A previous discussion mentioned that many used mobile comms rather than the stores own connectivity; if so then I have seen some providers do SIMs that terminate in VPNs, so without any software changes on the devices they could be isolated.
"What's more worrying, is that multiple Danfoss business units (including Climate Solutions & Electronic Controllers) received IEC 62443-4-1 certification for Secure Product Development Lifecycle and this is prominently advertised as such"
While it's known that certifications are often just paperwork (eg. European CE mark means almost nothing imho), it does raise the question: what exact does it mean when .org/product line receives this certification?
You'd expect this to be about best practices, certain aspects of processes etc. With the idea that good processes produce good results.
That is in direct conflict with:
"It turns out that stack canaries and Position Independent Executable (PIE) are not enabled. These mechanisms have been staples of memory corruption defenses for decades and enabling these features on a modern Linux distribution running on a modern ARM application processor requires no engineering work at all. It is simply a matter of setting the right compiler flag."
If such basic / low-hanging fruit is not covered by above certification, then what on Earth is?
Also:
"controllers remain exposed to the public internet. While this is for understandable reasons (supermarket chains sometimes risk SLA or insurance condition violations by taking away remote maintenance"
Anyone have some context as to why service and/or insurance would require remote access? Sounds beyond stupid.
All in all a VERY juicy & informative read. Curious to see how Danfoss will handle this swiss cheese affair.
A previous discussion mentioned that many used mobile comms rather than the stores own connectivity; if so then I have seen some providers do SIMs that terminate in VPNs, so without any software changes on the devices they could be isolated.
How is it that this page is getting cut off on mobile? I can't even scroll to the side to see the rest of the words.
Working on chrome / android
Shodan now says 7,667 StoreView devices, up from 4500 around mid-October.
Some of those may be honeypots, but not all of them.
2,000 of them are on 2 IPs. So I think many are honeypots.
"What's more worrying, is that multiple Danfoss business units (including Climate Solutions & Electronic Controllers) received IEC 62443-4-1 certification for Secure Product Development Lifecycle and this is prominently advertised as such"
While it's known that certifications are often just paperwork (eg. European CE mark means almost nothing imho), it does raise the question: what exact does it mean when .org/product line receives this certification?
You'd expect this to be about best practices, certain aspects of processes etc. With the idea that good processes produce good results.
That is in direct conflict with:
"It turns out that stack canaries and Position Independent Executable (PIE) are not enabled. These mechanisms have been staples of memory corruption defenses for decades and enabling these features on a modern Linux distribution running on a modern ARM application processor requires no engineering work at all. It is simply a matter of setting the right compiler flag."
If such basic / low-hanging fruit is not covered by above certification, then what on Earth is?
Also:
"controllers remain exposed to the public internet. While this is for understandable reasons (supermarket chains sometimes risk SLA or insurance condition violations by taking away remote maintenance"
Anyone have some context as to why service and/or insurance would require remote access? Sounds beyond stupid.
All in all a VERY juicy & informative read. Curious to see how Danfoss will handle this swiss cheese affair.