coldframe

关于

I built Coldframe, a honeypot that pretends to be a supermarket refrigeration controller and logs what people try. It’s one Python file using only the standard library. This autumn, attackers got into internet-facing refrigeration controllers in European supermarkets and forced defrost cycles. I wanted to see what people would try against a convincing fake. Things that were fun to get right: Matching real units. I used Shodan records of real devices to match header order, page titles, certificate fields and TLS versions. The Danfoss persona sends nginx headers in the same order as a real AK-SM 800A. The Dixell persona sends no Server header and pads its page to exactly 8,202 bytes. Recognising exploit attempts. It recognises CVE-2025-41450, the Danfoss “code of the day” login bypass, and records whether the submitted code is correct for today. It also tags attempts targeting three other Danfoss CVEs and the XWEB vulnerabilities. Letting them in. Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first. Nothing behind it is real. Two instances have been live for a day. So far they’ve only seen generic scanners and Shodan’s crawler, which is called refrigerator.census.shodan.io. It builds on eppser/danfoss-ak-sm-decoy and public research by Synacktiv, Claroty and Ironhackers. Feedback welcome, especially from anyone who has seen these devices in the field.

收录记录

1. Show HN

   2026年11月6日 · 1 次收录