Evidently, the username was admin and the password was automatically reset to the current date, every day. More of a gross negligence issue than a hack, IMO.
So that's still a firmware issue indeed for me, no admin set voluntarly its password to current date.
The write-up in question: https://claroty.com/team82/research/freeze-the-controller-de...
You still can do it, but it better be a super low level private network: basically a super low VPN/crypto without using any off-the-self kludge, open source or not, probably directly implemented in some hardware driver in assembly for machine code/hardware control (if traffic was "big", it would have been FPGAs, probably). And you ** _MUST_ ** have a permanent and significantly sized and competent "security" team 24/24 7/7 ** you can trust ** for monitoring and looking for "pertinent" flaws.
Mechanically, the effort required is some exponential of the machine code (compilers are a [trust] problem, not a solution) size, complexity and code unstability (change over time).
No, trusted compilers of comfy computer languages do not exist by definition, eat the bullet.
Related to crypto: I wish we had some open source binary specifications implemented in various ISAs for some micro-architectures. You want machine code here, not even C or whatever (or at best only for those binary specifications).
And don't be a fool, ASIC trust will be a thing: some features will have to be disabled, or you better be ready to change some micro-architecture, yes, would be better to have several micro-architectures based on the same ISA (i.e. RISC-V for zero IP lock) ready at proper scale.
Ive got to disagree there, the mistake is in it not being readonly accessible. Monitoring fridges in such a setting is one of the few times it actually does make sense to put online readonly.
It means someone has to physically go in... So a classic security vs. convenience trade-off.
> There's also a documented authentication bypass: sending a POST request to /xml.cgi can bypass the login entirely.
Edit: TBF, they're ISO 27001 certified. Such cybersecurity! :P
https://www.danfoss.com/en/about-danfoss/news/cf/danfoss-rei...
Never assume that having that certification means that shit is actually secure. It just means the company can do the audit dance.
Always leave an obvious-once-you-see-it, but minor, defect somewhere for the auditor to latch on to. One they can earmark for you to come up with a plan to address the issue before they grant you the certificate (and which you'll be able to write up in no time because you planned for it).
A good auditor and a company actually taking this stuff seriously can benefit from 27001. That probably accounts for 5% of all 27001 certifications out there.
If you're lucky you get an auditor who's just there along for the ride towards early retirement in a few years, and who'll joke with you and eat your lunch. Had one of those once. Doesn't help your security one bit of course, but it makes audit time more relaxed.
But then, no other kind of auditor do either...
passes the password expiration policy, if they used the full month name and spaces then that would be a combination of upper/lower case letters, numbers, and "special chars". "1 May 2026" is the shortest date i can think of and it's 10 chars in length. not bad, not bad, possible dailywtf material.
Amazing