Posted by Zeekaas 15 hours ago
Related:
https://www.claroty.com/team82/research/freeze-the-controlle...
I think the military commissary's freezers were hacked - https://news.ycombinator.com/item?id=49508506 - Aug 2026 (239 comments)
On the bright side I'm sure the manufacturer and others will have an increased security posture going forward.
I initially misread it as "On the bright side, I'm the manufacturer..." (and earn a nice profit).
Wonderful world we live in where refrigerators and cars also become e-waste because a manufacturer gets tired of patching them
We're in a "post-patching world" in that the number of 0days coming out is so rapid, I'm not sure it would even matter.
The physical architecture itself is the problem. There needs to be better controls (physical and software) to access those systems. Airgap possibily.
It's not immediately obvious to me why fridges in supermarkets need remote control; a supermarket is a place where there are always people, it's not a base on Mars. And even if a remote is needed, it should probably not go further than the manager's office.
I don’t know to what degree control is needed, but remote supervision of cold holding temperatures is good to make sure food doesn’t spoil. Most places that don’t have networked fridges have staff manually logging the cold holding temperatures to make sure things are working.
Again, though, I don’t know about making changes though.
The other, more likely, answer is that there’s a diagnostic mode that allows raw control of the system and no one bothered to require physical presence to enable service mode.
With remote firmware update capability, at attacker could easily brick the entire fleet. With just service access it could be possible but would be more complex.
Having networked telemetry seems like a good idea, just not sure why they would need remote control too - that seems far more dangerous than necessary.
Wow, are you an optimist. The manufacturer has stated that they're past the period of security updates. And others... meaning the supermarkets? They outsource that. The people they outsource it to? Maybe they'll start paying attention to security.
Probably to inflict pain on the life of the voters so they can blame the government and manipulate the 2027 French presidential election in April. Maybe just a test.
Same as the high velocity train being sabotaged again just in the Spain national day. Hybrid war.
In France this benefits the pro-Russian Lepen's party with the "government is a disaster but we will make them pay for your suffering". Page "16" of the manual. In the end is all the same handbook all around the planet.
Just by the record, EU has just approved the biggest packet of sanctions against Russia so yes, they know. The more desperate grows Russia, the more this will happen. Until it will stop, suddenly, for no reason.
But it could be just for the lulz.
Remember the hackers behind the seven proxies, AntiSec, which hacked the NATO library website, and went to prison for it.
I wonder how many more decades of screaming into the void will be required for it to be taken seriously by those who deny any/all security efforts until after the disaster has already happened (and then still will only approve the absolute minimum required efforts)...
For the same reason, we hardly have heating meters in Germany that aren't wireless connected to the maintenance company.
To save costs doing maintenance trips to check their state.
Modern HVAC and fire control b systems for buildings are often connected now as well
It also wouldn't be a big deal when a supermarket employee makes an old-fashioned phone call (gasp!) to the refrigerator service company when some red light starts blinking ;)
Will they never learn?
The problem is that many of these setups are put behind essentially consumer connections, but with a better support contract or simply fitted with a 5G modem and a SIM card from the cell provider with the cheapest plan.
Building a WAN isn't magic, but it does require working with (competent) ISPs and paying the higher cost.
Yes you might need to be able to centrally monitor and manage things but that should be happening on a private network.
How exactly would a more obscure (or even “analog”) encoding help? This seems orthogonal to reducing surface complexity and remotely executable command subsets.
The idea is not to solve everything with one simple trick, but to reduce the attack surface as much as possible in hardware. If you are dumb enough to make your 4 messages something like off, on, hard reset, random dangerous maintenance protocol, then it does nothing. If instead it encodes 4 useful and typically used states that can't destroy your system, then you have massively reduced the requirement for onsite, and accepted that more serious issues require onsite control.
If it's a lot, maybe the manufacturers should be compelled to provide security patches if remote control is required to operate their products. For the sake of national security, of course.
* Fridges are read-only through their remote interface.
Both of these can be true if you must connect them to the internet.
I doubt the fridge has a remote-controlled robot arm to unload itself.
Meanwhile you can use analog gauges if you need perfect max temperature monitoring.
That's what always pisses me off about this. Someone brought up "Hey, if we connect this to the internet to enable that feature, someone will start hacking fridges and hurting our customers, and I don't think the stupid page with a temperature graph on it is worth that tradeoff", and some ass told them to get over it and implement it.
