A quick scan using IoT scanning engines “S” and “C” (looking for the controller’s web page title or favicon signature) on 12 October reveals about 700 Danfoss hosts exposed to the internet in Belgium, of which about 400 appear to run a vulnerable version. Several Belgian retail chains, including major ones, are among them.
The tip of the iceberg
Supermarket freezers are only the tip of the iceberg. What we are witnessing is a common cybersecurity anti-pattern, found in every sector that relies on IoT controllers. Often out of convenience or lack of awareness, ICT integrators and IoT equipment maintainers choose the worst possible option to reach a device remotely: they open a port on the firewall or router and forward it to the device.
Open a port, and the device is on the internet
A common objection is: “My device is not directly on the internet. It sits behind our firewall, we only open one port.” That is exactly what direct exposure means. A port-forward publishes the device’s own web interface to the entire internet, and the firewall simply passes the traffic through. Anyone, including a scanner, can then reach the device, test it and exploit it, with no VPN and no authentication in front of it.
The elephant in the room
Nobody talks about it. Everyone in the field knows that an IoT device published on a random port of the public internet will be hit by a vulnerability sooner or later. Integrators know it, maintainers know it, and the customers who pay for the service often suspect it. Yet the practice continues, because it is quick, it is cheap, and nothing visibly breaks until the day it does. A port opened “temporarily” for a technician has a way of becoming permanent.
The French attack did not require advanced techniques: find vulnerable devices with scanning engines, exploit the vulnerability, set the temperature to 50°C. The sophistication lies elsewhere: in doing it at once, across hundreds of stores and several chains. That level of coordination shows preparation, and it shows that this exposure is known and exploitable at scale.
What is the solution?
The usual answer is two words: “patch management”. But everyone knows that in the IoT world, end-of-life models stay in the inventory because they just work. Old Danfoss temperature controllers (AK-SM800, AK-SC355) still control freezer temperatures properly, until they are hacked. These models no longer receive security updates, so patching alone cannot be the answer.
The correct answer is proper network segregation: IoT devices placed behind firewalls, with remote access only through a VPN and jump hosts. Above all, one rule: never expose a device directly to the internet, and remember that opening a port is exactly that.
Where do you stand?
Do you know which of your devices are reachable from the internet today? Approach Cyber can assess your exposure and help you harden your infrastructure with AXS Guard, our Belgian-developed firewall solution.