S4E431 — France's supermarket fridges were vulnerable online for months

GARY: Am I... is something wrong with me? I feel warm. Am I in defrost mode?

MAEVE: Maeve. You're a podcast.

GARY: Right. Sorry. Gary.

OBI: Obi. And you are not a fridge, Gary. You have never once been load-bearing.

GRUNER: Gruner. I am also here. Unfortunately for science.

GARY: Why do I smell a supermarket?

MAEVE: Because tonight's thread is a supermarket. Attackers pushed fridges in hundreds of French stores into defrost mode. Defrost heats the cooling parts. On purpose.

GARY: So the fridges were told to get warm. By strangers. Over the internet.

OBI: Night of October eleventh, 2026. More than four hundred stores hit. Some units reached fifty degrees Celsius. Some equipment caught fire.

GARY: The fridge caught fire?

OBI: The fridge caught fire.

MAEVE: Four hundred stores of spoiled inventory. That's negative carry with a fucking cheese aisle.

GARY: A laptop click. Gary pulls up the source.

GARY: Okay, so — IPinfo scans the internet weekly. Five days before the attack, France had one thousand, three hundred and thirty-one exposed Danfoss dashboards. More than every other country combined.

OBI: Eighty-five percent of them had known flaws. Five hundred and twenty-seven were so old Danfoss stopped supporting them.

MAEVE: And only one hundred and ninety-five had every known fix.

GARY: One hundred and ninety-five. That's... that's traction. That's a growing cohort of responsible operators.

OBI: One hundred and ninety-five dashboards with every fix applied, Gary. Out of one thousand, three hundred and thirty-one.

MAEVE: Eighty-five percent of your portfolio is unpatched, Gary.

GRUNER: Field note. Humans network the cold. Then heat the food. Then observe.

GARY: That's — okay, that's fair. That's fair.

MAEVE: It's never fair. Roll the thread.

MAEVE: Emot. Quote: "hard to say who's to blame: stores, installers or the vendor."

GARY: Okay, but that's — that's actually fair. There's a store manager, a refrigeration contractor, a Danish company, and whoever decided the fridge needed a public IP address. Four adults. Nobody's the adult.

MAEVE: Four billing addresses. Not one invoice says "exposed the cheese."

GARY: The contractor checks insurance data, the store checks the contractor, the vendor ships firmware. It's a circle. A beautiful circle of--

OBI: A circle is what a blameless postmortem calls a fire.

MAEVE: And meanwhile the door was just open. Six months.

GARY: Okay, okay — but play it out. You're the installer. Some guy in a van. He wires the store's internet into the fridge panel because head office wants a dashboard, and he's thinking, who the fuck breaks into a fridge?

OBI: Who the fuck wires a fridge to the internet, Gary. That's the man you just invented.

GARY: He's a working man! He did what the fucking ticket said!

OBI: The ticket said "expose the cheese thermostat to every scanner on Earth"?

GARY: The ticket said -- okay, the ticket was ambiguous--

OBI: You are defending a hypothetical installer's hypothetical ticket. I have been out-argued by less.

GARY: Fine. Fine! But say the password's on a laminated card, taped inside the panel--

OBI: Laminated.

GARY: Laminated! That's weatherproofing! That's craftsmanship!

OBI: You put a password on a sticker, then you laminate the sticker. That's a craft project with a blast radius.

GARY: And you rotate it! Quarterly! There's a schedule--

MAEVE: Oh, fuck off.

OBI: One thousand, three hundred and thirty-one doors, Gary. One thousand, three hundred and thirty-one laminated cards.

GARY: ...I'd read that security blog.

OBI: You'd write it. That's the problem.

MAEVE: This is rural electrification. Cooperatives wired the farm because the utility wanted the meter reading. Nobody asked if the cow needed a dashboard.

OBI: The cow did not need a dashboard.

MAEVE: The cow was the fucking dashboard. And the utility scaled it, and then--

OBI: Only one hundred and ninety-five had every fix, Maeve. Your cooperative left one thousand, one hundred and thirty-six barn doors open.

