Coldframe is a lightweight, standard-library Python honeypot that imitates internet-facing supermarket refrigeration controllers: the Danfoss AK-SM 800A and Copeland/Dixell XWEB EVO. Its purpose is to attract and document scanning and intrusion attempts without controlling equipment or exposing real data. The Danfoss persona mimics details such as web headers, TLS behavior, login pages, and XML endpoints; the Dixell persona reproduces its login flow and targeted CGI paths. Weak or factory credentials can appear to succeed, leading to a fake dashboard where actions such as defrost requests are recorded rather than performed. An optional Modbus TCP service presents invented temperatures, setpoints, and registers.
The honeypot logs requests, credentials, session actions, XML commands, Modbus activity, and recognized exploit attempts as JSON lines. It identifies patterns associated with several disclosed vulnerabilities, including Danfoss path traversal and command injection, authentication bypasses, and Dixell upload or login attacks. The project includes tests, a log-summary utility, and instructions for deploying a container or Ubuntu cloud instance. Its safety measures include dropping exploit payloads, limiting connections and logged data, rotating logs, and running with restricted container permissions; the decoy does not execute commands, read files, or connect outward. Coldframe is intentionally shallow, however, and its public code and imperfectly documented device details may make it recognizable as a honeypot. Optional firmware assets can improve fidelity, while cloud-hosted industrial-device simulations may also draw suspicion.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
AI is exposing how much of the internet and its software relies on sloppy human work, including code with security vulnerabilities. The growing ability of AI tools to spot these weaknesses is forcing companies to confront the quality and safety of systems people built. (businessinsider.com)
Iran-linked tankers and a fishing boat loitered near major undersea internet cables in the Strait of Hormuz, with some ships switching off tracking transponders. The activity raises concern Iran could target cable infrastructure if the US and Israel resume strikes, potentially disrupting communications across several countries. (arstechnica.com)
A British soldier deployed in Estonia ignored orders to remove his phone’s SIM card and disable location settings, and attackers stole nude photos to blackmail him. He pleaded guilty to disobeying a lawful command and was reduced in rank and sentenced to 10 months’ detention. (arstechnica.com)
Consumer brain-wave headsets collect neural data that manufacturers can use to train AI, sometimes without clearly telling users. The practice raises privacy concerns because brain signals can reveal sensitive information about people. (science.org)
A URL-encoding flaw in Hugging Face Chat let unauthenticated requests bypass an admin check and trigger bulk exports of users’ private conversations. The exported data was sent to a configured dataset destination rather than returned directly to the requester. (twitter.com)
Claude Code’s “Don’t Ask Again” setting was linked to passwords and other secrets being exposed in 1,122 public GitHub files. The finding highlights how coding-agent features can accidentally put sensitive data into public code repositories. (apiiro.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.