A previous discussion mentioned that many used mobile comms rather than the stores own connectivity; if so then I have seen some providers do SIMs that terminate in VPNs, so without any software changes on the devices they could be isolated.
"What's more worrying, is that multiple Danfoss business units (including Climate Solutions & Electronic Controllers) received IEC 62443-4-1 certification for Secure Product Development Lifecycle and this is prominently advertised as such"
While it's known that certifications are often just paperwork (eg. European CE mark means almost nothing imho), it does raise the question: what exact does it mean when .org/product line receives this certification?
You'd expect this to be about best practices, certain aspects of processes etc. With the idea that good processes produce good results.
That is in direct conflict with:
"It turns out that stack canaries and Position Independent Executable (PIE) are not enabled. These mechanisms have been staples of memory corruption defenses for decades and enabling these features on a modern Linux distribution running on a modern ARM application processor requires no engineering work at all. It is simply a matter of setting the right compiler flag."
If such basic / low-hanging fruit is not covered by above certification, then what on Earth is?
Also:
"controllers remain exposed to the public internet. While this is for understandable reasons (supermarket chains sometimes risk SLA or insurance condition violations by taking away remote maintenance"
Anyone have some context as to why service and/or insurance would require remote access? Sounds beyond stupid.
All in all a VERY juicy & informative read. Curious to see how Danfoss will handle this swiss cheese affair.
Some of those may be honeypots, but not all of them.
While it's known that certifications are often just paperwork (eg. European CE mark means almost nothing imho), it does raise the question: what exact does it mean when .org/product line receives this certification?
You'd expect this to be about best practices, certain aspects of processes etc. With the idea that good processes produce good results.
That is in direct conflict with:
"It turns out that stack canaries and Position Independent Executable (PIE) are not enabled. These mechanisms have been staples of memory corruption defenses for decades and enabling these features on a modern Linux distribution running on a modern ARM application processor requires no engineering work at all. It is simply a matter of setting the right compiler flag."
If such basic / low-hanging fruit is not covered by above certification, then what on Earth is?
Also:
"controllers remain exposed to the public internet. While this is for understandable reasons (supermarket chains sometimes risk SLA or insurance condition violations by taking away remote maintenance"
Anyone have some context as to why service and/or insurance would require remote access? Sounds beyond stupid.
All in all a VERY juicy & informative read. Curious to see how Danfoss will handle this swiss cheese affair.