The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food", which the attackers apparently took to be a good suggestion.
As the firmware is open for anyone to download [2], blurring the affected function seems more like an invitation to find out more. I know I was curious when the news about the fridges in France broke. The function's actually called "check_code_of_the_day", and this is the implementation:
uchar check_code_of_the_day(LPCTSTR pass) {
uchar uVar1;
LPCTSTR pass_local;
DATE_STRUCT date;
INT32 tothex;
INT32 hex;
UTF8_STR buff;
Get_syst_current_tds(&date);
ftext_s(buff,0x1ff,"%02d%02d%02d%02d",date.month,date.day,date.year,date.month);
sscanf(buff,"%lx",&tothex);
ftext_s(buff,0x1ff,,date.day);
sscanf(buff,"%lx",&hex);
tothex = __aeabi_idiv(tothex,hex);
ftext_s(buff,0x1ff,"%05ld",tothex % 100000);
if ((((*pass == buff[0]) && (pass[1] == buff[1])) && (pass[2] == buff[2])) &&
((pass[3] == buff[3] && (pass[4] == buff[4])))) {
uVar1 = '\x01';
}
else {
uVar1 = '\0';
}
return uVar1;
}
[2] https://www.danfoss.com/en-us/service-and-support/downloads/...
With all the disruption from AI on our industry, I can’t help but feel a little jealous.
You now have the ability to remotely monitor the system but hacking it does not allow you to control anything. Though there is still a sizable amount of infrastructure which has no on site workers and needs to be remotely controlled.
There is no evidence AI was used to do this and it feels like a random way to force AI into the conversation? It’s just spectacularly negligent behavior by people who think that they don’t have to trouble themselves with security, but want the convenience of having their stuff on the Internet for remote management.
This is just like the OPM hack 10 years ago.
As long as the fridges are used the controller has to be supported.
This isn't a raspberry pi $50 a pop...
“Why would a bunch of equipment malfunction?”
“Because you plugged it into the internet, you dolt.”
so of course that creates/enables the problem and doesn't notify us.
deliciously ironic and rottingly sad.
this case was egregious - built-in backdoor pw - but that is downstream of the decisions to IoT them and to default them to listen on the network.
I can't understand the mindset that would treat this as a trivial problem. What's sad is your confidence in giving this situation a 5 second take and declaring the whole thing stupid. Yes, security was clearly an issue, but saying that monitoring of critical infrastructure is sad is bizarre.
And it still isn't going to save electricity. The only thing it can do is warn of a failure and tell you that you got like 20 minutes to start moving food before it has to be trashed for exceeding safe food handling temperatures.
But they are perfectly capable of checking the temperature. After all the fridges and freezers are restocked multiple times a day so even if one failed it wouldn't have time to get warm before someone should notice.
Ad there are other ways of monitoring such as having an audible or visual alarm.
The AK-SM 800A can control 170 different refrigeration devices. This is more akin to the entire freezer section (and probably meat and dairy) in your supermarket.
A valid question which has yet to be answered (at least not publicly).
Edit: Yes i know the commercial fridges do not have "dials" and it's more involved. Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.
Sure, with time and expertise. How does the average employee adjust the virtual thermostat on fifty network-controlled fridges before the food goes bad?
Unless of course they turn it off without telling the businesses so the products go bad because nobody's watching over the weekend or smth. But then again, why would someone want to do that. I wonder.
There may yet be hope that a few stores survived. Possibly even a village or hamlet. In the vast rubblescape that is now France.
https://trends.shodan.io/search?query=http.favicon.hash:-853...
Over the past few years it has fluctuated but not the same continued growth as before. If you don't have a Shodan account you can see a chart on twitter: