Hacker News Reader

Comment by jttnr | Hacker News Reader

We all know the saying: The S in IoT stands for secure.

A quick search puts the list price of the touchscreen-equipped controller at around €7,000 [1]. So this is hardly the typical dirt-cheap IoT device you can buy for a few bucks from China. The product label also says "Made in Denmark."

This vulnerability certainly appears more complex to exploit than the ones routinely found in cheap IoT devices.

Still, I wonder why, in the age of Tailscale and Nebula, a large company like Danfoss doesn’t use overlay networks to make these services accessible only to technicians and other authorized personnel, rather than exposing them publicly. From a technical standpoint, a company with 40,000 employees should be capable to pull this off.

[1] https://www.lefroid.fr/fr/c/p/402785

View on HN

>The product label also says "Made in Denmark.

That label only means most of the final assembly process have been completed in Denmark, it doesn't mean all HW & firmware inside of it have been developed in Denmark by vikings.

A lot of HW & FW by EU companies whose main specialty isn't HW and FW, tends to be outsourced to third party consultancies (sometimes even offshored), who won the bid to do it as cheap as possible, so you never know what quality you're gonna get inside of it, despite the provenance label.

One of the biggest scams right now is the Made in Germany label on cars/household appliances, which isn't in any way an indicator of quality like it used to be.

I promise I'm not simping for Danfoss, just because I'm danish, but... Is it really their fault the customers aren't putting these things behind VPN? Yes, the thing should be secure ideally, but why take the risk?

Agreed, it's not necessarily Danfoss's fault. The customer bought the appliance and is free to do whatever they want with it, that's what ownership is about and I fully support this. But in a situation like this, who bears responsibility? The customer whose appliance is exposed to the internet, likely having been installed by an authorized technician in the first place, or Danfoss, whose now-insecure maintenance interface listens on 0.0.0.0? I don't have an answer.

As others have pointed out, this interface is intended for use by service personnel.

My point is simply that situations like this can be prevented in several ways: on the customers side, if they have a capable IT department, or on the vendors side, by designing with the expectation that some customers will inevitably expose devices to the internet, regardless of what the manuals and training materials say.

Reply on news.ycombinator.com