> The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food",
And it's _even worse_ than that. A famous french cybersecurity firm, Synacktiv, published a report in 2023 (!) about the code-of-the-day vulnerability, but it made less noise apparently [1]
US bases were also attacked remotely this year too, but yet this attack was still "unprecedented" to the upper management of these grocer chains. Smells like incompetence to me personally.
Stage 1 and 3 of that chain are shocking. I mean, yes, security is very hard, especially in a large codebase, but they look like actively made misguided choices.
Stage 1: one endpoint checks for the token header existence, not its content. From the writeup I'm guessing all the other endpoints do check the content, so why?
Stage 3: checks if the URL starts with http://127.0.0.1, not if the domain is 127.0.0.1, to expose an admin token. Ouch.
Not surprised by the driver software quality issues. When I was still working in consumer electronics / embedded, I saw many examples of the internals of those devices. The software was often a hodgepodge of scripts and drivers, whatever seemed to work, from companies without a great software and details culture.
We would usually rewrite the drivers entirely from the datasheets or from reversing the vendor ones!
Agreed, fun to read. Spite driven development. Reminded me of that Asus ACPI issue that somebody went buckwild on last year, or when Tavis Ormandy decided that xterm on windows took too long to launch.
Thanks for sharing. Do you have any blog or other links about this kind of research and the re-writes? I don’t work in the field so I feel modern chips are way too complex so it is not commercially viable to reverse and rewrite the drivers, but apparently I’m wrong.
Looks like that specific vulnerability was found this summer, disclosed in coordination with the vendor and at least some models were patched [0] (unclear if all models were), but from early reports:
- they either didn't warn their customers this was a critical security patch,
- many of these fridges/freezers were directly accessible on the internet with their own 3G/4F SIM cards without further protection!
> When a person hears someone talk about the importance of backups, but also haven't heard friends/family suffer this date, they will rightfully ignore this warning.
Maybe they just haven't talked to you about it? Most people I know have suffered some form of (partial) data loss or another, and lived with it.
no idea, but at least Tailscale and Caddy were opening MPTCP sockets on servers I checked.
reply