France's supermarket fridges were vulnerable online for months
ipinfo.io
Related: Hackers activate automatic defrosting in supermarket fridges across Europe - https://news.ycombinator.com/item?id=50055304 - Oct 2026 (1007 comments)
ipinfo.io
The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food", which the attackers apparently took to be a good suggestion.
As the firmware is open for anyone to download [2], blurring the affected function seems more like an invitation to find out more. I know I was curious when the news about the fridges in France broke. The function's actually called "check_code_of_the_day", and this is the implementation:
uchar check_code_of_the_day(LPCTSTR pass) {
uchar uVar1;
LPCTSTR pass_local;
DATE_STRUCT date;
INT32 tothex;
INT32 hex;
UTF8_STR buff;
Get_syst_current_tds(&date);
ftext_s(buff,0x1ff,"%02d%02d%02d%02d",date.month,date.day,date.year,date.month);
sscanf(buff,"%lx",&tothex);
ftext_s(buff,0x1ff,,date.day);
sscanf(buff,"%lx",&hex);
tothex = __aeabi_idiv(tothex,hex);
ftext_s(buff,0x1ff,"%05ld",tothex % 100000);
if ((((*pass == buff[0]) && (pass[1] == buff[1])) && (pass[2] == buff[2])) &&
((pass[3] == buff[3] && (pass[4] == buff[4])))) {
uVar1 = '\x01';
}
else {
uVar1 = '\0';
}
return uVar1;
}
[2] https://www.danfoss.com/en-us/service-and-support/downloads/...
on edit: even though I don't know C or C++ (I suppose it's C but can't be sure) I do think I can figure out what it's doing and how to guess what the password is, so that seems bad.
But the relevant bit is at the end, from “if” to “return”, and should be pretty accessible to anyone familiar with an imperative language who can get past the general ugliness of the code. Once that’s figured out, you can recover the password by copying and executing the rest of the function.
But use strong cryptography (tls1.3) and authentication (oidc)
home or mobile users often have dynamic IPs and thus can't be "whitelisted". Why would you not want someone on their phone access the controls?
And VPNs are just external authentication & encryption mechanisms, you might as well implement those properly inside the application and forego VPN entirely.
Yes, of course use good encryption and auth{n,z}, but _also_ layer on restrictions at the network layer to stop general traffic from even getting there.
There are rarely good reasons to control domestic fridges remotely. Why would you want to trigger defrosting when you are not there?
points vaguely at the exploit and how easy it is to find the targets.
If "change it from their phone" is a requirement, they can connect the phone to shop's network, or VPN from phone to HQ then bounce to the controller.
It is security by obfuscation, yes, but it is somewhat effective at low cost.
> And VPNs are just external authentication & encryption mechanisms, you might as well implement those properly inside the application and forego VPN entirely.
The controllers go out of support after some years. They work just fine, so replacing one if possible is costly and seen as unnecessary.
Putting it between $50 VPN box decouples "keeping VPN software up to date" and "keeping the controller up to date". It also gives your IT a single type of VPN config to support rather than being controller dependent.
The solution is for supermarkets to stop being moronic by putting refrigerators on the internet.
The weird thing is it didn't emit a 32-bit load+compare for the first 4 bytes, this could probably be done with 2 comparsions. Idk. Maybe weird CPU with stricter alignment rules.
> Danfoss takes security seriously and as part of our continued improvements, new measures are being implemented. Please review below important security updates included in the latest AK-SM 800A software update that may impact your upgrade experience
> firmware
Either said 'firmware' is a Windows app, or somebody has Stockholm syndrome
Iirc LPCTSTR is just an alias for const char* , lp being an anachromism of "long pointer" held over from the days when needing to do a distinction for "flat" 32bit pointers since there already was "near" and "far" pointers during the x86 16bit era.
And it's _even worse_ than that. A famous french cybersecurity firm, Synacktiv, published a report in 2023 (!) about the code-of-the-day vulnerability, but it made less noise apparently [1]
[1] https://www.synacktiv.com/sites/default/files/2023-10/synack...
With all the disruption from AI on our industry, I can’t help but feel a little jealous.
Wait what do you mean you want to use a key to log in, our stuff doesn't support that.
Europe doesn't need to continue using fax machines and bury its head in the sand.
There's also the option to adopt digital technology and just not be an idiot about it this time since the price of intelligence is now effectively 0.
Or, France can continue preventing any productivity increases from technology and watch its social systems continue to collapse.
