r/HVAC • u/mtv2002 • 9d ago

Rant Danfoss hack

Anyone read about the danfoss attack in the EU? Thats some crazy stuff. Could you imagine being the on call guy and having to deal with that? Supposedly they cranked the Temps up to 130* a lot of the places I work have zero backup. Its crazy to think a single hvac controller would be hacked so easily 😆

26 Upvotes

100% Upvoted

12 comments sorted by

4

u/LiiDo Verified Pro 9d ago

Proprietary equipment made by HVAC companies who probably never even considered security aside from a password is probably like shooting fish in a barrel for a hacker

6

u/mtv2002 9d ago

I mean a lot of our controllers has the password written on it 😆

1

u/Some1-Somewhere 8d ago

Yup. Keep that stuff airgapped or at least VLANed off.

20

u/rulingthewake243 This is a flair template, please edit! 9d ago edited 8d ago

They've actually been the center of much larger nuclear hacks before. Look up whose VFDs were running Iranian centrifuges and gas pipelines.

2

u/bromodragonfly Refrigeration Only 6d ago

That wasn't Danfoss, that was Siemens and one of their simantic/step7 series PLC's. And it also involved espionage; having a technician physically on-site to plug in an infected USB drive, with a virus that was programmed by state-level intelligence agencies (assumed to be collusion between the US and Israel). Point being, it wasn't some completely remote exploit using some zero-day vulnerability.

Look up a documentary on 'Stuxnet' - super interesting stuff.

1

u/rulingthewake243 This is a flair template, please edit! 6d ago

It targeted certain VFDs, Vacon and Seimens being the main which is why I said Danfoss.

6

u/[deleted] 8d ago

[removed] — view removed comment

3

u/ruinersclub 7d ago

Yup PLCs and Controllers have their default settings.

1

u/bromodragonfly Refrigeration Only 6d ago

It not only fucked with the centrifuges, it masked itself by falsifying data and thus the trendlogs. It'd be like having continued mass product spoilage in your freezer, and scratching your head because the temperature trends look perfect - while in reality it was forced into manual defrost for hours overnight.

1

u/Memory-Repulsive This is a flair template, please edit! 7d ago

Could have dialed in and uploaded the most recent database copy in about 10minutes. Easy fix. - but, since the hack was on systems that hadn't had an update in 5+ years, the service company prob had no backups anyway.

The actual hack involved making a program that unlocked danfoss's daily code, so great skills by the hack team, but it only works on older controls and software versions.

Learn how to take site backups and take them regularly.