Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • Does this amount to gross negligence?
    by Cameri
  • Sadly, I guess they won't have to worry about patching this issue now that everything's been looted and burned down.
    by xp84
  • Through my work I deal with grocery software and I can tell you that grocery software is ages behind the times. For most small retailers (small being a business owner with less than 10 stores in their retail chain, mostly local grocers) you are dealing with processes that would have been considered antique for the year 2000
    by SOLAR_FIELDS
  • No one at Danfoss got alerts than sudently hundred of fridges entered defrost mode? Reminds me of those computer you see at stores running weird ms-dos software.
    by Thaxll
  • From 2017 through 2022 there was a large increase in the number of exposed refrigerators:

    https://trends.shodan.io/search?query=http.favicon.hash:-853...

    Over the past few years it has fluctuated but not the same continued growth as before. If you don't have a Shodan account you can see a chart on twitter:

    https://x.com/shodanhq/status/2110526116679021055

    by achillean
  • So the author charitably calls the 2025 vulnerability an "authentication bypass", but it's much worse than that. The firmware included a "datetime-based password" mechanism: a built-in backdoor password, like it's the 90s again.

    The original researcher published about this in August of this year [1], and as the firmware is open for anyone to download [2], blurring the affected function seems more like an invitation to find out more. I know I was curious when the news about the fridges in France broke. The function's actually called "check_code_of_the day", and this is the implementation:

      uchar check_code_of_the_day(LPCTSTR pass) {
    uchar uVar1;
    LPCTSTR pass_local;
    DATE_STRUCT date;
    INT32 tothex;
    INT32 hex;
    UTF8_STR buff;

    Get_syst_current_tds(&date);
    ftext_s(buff,0x1ff,"%02d%02d%02d%02d",date.month,date.day,date.year,date.month);
    sscanf(buff,"%lx",&tothex);
    ftext_s(buff,0x1ff,,date.day);
    sscanf(buff,"%lx",&hex);
    tothex = __aeabi_idiv(tothex,hex);
    ftext_s(buff,0x1ff,"%05ld",tothex % 100000);
    if ((((*pass == buff[0]) && (pass[1] == buff[1])) && (pass[2] == buff[2])) &&
       ((pass[3] == buff[3] && (pass[4] == buff[4])))) {
      uVar1 = '\x01';
    }
    else {
      uVar1 = '\0';
    }
    return uVar1;
  }
    [1] https://www.claroty.com/team82/research/freeze-the-controlle...

    [2] https://www.danfoss.com/en-us/service-and-support/downloads/...

    by Confiks

Explore Birbla archives