Raymond Chen used to write about feature development at Microsoft, specifically how every single new feature idea started from a negative position, since it requires support and testing and engineering and thought, and has future repercussions, so it's often not a good idea to just add box checking features.
Microsoft believed this in the 90s. For things like UI functionality. That's the effort and thought and restraint required to have a consistent UI, for things to be thought out.
Somehow, between then and now, the industry threw all that thought away, and now everything has 400 totally unused, half implemented, utterly broken features.
Why are we here? "Move fast and break things" just breaks everything eventually. Someone, somewhere, eventually has to fix stuff.
That's termed Post-IPO problem. :)
> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".
They sell fricken refrigerators for God's sake. Maybe I can understand planned obsolescence for a cell phone, but a fridge? And especially to grocery stores that operate on razor thin margins to begin with, the idea that they'll just dump their old working refrigerators because the manufacturer refused security updates is a guaranteed recipe for stuff like this.
AK-SM800 looks like a current product. Danfoss have a PDF dated 2026.06 about it: https://assets.danfoss.com/documents/latest/590332/BC3376298.... This mentions "All new Electronics platform supporting new Operating System (based on Linux)", and specifically advises against connecting it to the internet.. Reading between the lines, especially section 10.5, it sounds like there was a major security revamp in 'release 4.0'. The article mentions "outdated firmware", so perhaps that refers to things before 4.0.
AK-SC355 looks like a product from 2010 (that's the date in the PDF metadata, plus the examples in the manual mention 2009). https://3.imimg.com/data3/ID/LC/MY-3170595/danfoss-system-ma...
I haven't worked with supermarket control systems, so I only know what I've read in the PDFs, but it looks like this is not about throwing out entire fridges to update the control system. If you have the newer AK-SM800, it looks like the suggested action is to update firmware and follow instructions about keeping it well away from internet access. If you have the older AK-SC355, then keeping it away from the internet is even more important. Or, update to AK-SC355.
But the hack has already been disclosed and it's the responsability of the manufacturer to ensure that the fridge keep ever up to date or offline.
As with the USA Defense hack, it could have been prevented.
The hack: https://blog.claroty.com/team82/research/freeze-the-controll...
I can't for the life of me understand why these systems aren't air gapped, or at the very least network access is restricted to a small number of IPs or hardware keys.
I could see remote monitoring (of temps) and logging on the system (cycle time etc) but does one really need to control the defrost cycle? It's probably just a web interface on a single controller that used to be accessed by HVAC techs only.
> > "legacy" products which "no longer receive software or security updates".
Because it's the EU I have to wonder if they will finally mandate that software go into escrow and be released if support stops.
Hopefully it will extend to consumer tech like iPhones and other “waste as soon as {corp} is done with it”
They use cold cases and have rooftop or outdoor condensing units and evaporators inside of the cold cases/freezers/etc. There’s refrigerant piping running all over the place and there’s a bunch of sensors and relays that are automated to manage the refrigeration system.
My assumption is the Danfoss control system they’re using is EOL, it’s the grocer’s responsibility to upgrade their automation equipment if it’s unsupported.
> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates". It said its AK-SM800 and AK-SC355 fridge regulator systems were notably affected, with a version of the former using "outdated firmware". It added that it had long advised supermarkets to update from those models.
That being said I am curious what is typically the amount of time for software support offered on a newly released equipment and how common it is for super market to use obsolete software (especially for the part which carry some security risk like something with remote control). Also what about the insurance? Will they (fully) cover the financial loss? I don't know what is in their insurance contract and I am not a lawyer but it seems to me that using obsolete software make the supermarket responsible to some extent
It's a near guarantee. I've been in dozens of power plants where the engineering workstations or operator interface terminals are running Windows XP or Windows 7. More than zero of which were not properly air-gapped. If those sites (with sizable CapEx budgets) delay upgrading for various reasons I would expect grocery store chains to keep whatever they have running until it's broken to the point of not being fixable without a complete overhaul.
https://www.danfoss.com/en/industries/food-and-beverage/dcs/...
Dispatch an HVAC tech if an alarm comes up. Physical access should be the only way to shut down a system like this.
