IoT platforms provided all the required functionality. Device provisioning (it is not easy to do identity on 'things'). MQTT for service-assisted communication where devices don't need to accept incoming connections. Over-the-air software updates. Over-the-air kernel security updates.
The 'fridge company' and other product manufacturers decided to skip all that and run everything on a raspberry pi with apache, or an ESP32 soldered onto the control board, and call it finished. There are millions of these devices out there.
I just read the article again. It mentions "Danfoss" HVAC controls.
I happen to have a Danfoss HVAC controller here, and its controllable via Modbus. Its an older model, but its my understanding that larger HVAC systems commonly use Modbus.
Modbus systems are multi-drop serial, and the hack likely came in from the server side of one of the companies involved, and the HVAC controllers were all sent defrost commands. Thats my guess anyway.
I have a pump thats Modbus controllable as well, made by a company called Grundfos.
Gonna make a water battery.
Shift my cooling load into off-peak rate hours.
Stickin it to the power man. :D
Seriously, you guys would love these pumps.
https://product-selection.grundfos.com/us/products/magna-nor...
It has wifi. Neighbor kids are gonna defrost me. :(
Modbus is the equivalent of VGA connector in displays and projectors. It does have a TCP/IP version as well, but it has no security whatsoever. Or any features besides reading/writing a 16-bit value (or a single bit, charmingly referred to as "coil")
Absolutely.
I'm in the beginning stages of giving my home HVAC system an upgrade and using Modbus throughout with various adapter boards.
Yes, that is likely. Although Danfoss seems to have their own controllers, I think that you are right, that the attack was not an 'Internet connected fridge', but an HVAC or FMS (Facilities Management System) that was connected to the fridges.
My mistake. It is stupider than that. Facepalm.
https://www.claroty.com/team82/research/freeze-the-controlle...
Resubmit that article as its own headline. Good find.