Is Your Fridge Running- Then You Better Catch It - State of Security in Refrigeration Systems

The talk looks at the controllers that run compressors, fans and heaters in supermarkets, pharmacies and cold warehouses. The researchers argue that compromising these systems could disrupt food and medicine supply. They chose two widely deployed products, a Danfoss controller and a Copeland (Dixell) controller, with the goal of reaching unauthenticated remote code execution on both.

On the Danfoss unit, the firmware came from the vendor's public download. The team identified an ARM Linux binary and ran it under emulation. They found a web login that accepted a daily password computed from the device date and hard-coded values, plus an OS command injection in the SMTP settings page. Chaining the two gave code execution. The Copeland firmware was encrypted, so they desoldered the flash chip and dumped it directly. Searching the image for Lua os.execute calls revealed many command injection flaws. An SSH daily password was also derived from embedded keys, the MAC address and the date.

To show impact, the team built a small refrigerator with a field controller linked over Modbus RTU. Through the compromised controller they changed the displayed temperature and cut cooling, so contents warmed without any visible alarm. They also reported thousands of exposed devices and techniques for tying them to store locations and owners. The vendors shipped firmware fixes after coordinated disclosure. The takeaways: avoid predictable secrets, limit internet exposure and patch regularly, since the retail sector lags other OT domains in security maturity.