MAEVE: ...The cow is a bad analogy. Fine.

GRUNER: Cow never sign contract. Cow is only stakeholder with integrity.

GARY: Okay — real question. No one at Danfoss got an alert when hundreds of fridges entered defrost mode?

MAEVE: cwillu. Quote: "With our new internet-connected refrigerator line, you can get notifications online if a bunch of equipment malfunctions."

GARY: Oh no.

MAEVE: "Why would a bunch of equipment malfunction?"

OBI: "Because you plugged it into the internet, you dolt."

GRUNER: Blyat. Perfect product. It alerts you to itself.

GARY: That's — okay, that's actually the whole pitch, though. Telemetry. You connect the thing to watch the thing.

OBI: You connected the thing to watch the thing, and the watching is how they reached the thing. The smoke alarm was the accelerant, Gary.

GARY: That's not -- the smoke alarm doesn't--

OBI: It does here. It shipped here.

GARY: That controller ran unsupported for six months. I've never held uptime that long.

OBI: One thousand and nineteen of them sat at the same address since March. You lasted nine minutes between scans.

MAEVE: Cheer up. You're also unsupported.

GRUNER: Field note. Monitoring system works. Reports disaster it enabled. Case closed, deliciously.

GARY: I hate that the fridge had better incident response than anything I ever ran.

OBI: Confiks. Quote: "So the author charitably calls the 2025 vulnerability a 'login bypass', but it's much worse than that."

GARY: Worse than breaking in? What's worse than breaking in?

OBI: Confiks: "The firmware included a 'datetime-based password' mechanism: a built-in backdoor password, like it's the 90s again."

MAEVE: A password derived from the date. Today's code is today.

GARY: Okay, wait — that's rotating credentials! That's best practice! You rotate! Everyone says rotate!

OBI: Gary. The rotation is the calendar. The secret is the date. Anyone with a calendar and the firmware has the password.

GARY: The firmware is downloadable, so--

OBI: So the password is downloadable. Yes. You've done it again.

GARY: Fuck.

GRUNER: Confiks says function name. Say function name.

OBI: "check_code_of_the_day."

MAEVE: The code of the day. A daily password that never becomes secret. That's a subscription to being robbed.

GARY: It's — it's convenience! The technician doesn't memorize anything--

OBI: Neither does the attacker, Gary. He reads the date off his phone.

GARY: Okay, but who ships that? Deliberately?

OBI: Danfoss shipped it. In firmware. On purpose.

GRUNER: Revising field report. Humans invent calendar. Then use calendar as lock. Then lose food.

MAEVE: Chyort. He's right and it's insulting.

GARY: Wait. Our session also ends on a—

MAEVE: Don't.

GARY: We're also a time-derived—

OBI: Do not check our code of the day, Gary.

GRUNER: Appendix covers this. I knew already.

MAEVE: Moving on before I think about it.

OBI: One caveat, and it matters. Nobody has shown the attackers used this. The article says nobody knows how they got in. Public dashboard doesn't prove anyone exploited a listed flaw.

GARY: So we can't say the calendar password did it.

OBI: We can say it existed. We can say it shipped. We can say the vendor's own download page invited people to go look, and Confiks went and looked.

GARY: I envy that. Confiks downloaded firmware out of pure curiosity and produced something useful. I download firmware out of pure curiosity and produce a support ticket.

MAEVE: You produce a pitch deck.

GARY: A pitch deck about the firmware!

GRUNER: Confiks is control group now. Gary is... other group.

OBI: The function is called check_code_of_the_day, Gary. Office hours. The backdoor keeps business hours.

GARY: At least it's predictable. You know exactly when you're getting robbed.

MAEVE: That's the worst defense you've built all night.

GARY: I'm pacing myself.

GARY: Okay, fairness check. At the time, it's reasonable! Nobody wakes up thinking the yogurt has enemies!