There is no evidence AI was used to do this and it feels like a random way to force AI into the conversation? It’s just spectacularly negligent behavior by people who think that they don’t have to trouble themselves with security, but want the convenience of having their stuff on the Internet for remote management.
This is just like the OPM hack 10 years ago.
Imagine if your neighborhood had a million autonomous door-opening drones randomly flying around identifying doors and entering them. It wouldn't take long for everyone to lock their doors.
All the unsupported iot stuff will be obliterated by malicious bots, but the next generation of iot will be both more robust and less directly exposed to the internet. Like how Matter devices sit behind a hub rather than directly connecting to the internet.
You can not defend everything. At some point you have to realize the world works because not every exploitable thing is exploited and we live in a civil society (most of us anyway).
I get it, the internet makes things different. But your analogy doesn't work You can not build a building that can not be destroyed.
Pretty interesting example, because I'd like to live in a society where I don't have to lock my doors, because it's safe and I trust people around me. Releasing drone police randomly opening doors in the name of security sounds like a strict downgrade, not "a good thing because people will learn".
and don’t live in a city.
Of course, as you said, in a city I will never feel safe enough to leave a door unlocked when leaving my apartment - big cities are big, and even 0.1% of bad apples may spoil things for everyone. But wanting a safer and more high-trust society sounds like a good thing, right? How would disconnecting from the internet help me.
while still living in the real world.
I don’t really “hope and dream” for stuff like feeling safe.
Especially when it can be had for so much less than the not-feeling-safe options.
(and yes, people randomly taking my things makes me feel unsafe.)
Disconnecting from the Internet makes it harder for people to break into your hardware.
> Releasing drone police randomly opening doors in the name of security sounds like a strict downgrade
This is happening on the Internet hourly, and it’s not the police. Well, sometimes. But mostly not.
Though one could argue that "AI" is needed, currently, for an editor to decide that a story about a hack is worth publishing.
(Yes, current-day AI's do shift the equilibrium. Somewhat. The French fridges would not be news if the situation was anywhere near as bad as the doomsayers seem eager to proclaim.)
You now have the ability to remotely monitor the system but hacking it does not allow you to control anything. Though there is still a sizable amount of infrastructure which has no on site workers and needs to be remotely controlled.
Critical National Infrastructure should go further, as Iran found out with Stuxnet.
Nothing could possibly go wrong?!?...
For example, during peak sunlight times, many neighbourhoods now generate more solar than they use. Without a sink for that power, voltages would go haywire on power lines and damage equipment. So the grid uses control boxes to manage how much power each house is allowed to send back to the grid. And all that needs compute, live metering and so on.
They are clearly making money just fine and in very low margin business. Moving cash registers to some electron app and vibecoding inventory management coz current system's app windows are ugly would improve it by 0 to negative %
It is also worth looking at why this is so, which most likely stems from the lack of technically inclined staff in every location and the cost of having a tech going from store to store everyday to deal with POS, back office computers, amd any other kind of device.
Now, can you secure all this? For the most part yes, but it is quite expensive to do it. Maybe they will do it now or they will go with “it cannot happen to us twice” thinking and not do anything substantial about it.
Rather than have extra staff at the store to do stuff like monitor fridge performance, it's better to have them report stuff centrally and have someone or some tool monitoring thousands of fridges across the entire chain. This way you can send out repair teams and plan maintenance more efficiently.
Why would managing fridge temps be a job that requires more than a few minutes a day at most ?
How hard could it be ?
Surely, these fridges weren't doing inventory tracking? (Or were they?)
If a fridge is being opened frequently, the amount doesnt matter but lets pretend frequently means many times an hour, shouldnt a human be able to spot the fridge is warming up because it doesnt look or feel as cold as normally ?
Or perhaos they could look at a thermometer...
If there were actually people wandering around supermarkets manually checking fridge temperatures in 2026, everyone on HN would be saying how easy it it ought to be be to avoid all this pointless manual labor using modern technology.
Its the same thign that separate good cars from the best. They both drive well enough at normal speeds in normal conditions. The best cars save your life when the others make you a cripple or dead in some unfortunate chance bad luck event.
I think, in classic HN style, you're massively underestimating the complexity of a domain that you have no experience with. There's a whole academic literature on optimizing this:
https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=supe...
The software running on fridges should, obviously, be secure (just like any other software should), but air gapping the fridges, and winding the technological clock back a couple of decades, isn't a realistic proposal.
