Reverse Engineering the CRAZY Fridge Hack (what happened?) | Low Level

The Gist

A hacker targeted internet-connected Danfoss refrigeration controllers at 700 supermarkets across France on October 11, raising internal temperatures to 50 degrees Celsius and causing millions in food spoilage and fires.

Quick Overview

Supermarket refrigeration systems run on operational technology that is frequently exposed to the internet with weak security practices and outdated firmware. Clarity Team 82 researchers recently uncovered critical authentication and command injection vulnerabilities in Danfoss AK-SM 800A controllers that allow remote attackers to gain root access. Because thousands of these devices remain directly accessible online without proper security behind a VPN, widespread food spoilage incidents like the recent French supermarket hacks will continue to happen.

Key Points: An attacker compromised around 700 supermarkets across France on October 11 by exploiting internet-connected refrigeration control units. The hacker manipulated temperature settings up to 50 degrees Celsius, triggering defrost cycles that spoiled perishable goods and sparked electrical fires. Team 82 at Clarity discovered severe vulnerabilities in Danfoss AK-SM 800A refrigeration controllers two months prior to the incident. The controllers suffered from a hardcoded day-code authentication mechanism and a command injection flaw that combined to grant unauthenticated remote root access. Danfoss released firmware version R4.31 to address the security flaws, but many operators fail to update their operational technology. A public search reveals thousands of vulnerable Danfoss management controllers directly exposed to the internet without proper virtual private network protection. Critical operational technology systems running on C often prioritize uptime over security, leaving embedded software dangerously vulnerable to remote exploits.

Context: Operational technology includes critical infrastructure devices like power controllers, water pumps, and refrigeration units that directly impact the physical world. Unlike traditional web applications that undergo rigorous penetration testing, operational hardware is rarely updated and often exposed directly to the internet with weak authentication safeguards.