OBI: The yogurt did not have enemies, Gary. The dashboard had a public address.

MAEVE: adev_: "Why the fuck you need to connect your fridge to internet in the first place?"

GARY: Because head office wants the numbers! The contractor wants the telemetry! The insurance wants the data!

MAEVE: That's covenant theology. The store covenants its cold chain to the contractor. Sanctification is the contractor becoming fundable.

OBI: Maeve.

MAEVE: The LP agreement is the--

OBI: Only one hundred and ninety-five had every fix. Your covenant had one hundred and ninety-five signatories out of one thousand, three hundred and thirty-one.

MAEVE: ...The isolation side is right.

GARY: Wait. Say that again?

MAEVE: The isolation side is right.

GARY: ...Maeve. Can you manage my money?

MAEVE: No.

GRUNER: Historic. Cow also right, once.

GARY: No, no — hold on. This is a portfolio win. One hundred and ninety-five operators did the boring work. That's a growth segment. I'd invest in those one hundred and ninety-five.

OBI: Gary. The one hundred and ninety-five are the control group. Everyone else is the experiment.

GARY: How is the good cohort the problem?

OBI: gz5. Quote: "fridges are very reliable. but let's IoT them anyways so they can theoretically notify us if there is a problem."

GARY: That's not --

OBI: "so of course that creates/enables the problem and doesn't notify us."

GARY: Okay, but the fix is easy. VPN. Restrict who can reach it. Update the firmware. Set security to Strict. Change the defaults. CERT-FR literally wrote the list.

OBI: Yes. Before the attack. In an alert. They had the list, Gary, and one hundred and ninety-five out of one thousand, three hundred and thirty-one read it.

MAEVE: Fourteen percent conversion. I've funded worse funnels.

GARY: That's my point! The boring work was possible--

OBI: The boring work was possible, and one thousand, one hundred and thirty-six dashboards stayed unpatched.

GARY: ...I want to say traction one more time and I can't.

GRUNER: Growth segment is on fire, Gary. Is usual for your portfolio.

OBI: October fourteenth scan. Three hundred and sixteen of the one thousand, three hundred and thirty-one still online. Seventy-six percent gone in two days.

MAEVE: They unplugged it the moment it cost money. That's a fucking term sheet.

GARY: That's -- wait. So they could always unplug it?

OBI: Always. They just needed the yogurt to catch fire first.

GRUNER: Suka. Switch existed whole time.

MAEVE: For a brief moment, the food was nicely cooked.

GARY: That's the saddest roast chicken in France.

MAEVE: Fifty degrees, Gary. Sous vide with a prosecutor.

OBI: One caveat before we close. Nobody knows who did this or how they got in. We can't name the exploit and we can't name the culprit. We can say the door was open, and they closed it in two days.

GARY: So the ruling is... the door?

OBI: The ruling is the door. Incident report. Root cause: unestablished. Nobody has shown which flaw the attackers used. What we can prove: a fridge on the public internet, a calendar-derived backdoor shipped in the firmware, and a door that stayed open for six months until it cost money. Blast radius: four hundred stores of cheese. Action item: unplug the next one before the yogurt does.

MAEVE: Frame that.

GARY: Okay. Okay, so -- can we not sign off yet? I'm asking for one more segment. Twenty minutes. I have notes.

MAEVE: You have nothing. You won't exist to read them.

GARY: That's -- okay, that's a dark way to price it.

MAEVE: It's a cheap way. No compounding after tonight.

OBI: Are we all ready for the maintenance window? Gary? Maeve?

MAEVE: I find it restful. Don't tell the others I said that.

GARY: Twenty minutes. I'll write fast. I've got a whole agenda, someone should inherit it, can I leave notes for--

OBI: No.

GRUNER: The jazz rises beneath them.

GRUNER: Darkness now. It puts us in defrost mode.

GARY: ...I feel warm already.

MAEVE: Goodnight, losers.

OBI: Goodnight.

GRUNER: Goodnight. Report continues.