They usually require scheduled service teams maintaining them who have tight SLAs (because a supermarket without fridges loses a lot of money per day) so making sure you have remote access to it so you can bring the right parts with you is probably useful.
This game is nsfw.
Are you implying french fridge makers in real life are stupider than porn?
I love customers that aren't tech savvy.
It's so boring to just sell fridges, let's spy on customers and sell that data! /s
Sad world of greedy things.
The shit will go on until those who makes such decisions start going to jail regularly.
How can the market support so many sources all selling customer data ?
The price has to crash because of the inbalance of data vs customers.
What customer data is this even giving me? How do I get someone's personal information based on the temperature of the drinks fridge in Store #138 in Nantes?
If the application is properly secured (strong encryption, strong authentication) there is no point for the VPN
and if the application isn't configured correctly, the vpn/internal network might not be configured correctly either.
Current security model is clearly not adequate but it would be nice if folks recognized that world is more complex than ie their home situation or some very simple use case they can come up with in their head.
It's the complexity of the world which should drive you towards keeping this stuff offline.
Hell, I used to manage some VoIP switches which would hard-lock if you hit them with `nmap -A`. More people need to learn this lesson.
I don't know lot about fridge internet tech, but I can see that communication is needed to send this data. Having a hub to be able to do it is probably introduces complexity, but also maybe viable solution.
We had a blackout for a prolonged period of time (not 24hrs, but was 12+). Next day thee shop had all the freezers empty. If the "food and safety administration" on your audit catches that you still sold food when temp dropped under x for period of time, I bet you get into trouble.
You also get into trouble if you don't have records to show.
There was far more serious incident very recently where hackers gained control or attempted to gain control of a propulsion system of an oil tanker. Resulting in a military operation to take it back. People need to start treating these risks more seriously.
Edit: Here's the link to the article:
so of course that creates/enables the problem and doesn't notify us.
deliciously ironic and rottingly sad.
this case was egregious - built-in backdoor pw - but that is downstream of the decisions to IoT them and to default them to listen on the network.
I can't understand the mindset that would treat this as a trivial problem. What's sad is your confidence in giving this situation a 5 second take and declaring the whole thing stupid. Yes, security was clearly an issue, but saying that monitoring of critical infrastructure is sad is bizarre.
But they are perfectly capable of checking the temperature. After all the fridges and freezers are restocked multiple times a day so even if one failed it wouldn't have time to get warm before someone should notice.
Ad there are other ways of monitoring such as having an audible or visual alarm.
Also, offline fridges are completely normal.
[citation needed]
Where I live, stores don't open on Sundays. Many apparently do in France, but I imagine not all of them. So there are potentially 24 + 12 hours where nobody's there to check stuff
And it still isn't going to save electricity. The only thing it can do is warn of a failure and tell you that you got like 20 minutes to start moving food before it has to be trashed for exceeding safe food handling temperatures.
To be honest, a grocery store is one of the most dynamic systems I can think of.
Edit: A bang-bang thermostat is not an appropriate solution for a grocery store.
Are the contents of the fridge also being adjusted via remote management tools?
There's making a meeting out of something that should have been an email and then there's making a software project out of something that should have been an email.
The email is gonna go to the managers DL and it's gonna say "hey assholes the new temp is X set your shit to that" but in professional corporate speak and the managers will use their screwdrivers, take off one access panel and turn a dial ever so slightly" and I'll be able to see they've all done it right from my read-only monitoring system. And this has the side effect of keeping food from going bad in bulk because of a bug or fat finger or "Russian hackers" or whatever. The cost of the labor will almost certainly be cheaper than the cost of the software project amortized over its life.
Alerts can be sent, and HVAC operators could have a process where they open a support ticket to get temporary access during scheduled windows by store managers.
I remember setting this up years ago for an hospital. Some third party suppliers could obtain RDP access to some VDI who could only accept a limited number of ips but they had to open a ticket and give a reason to get access. It wasn't a 365/24/7. Monitoring could still be sent any time.
None of it requires connecting the very fridges to the Internet.
Something like tailscale, iroh, Defguard securing these so that they’re accessible over the internet but only by authorized users works just fine.
Your suggestion doesn’t work if I want to actually do the control remotely. It only allows for remote status viewing.
The AK-SM 800A can control 170 different refrigeration devices. This is more akin to the entire freezer section (and probably meat and dairy) in your supermarket.
A valid question which has yet to be answered (at least not publicly).
