Two hours a day

Two hours a day. That is how long the defrost cycle on these supermarket refrigeration systems normally runs, according to La Dépêche's account of the attack that began Sunday night in France. The attackers set it to run continuously, at 50°C. By Monday, E. Leclerc, Intermarché and Coopérative U had confirmed it to AFP: at least 300 Intermarché and Netto shops and more than 100 Coopérative U outlets hit, fresh and frozen stock headed for the bin, and reports of fires that Paris prosecutors are now working to tie to the attack. A source close to the case said the controllers were made by Danfoss.

The attackers didn't break the fridges. They used a feature. Defrost exists to melt ice off the coils, and the controllers that schedule it accepted a cycle of forever and a setpoint hot enough to ruin the stock from whoever reached them. That is the defect, and it sits below the password. A heater built to run two hours should be physically unable to run twenty-four, whoever is asking and however they got in.

The standard response is about the door, and the door is easy to find. Nobody has said yet which hole the attackers used, but Claroty's Team82, researching Danfoss's AK-SM 800A system manager, found thousands of its management interfaces reachable from the public internet and, inside the firmware, a hidden maintenance login:

The code is derived from the device's date and nothing else, so anyone who reconstructs the algorithm is an administrator on every unpatched unit. Team82 chained it to remote code execution, Danfoss fixed both in firmware R4.3.1, and the advice that came with the fix is the usual pair: upgrade, and get the consoles off the open internet.

Both are right, and the obvious objection follows from them: the process worked and the stores didn't, so blame the stores. Except Danfoss told AFP that most of the affected equipment is "legacy" and "no longer receive[s] software or security updates," and that it had long advised supermarkets to replace those models. For those boxes there is no patch to apply. And keeping consoles off the internet across thousands of independently run stores, each with a refrigeration contractor who wants remote access to the rack, is a policy someone has to keep, not a property of the hardware. "Legacy" settles whose problem it is. It doesn't change what the box does when told.

Equipment like this outlives its update stream. The compressor and the controller stay in service long after the vendor stops shipping firmware, so the only defense that ages as well as the hardware is one that never needs an update: a hard cap on defrost duration and a high-temperature cutoff wired into the heater circuit, below anything the network can reach. A water heater's relief valve works this way. It opens at a set pressure whatever the thermostat says.

A cap wouldn't make the attack harmless. Whoever owns the console can still shut the cooling off. But a dead compressor warms a freezer case over hours, trips alarms and leaves staff time to move stock; a heater running flat out at 50°C ruins it overnight and, if the fire reports hold up, starts fires. The interlock's job isn't to stop the intruder. It's to cap the worst thing the intruder can order.

The interlock's job isn't to stop the intruder. It's to cap the worst thing the intruder can order.

Christophe Hansen, the EU's food commissioner, said after the attack that the "exploitation of food" is now a reality. It will stay one for as long as what a stranger can tell a fridge is limited only by who can reach it. Two hours a day was the right setting. It should also have been the only one.