I would be very skeptical of anyone relying on Shodan data. At one point I was trying to write honeypots myself by replicating wifi cameras, but almost all the ones on the internet I found were honeypots of some sort, and the ones that weren't were already hacked and had their web pages replaced. In retrospect it would have probably been better to get a vulnerable device myself and probe it.
If I were you, I would probably ensure that the fridges you used have residential or commercial (aka non-DC) IP addresses. Maybe Shodan uses this data for their "honeypot" label, my experience was some time ago so no idea though.
What I meant is that I'd find some way of ensuring that I'd want to ensure that the responses you're serving up are real. If you are happy with what you have, we're good.
Fair point and I agree, Shodan isn't the only source. For the reason, for Danfoos the login page comes straight from the firmware package that Danfoss publishes. It's byte for byte identical, so it hashes the same as thousands of real units. Dixell was matched against Shodan records, so that one is weaker, you’re right.
The datacenter IP is the bigger tell. Real controllers sit on shop or ISP connections. Moving one decoy onto a residential line is on my list.
Along the way I did some hunting for vulnerabilities on the Danfass units, quite interesting stuff actually.
Plot twist: the hackers are members of the Van Helsing Society and the supermarkets were just a trial run in their war against the International Vampire Cabal.
One thing keeps coming back, (and it's the story of industries where security and patching is an afterthought).
a supermarket has no security team.
If a fridge controller needs patching, a VPN and a strong password to be safe, that work has to come from the vendor or installer by default.
One would hope that all these come by default or as a feature on these devices. It could even be a selling feature and not part of an expensive maintenance contract. A supermarket manager cannot be expected to do this work.
This is how it should work: supermarket wants to use high tech stuff such as connected fridges, they get a cyber insurance policy as part of all the other insurances they have. The insurer then has domain experts to figure out what the insured needs to do to meet a risk threshold (or they adjust fees accordingly).
This model has worked fine for many other types of risks.
Wait, I recall reading the threads about someone speculating there was a hack. Some people suggested it could just be that a large percentage of refrigeration units received a software update at the same time which resembled a hack.
Is there a definitive story that someone actually did hack these units on a grand scale?
This type of attack lasted few days in different countries, quite hard to believe the fridge manufacturer could keep pushing these updates after all the news around.
That's a known playbook. Stir up shit, then create an uplausible denial which will take experts some time to debunk. Once it's figured out the story was bs, put out another three. By the week end there is 10 narratives and nobody except the field experts is sure that it's the usual suspects doing the usual things, but nobody listens to those
My view is that some companies installing this have not implemented any defense in depth and cut corners all around. Installing a firewall with a simple vpn service would probably have prevented lots of pain (unfrosting).
In general we also see almost every security expert working at banks or other high paying companies and not for supermarkets.
My feeling is that this 'niche' is probably interesting to spend some 'tokens' and time on.
Although seemingly the hack wasn't so sophisticated, maybe it's truly just some kids fucking around with what they see being open, and maybe just want to target European countries for the "lulz" or whatever, who knows.
It's most certainly a form or hybrid warfare. While being very easy to perform, it's still quite effective. Empty supermarkets and supply chains being disturbed.
Hopefully this is a wakeup call for the industry.
> Hopefully this is a wakeup call for the industry.
Would be nice but none of the other <waves at cybersecurity for the last decade> events has been.
It seems like something horrific is going to have to happen before this is taken as seriously by government and private orgs as it should have been, that seems to be how it works with other stuff historically.
You'd probably have more luck posing as other industrial hardware like HVAC, lighting, controllers for the kinds of pumps or valves you'd find in chemical plants. That kind of stuff.
New ideas are popping up. I started with fridges because of the recent attacks, but the code makes it easy to add personas. Electric car charing stations and coffee machines were my initial idea, but HVAC and building controllers are probably better ideas. Thanks!
- Letting them in. Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first. Nothing behind it is real.
The more people that can deploy it, the higher the chance of discovering something about the attacks. Also this gave me an incentive to look deeper into the real software.
The hilarious thing about this is that there was an initial hack, and then like a month later another one that was equally successful. Who could have possibly seen that coming lol.
> Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first.
I think we're past the point where it's reasonable to expect people to not use AI for code, but their prose still sucks balls. You should at least write your submission here yourself, come on.
Crazy thing is, when the fridges in all those military bases were hacked people were initially in denial and the people noticing that it was just a little too coincidental to be happing simultaneously were called paranoid. Well who's paranoid now?
I would be very skeptical of anyone relying on Shodan data. At one point I was trying to write honeypots myself by replicating wifi cameras, but almost all the ones on the internet I found were honeypots of some sort, and the ones that weren't were already hacked and had their web pages replaced. In retrospect it would have probably been better to get a vulnerable device myself and probe it.
If I were you, I would probably ensure that the fridges you used have residential or commercial (aka non-DC) IP addresses. Maybe Shodan uses this data for their "honeypot" label, my experience was some time ago so no idea though.
At this point the honeypot I'm running is not marked as honeypot. Guess that it's a good sign?
What I meant is that I'd find some way of ensuring that I'd want to ensure that the responses you're serving up are real. If you are happy with what you have, we're good.
Fair point and I agree, Shodan isn't the only source. For the reason, for Danfoos the login page comes straight from the firmware package that Danfoss publishes. It's byte for byte identical, so it hashes the same as thousands of real units. Dixell was matched against Shodan records, so that one is weaker, you’re right.
The datacenter IP is the bigger tell. Real controllers sit on shop or ISP connections. Moving one decoy onto a residential line is on my list.
Along the way I did some hunting for vulnerabilities on the Danfass units, quite interesting stuff actually.