Your opinion does not change the fact that virtually every automation system can be access remotely. It can be done safely with proper access controls.
gestures broadly
No, there is not always someone onsite with the experience and knowledge to monitor and change the system. Grocery stores do not have staff refrigeration techs onsite, they contract that out.
The family run supermarket I'm very familiar with that eventually was taken over by Hannaford absolutely had their own HVAC techs. Years ago at least.
You know what Hannaford did to that store after they bought it? They said that it would have to be a "smaller" store in their system, with less product diversity, fewer departments, less attention, less investment.
Do you know what that store was famous for, and why Hannaford placed it as the center of that deal? Because it did really really well, ran very profitably, and was essentially preferred by the (poor) community despite the Walmart 10 miles away. This store was so well run in the opinion of Hannaford Corporate, that they gave the former assistant manager, who had a working relationship with Hannaford for 20 years, priority over other internal applicants for high level management roles in order to get him to fix their problems at other stores. They lost another valuable manager due to that decision!
Their problems at another store were that it takes in $1 million a day but they refuse to pay more than local minimum wage to staff it. They struggled to keep that store staffed well, and this store in one of the wealthiest neighborhoods in the area looked like shit because stuff was never done.
Hannaford is currently seeing incredibly stiff competition from Market Basket and Costco. People who have trusted Hannaford (in the new england way where it means something) their entire lives are turncoating to Market Basket because why the hell not? It's just a store. They all suck. They can't compete on prices because distributors and upstream corporate behemoths set the prices. They can't compete on quality, because they buy that product from the exact same truck. The company explicitly has chosen to go the direction of competing on vibes of "Upmarket" product lines from the in house brand.
You know what Hannaford didn't do? Raise wages. You know what that Manager eventually did? He re-retired and gave up the good pay, good benefits, reliable and easy income to trade for being a physical laborer and building decks for rich people, because then nobody will be so stupid as to tell him to not do the things that he knows would improve things, and has the 40 year career to back it up. Hannaford had been courting him since the 90s, because that's literally how competent he was. This man went back to destroying his body, after a diagnosis of Rheumatoid Arthritis, After a new Marriage, after economic uncertainty, because he literally wasn't allowed to be a good fucking manager of a business that he has known in his bones for decades. They didn't let him solve all their problems! Because either that would have affected how they want their profits to work, or because that's just how stupidly pig-headed and petty the modern Executive class is.
We fix it when it breaks. We replace it when even the aftermarket doesn't supply the parts to keep it working.
If you want to defrost it presumably someone already needs to be physically present to unload the fridge?
They had a contract with a fridge company, and the service agreement required remote monitoring such that, the service company would be able to detect and troubleshoot remotely, and schedule calls.
The problem with situations like these is that your network security falls to the lowest common denominator, which in this case, is a group of HVAC technicians.
The conversation was something like this:
HVAC company: "Oh yeah, our software does this, and that, and we monitor everything, and thats why our contract is less, we dont waste time and we use sophisticated technology. And of course its 100% secure because expert boffins wrote it."
Grocer w/ 2% margins: "Sounds great."
To be clear, I'm not throwing shade on HVAC technicians. I'm only saying, they aren't network security specialists, thats all.
Given that we agree that HVAC technicians can't be relied on for network security, this is 100% on the fridge company for having insecure software. If it's a bad password or an unchanged default password that's still on the fridge company for not enforcing something better
The grocer likely has the least expertise. The HVAC company has more, but as evidenced by the article, not enough.
Now obviously, these companies have internal "information systems experts" but again, how does the banana guy interview a CIO ? Grocery store CIO might have gotten the job because he made the banana guy comfortable by talking about sports.
Each party was confident in a successful outcome, until the 15 year old kid across the globe pulled the rug.
The processes that created this situation were inadequate, because glad handing and name dropping cost less than formal systems validation.
Of course, the other way to view all of this is ... they just completed formal systems validation, found 1 bug, and paid whatever the food spoilage cost was for it, because no matter how much preperation one does on a project, at some point the power switch gets flipped, and its wait and see.
In a group project, noone is ever sure if Poindexter over there in the corner is quiet because he's quiet, or is quiet because he knows the code is crap and his boss ordered him to ship it anyway.
We're likely dealing with at least 4 companies here, if not more:
contracted programmers <-> fridge equipment maker <-> HVAC sales/service group <-> grocer
3 of the 4 companies could have all said to themselves "Project ships on Monday, no matter what" because who carries the risks for any flaws ? The grocer(s).
