Posted by hedgerow-dev 4 hours ago
To learn more about this I built a honeypot that resembled perfectly the Danfoss AK-SM 800A and Dixell XWEB interfaces. Both of them are recognized on Shodan as real ones (an not as honeypots). It’s one Python file using only the standard library, and it builds on eppser/danfoss-ak-sm-decoy and public research by Synacktiv, Claroty and Ironhackers.
Things that were fun to get right:
- Matching real units. I used Shodan records of real devices to match header order, page titles, certificate fields and TLS versions. The Danfoss persona sends nginx headers in the same order as a real AK-SM 800A. The Dixell persona sends no Server header and pads its page to exactly 8,202 bytes.
- Recognising exploit attempts. It recognises CVE-2025-41450, the Danfoss “code of the day” login bypass, and records whether the submitted code is correct for today. It also tags attempts targeting three other Danfoss CVEs and the XWEB vulnerabilities.
- Letting them in. Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first. Nothing behind it is real.
Two instances have been live for a day. So far they’ve only seen generic scanners and Shodan’s crawler, which is called refrigerator.census.shodan.io.
Feedback welcome, especially from anyone who has seen these devices in the field!
If I were you, I would probably ensure that the fridges you used have residential or commercial (aka non-DC) IP addresses. Maybe Shodan uses this data for their "honeypot" label, my experience was some time ago so no idea though.
a supermarket has no security team. If a fridge controller needs patching, a VPN and a strong password to be safe, that work has to come from the vendor or installer by default. One would hope that all these come by default or as a feature on these devices. It could even be a selling feature and not part of an expensive maintenance contract. A supermarket manager cannot be expected to do this work.
This model has worked fine for many other types of risks.
Is there a definitive story that someone actually did hack these units on a grand scale?
Confirmed exploits, many manufacturers, experts, …
Given the scope here (see map at https://en.wikipedia.org/wiki/2026_French_supermarket_refrig...), it'd either be individual hackers getting inspired from their neighbor hackers, or one actor targeting European countries.
Although seemingly the hack wasn't so sophisticated, maybe it's truly just some kids fucking around with what they see being open, and maybe just want to target European countries for the "lulz" or whatever, who knows.
Would be nice but none of the other <waves at cybersecurity for the last decade> events has been.
It seems like something horrific is going to have to happen before this is taken as seriously by government and private orgs as it should have been, that seems to be how it works with other stuff historically.
MFs be doing everything but pulling those fridges off the Internet. Given the amount of TOR nodes, IP addresses today, Honeypots mean nothing ....
Of course, it's my unpopular opinion. :)
> Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first.
I think we're past the point where it's reasonable to expect people to not use AI for code, but their prose still sucks balls. You should at least write your submission here yourself, come on.
I was happy reading you post and I imagine there are many many more people like me than the grinch.
I don't think it's unreasonable to spend literally 3 minutes writing your own submission. I'm not asking to rewrite every code comment.
And it wasn't "slightly" AI sounding text. It's very obviously AI.