IoT platforms provided all the required functionality. Device provisioning (it is not easy to do identity on 'things'). MQTT for service-assisted communication where devices don't need to accept incoming connections. Over-the-air software updates. Over-the-air kernel security updates.

The 'fridge company' and other product manufacturers decided to skip all that and run everything on a raspberry pi with apache, or an ESP32 soldered onto the control board, and call it finished. There are millions of these devices out there.

▲

Kevin_Flynn 10 hours ago | parent [-]

I just read the article again. It mentions "Danfoss" HVAC controls.

I happen to have a Danfoss HVAC controller here, and its controllable via Modbus. Its an older model, but its my understanding that larger HVAC systems commonly use Modbus.

Modbus systems are multi-drop serial, and the hack likely came in from the server side of one of the companies involved, and the HVAC controllers were all sent defrost commands. Thats my guess anyway.

I have a pump thats Modbus controllable as well, made by a company called Grundfos.

Gonna make a water battery.

Shift my cooling load into off-peak rate hours.

Stickin it to the power man. :D

Seriously, you guys would love these pumps.

https://product-selection.grundfos.com/us/products/magna-nor...

It has wifi. Neighbor kids are gonna defrost me. :(

▲

lrasinen 6 hours ago | parent | next [-]

Modbus is the equivalent of VGA connector in displays and projectors. It does have a TCP/IP version as well, but it has no security whatsoever. Or any features besides reading/writing a 16-bit value (or a single bit, charmingly referred to as "coil")

	▲	Kevin_Flynn 6 hours ago \| parent [-]
		Absolutely. I'm in the beginning stages of giving my home HVAC system an upgrade and using Modbus throughout with various adapter boards.

▲

Delphiza 10 hours ago | parent | prev [-]

Yes, that is likely. Although Danfoss seems to have their own controllers, I think that you are right, that the attack was not an 'Internet connected fridge', but an HVAC or FMS (Facilities Management System) that was connected to the fridges.

▲

Delphiza 7 hours ago | parent [-]

My mistake. It is stupider than that. Facepalm.

https://www.claroty.com/team82/research/freeze-the-controlle...

	▲	Kevin_Flynn 6 hours ago \| parent [-]
		Resubmit that article as its own headline. Good find.