They're selling network-accessible equipment so it's their duty to make it secure within some well-defined envelope. How's that any different from any other part of engineering and product development?
> "Project ships on Monday, no matter what" because who carries the risks for any flaws
Soon that will be the OEMs, per the EU Cyber Resilience Act [1]:
> Directive (EU) 2024/2853 [on liability for defective products] of the European Parliament and of the Council (16) is complementary to this Regulation. That Directive sets out liability rules for defective products so that injured persons can claim compensation when a damage has been caused by defective products. It establishes the principle that the manufacturer of a product is liable for damages caused by a lack of safety in their product irrespective of fault (strict liability). Where such a lack of safety consists in a lack of security updates after the placing on the market of the product, and this causes damage, the liability of the manufacturer could be triggered. Obligations for manufacturers that concern the provision of such security updates should be laid down in this Regulation.
With floor planning, the loss itself could be spread across multiple companies, under multiple insurance policies.
With that said, this particular hack could easily be a systems / networking "configuration error" and not any particular piece of softwares fault ( as in a bug, or hardcoded backdoor password. )
The 'fridge company' and other product manufacturers decided to skip all that and run everything on a raspberry pi with apache, or an ESP32 soldered onto the control board, and call it finished. There are millions of these devices out there.
I happen to have a Danfoss HVAC controller here, and its controllable via Modbus. Its an older model, but its my understanding that larger HVAC systems commonly use Modbus.
Modbus systems are multi-drop serial, and the hack likely came in from the server side of one of the companies involved, and the HVAC controllers were all sent defrost commands. Thats my guess anyway.
I have a pump thats Modbus controllable as well, made by a company called Grundfos.
Gonna make a water battery.
Shift my cooling load into off-peak rate hours.
Stickin it to the power man. :D
Seriously, you guys would love these pumps.
https://product-selection.grundfos.com/us/products/magna-nor...
It has wifi. Neighbor kids are gonna defrost me. :(
I'm in the beginning stages of giving my home HVAC system an upgrade and using Modbus throughout with various adapter boards.
https://www.claroty.com/team82/research/freeze-the-controlle...
https://krebsonsecurity.com/2015/09/inside-target-corp-days-...
Newer PCI standards require much more secure customer-facing terminals and much more secure back-end systems so that much of this attack could not happen again.
https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec...
You have clearly never stepped foot inside an Albert Heijn store.
I have not. I travel in the ALDI circle.
2.1% net profit is what AI says the US grocery industry averages, so individual product margins would be higher.
edit: these are unlikely to be directly connected to the internet, but rather part of an internal network that got popped, likely a while a go too
These aren’t consumer refrigerators, it’s a collection of large cold rooms and cases with a bunch of refrigerant tubing and multiple condensers, evaporators, and sensors. It’s a bit more complex than a single home refrigerator.
Also adjust power usage depending on time of day and such.
Otherwise, this sort of spoilage could easily happen by accident as well.
These are minimum wage workers - they don't have bean bags in the nap room, employee massages and stock options.
Groceries see HVAC in the same way. If they can get their issue addressed or diagnosed by their HVAC contractor without him having to schedule and physically travel to their site, they'd prefer him to solve/start solving the problem immediately. Time is money and the faster the tech can diagnose the problem, the faster he can get on fixing it.
And yes, the prevalence of these systems means that many HVAC techs have the ability to turn off their customers' air conditioners/fridges. They don't use it maliciously, because that would be actual suicide for their business.
---
Source: A close friend of mine runs an HVAC business (~8 employees) doing residential and commercial installs, repairs, and maintenance.
I think the cost/benefit equation is gonna collapse in the era of AIs exploting vulnerabilities at scale, but it's not like there's zero theoretical benefit of this capability on its own.
Take away the security aspect and centralized management is just so much easier and reliable. Humans suck at doing things they were supposed to.
There is a ton of refrigerant piping, multiple condensing units, multiple evaporators, relays, and sensors connected to a controller that automates the refrigeration system. Not standalone refrigerators.
I shouldn’t need to list the benefits of remotely monitoring a system that can cause tens or hundreds of thousands of dollars if it fails.
The systems track all kinds of data and are decent at predicting failures before they get expensive.
So we schedule service, and then we throw away all the food anyway because the problem cannot be addressed remotely.