken" and that's it. Allowing control commands to be sent over the network is, yet again, just asking for trouble.
no more french fries!!!
> While they may be known across the world as ‘French fries’, <i>there’s nothing French about them</i>. The name ‘friet’ comes from patates frites, Belgian-French for ‘fried potatoes’. One possible explanation for the association could have been formed in the First World War, when American soldiers were introduced to ‘fried potatoes’ in Belgium, but thought they were in France because that was the language spoken in that region. Whether you call them Flemish or Belgian, our delicious fries are made from bintje potatoes per tradition, and are the tastiest you’ll find anywhere on the planet.<p>Source: <a href="https://www.visitflanders.com/en/discover-flanders/culinary-treats-and-belgian-beer/fries" rel="nofollow">https://www.visitflanders.com/en/discover-flanders/culinary-...</a>