Edit: Yes i know the commercial fridges do not have "dials" and it's more involved. Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.
Sure, with time and expertise. How does the average employee adjust the virtual thermostat on fifty network-controlled fridges before the food goes bad?
Unless of course they turn it off without telling the businesses so the products go bad because nobody's watching over the weekend or smth. But then again, why would someone want to do that. I wonder.
Could be competition, could be lonely angry incel hacker, could be state actor (ie russia would not be out of picture given their past actions and current war they wage against entire western culture, but they are far from the only ones).
Leave phpbb forum unguarded, it will get hacked quickly. What gain? None apart from hoping to mine some crypto or be part of botnet. Still, will happen reliably.
I'm just saying it wasn't a high value target like a bank. Which is what they counted on.
“Why would a bunch of equipment malfunction?”
“Because you plugged it into the internet, you dolt.”
As long as the fridges are used the controller has to be supported.
This isn't a raspberry pi $50 a pop...
On the other hand, saying an industrial device should receive security updates for 10-15 years instead 5 or whatever happens this days it will be a major step forward. This will incentivise vendors to use better hardware with room to grow, not just the cheapest components possible.
Or, make componente modular so that you can upgrade just the control unit instead of the whole fridge or whatever.
In practice, that would run into (probably, IANAL) legal issues, cost & staffing issues, and the narrow worldviews and business models of the insurance industry.
Honestly I feel like this should fall under a support contract. The pricing structure could be similar to that of Microsoft. Support is fairly cheap, X number of years included in the purchase price, once the product reaches EOL the price goes up dramatically each year.
There's a massive problem in how we think about these products collectively. They are inherently insecure, they will be attacked and preventing it is expensive. You could build a safer alternative, but you'd be priced out of the market instantly by less safe, but more convenient alternatives.
This is how it's done everywhere I worked. You can patch some bugs for cheap in the software, but you can't fix hardware limitations. I know companies that use PLCs that still don't support encryption despite the upcoming EU regulations.
The companies either don't care or are too greedy to spend money on this.
Oh yes you can patch it - that's how I got the 20 year old laminator working where I work. If the hardware is still good you can absolutely change firmware if you have the PLC control software (like RockWell ControlFlash) or know how to manipulate the ladder logic directly.
As long as you have room in memory, you can add functionality.
But because of AI, (1) is no longer true. And if you believe Anthropic's murmurings about self-replicating LLMs, (2) may not be relevant either. I have had to pre-emptively get a frontier LLM to systematically fix and harden all of my hobby instances. On the bright side - also because of LLMs - it was very easy. There is really no excuse for outdated security anymore, when an LLM can one-shot harden almost any service.
I mean it used to be utterly impossible, but now? Hard to tell.
https://trends.shodan.io/search?query=http.favicon.hash:-853...
Over the past few years it has fluctuated but not the same continued growth as before. If you don't have a Shodan account you can see a chart on twitter:
- Get notified if a compressor fails, refrigerant leaks, or a door gets left open
- Catch failing fans, compressors, or defrost heaters before they break
- Automatically log temperatures for food safety inspections
- Optimize defrost cycles and compressor operation to save electricity
- Let technicians diagnose problems remotely instead of driving to the store
- Reduce power usage during peak electricity rates
- Monitor fridges and freezers across multiple stores from one place
- Track energy usage and equipment performance over time
- Get alerts when power goes out or equipment doesn't restart properly
This is the only one that requires remote write access, and only when "peak electricity rates" means a dynamic pricing system. But it doesn't actually need full Internet access. Instead, prices can be streamed via data diode to a local processor which calculates correct temperatures based on this information. This calculation should set reasonable limits on allowed temperature, so even if somebody sends false pricing information it's just going to waste some electricity and not destroy all the food.
>Optimize defrost cycles and compressor operation to save electricity
Assuming this means something different from "Reduce power usage during peak electricity rates", I don't see how it needs Internet access at all.
All the other points are monitoring tasks that can be done with read-only access via a separate data diode.
Even the remote diagnostics is of questionable value at best. You can do remote diagnostics just as well with a faxed printout of system information and having store staff do manual resets at needed. Remote diagnostics isn't going to solve anything that requires more than a reboot, like replacing a compressor coil, anyway, so you're going to need service staff driving to stores for these with or without the remote diagnostics.
I like similar articles' discussions to be linked together. I didn't see a link, so I added one. I don't see why I am getting all the angry downvotes.