An extra insight, there was some news of 'blood banks' also being targetted. This is possibly a stronger (painful) target. It would demorelize people that are donors. https://www.independent.co.uk/tech/security/blood-hack-fridg...
Why would it, scarcity generally motivates
One could say blood is a fluid market that responds well to offer and demand
Plot twist: the hackers are members of the Van Helsing Society and the supermarkets were just a trial run in their war against the International Vampire Cabal.
One thing keeps coming back, (and it's the story of industries where security and patching is an afterthought).
a supermarket has no security team. If a fridge controller needs patching, a VPN and a strong password to be safe, that work has to come from the vendor or installer by default. One would hope that all these come by default or as a feature on these devices. It could even be a selling feature and not part of an expensive maintenance contract. A supermarket manager cannot be expected to do this work.
This is how it should work: supermarket wants to use high tech stuff such as connected fridges, they get a cyber insurance policy as part of all the other insurances they have. The insurer then has domain experts to figure out what the insured needs to do to meet a risk threshold (or they adjust fees accordingly).
This model has worked fine for many other types of risks.
Many of these supermarkets are part of big brands but operate independently. I doubt cyber insurance is top of mind for those small owners
It will be soon. How many refrigerated cases of product can they afford to lose?
The interesting aspect of these attacks was that they seemed to have been done per country.
Not a headline I ever expected to read. 2026 has been a wild year.
It's been a wild year from a suburbanite perspective. There's still a long way to go before real wilderness is witnessed.
Wait, I recall reading the threads about someone speculating there was a hack. Some people suggested it could just be that a large percentage of refrigeration units received a software update at the same time which resembled a hack.
Is there a definitive story that someone actually did hack these units on a grand scale?
There have been (at least) two separate waves to this now, which makes the "innocent broken update" speculation much less likely?
Unless they push updates in waves, which is what most big rollouts do.
This type of attack lasted few days in different countries, quite hard to believe the fridge manufacturer could keep pushing these updates after all the news around.
That's a known playbook. Stir up shit, then create an uplausible denial which will take experts some time to debunk. Once it's figured out the story was bs, put out another three. By the week end there is 10 narratives and nobody except the field experts is sure that it's the usual suspects doing the usual things, but nobody listens to those
Fwiw, the first thread I recall was a speculative blog post about commissary freezers for the US military: https://news.ycombinator.com/item?id=49508506
Now, as of November 2026, it is confirmed as a hack.
Confirmed exploits, many manufacturers, experts, …
My view is that some companies installing this have not implemented any defense in depth and cut corners all around. Installing a firewall with a simple vpn service would probably have prevented lots of pain (unfrosting). In general we also see almost every security expert working at banks or other high paying companies and not for supermarkets. My feeling is that this 'niche' is probably interesting to spend some 'tokens' and time on.
> Is there a definitive story that someone actually did hack these units on a grand scale?
Given the scope here (see map at https://en.wikipedia.org/wiki/2026_French_supermarket_refrig...), it'd either be individual hackers getting inspired from their neighbor hackers, or one actor targeting European countries.
Although seemingly the hack wasn't so sophisticated, maybe it's truly just some kids fucking around with what they see being open, and maybe just want to target European countries for the "lulz" or whatever, who knows.
It's most certainly a form or hybrid warfare. While being very easy to perform, it's still quite effective. Empty supermarkets and supply chains being disturbed. Hopefully this is a wakeup call for the industry.
> Hopefully this is a wakeup call for the industry.
Would be nice but none of the other <waves at cybersecurity for the last decade> events has been.
It seems like something horrific is going to have to happen before this is taken as seriously by government and private orgs as it should have been, that seems to be how it works with other stuff historically.
You'd probably have more luck posing as other industrial hardware like HVAC, lighting, controllers for the kinds of pumps or valves you'd find in chemical plants. That kind of stuff.
New ideas are popping up. I started with fridges because of the recent attacks, but the code makes it easy to add personas. Electric car charing stations and coffee machines were my initial idea, but HVAC and building controllers are probably better ideas. Thanks!
Did you write this post with AI?
- Letting them in. Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first. Nothing behind it is real.
Given the context, this reads like vomit.
Super cool, especially showing your work as FOSS, but: why announce your honeypot before it’s fulfilled its intended purpose once?
The more people that can deploy it, the higher the chance of discovering something about the attacks. Also this gave me an incentive to look deeper into the real software.
Me reading it be like:
MFs be doing everything but pulling those fridges off the Internet. Given the amount of TOR nodes, IP addresses today, Honeypots mean nothing ....
Of course, it's my unpopular opinion. :)
Agreed, that's the real fix. The honeypot is just to see who's looking while they're still out there.
The hilarious thing about this is that there was an initial hack, and then like a month later another one that was equally successful. Who could have possibly seen that coming lol.
> Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first.
I think we're past the point where it's reasonable to expect people to not use AI for code, but their prose still sucks balls. You should at least write your submission here yourself, come on.
I agree, I rushed this one a bit. Glad to share with the industry at least.
TBH, I think at this point it is the "holier than thou" people pointing out every instance of slightly AI sounding text that are getting annoying.
I was happy reading you post and I imagine there are many many more people like me than the grinch.
Thanks! To be honest, using AI helps 'gettings things out' instead of shelving it because it's never perfect.
> I think at this point it is the "holier than thou" people pointing out every instance of slightly AI sounding text that are getting annoying.
I don't think it's unreasonable to spend literally 3 minutes writing your own submission. I'm not asking to rewrite every code comment.
And it wasn't "slightly" AI sounding text. It's very obviously AI.
Crazy thing is, when the fridges in all those military bases were hacked people were initially in denial and the people noticing that it was just a little too coincidental to be happing simultaneously were called paranoid. Well who's paranoid now?