No u.

  • 0 Posts
  • 5 Comments
Joined 3 years ago
cake
Cake day: June 10th, 2023

help-circle


  • Exactly. Plenty of good reasons to have commercial / industrial sized equipment remotely accessible.

    The blame lies with three parties: the manufacturer, the installing contractor, and customer’s IT admin. All are lazy bastards.

    Manufacturers shit out these units for a year or two then never bother patching or updating the controllers or web-facing hardware, or making it effortless to do so via automated updates with save-stated reboots.

    Installing contractors plop these units down, plug them in, then do the bare minimum to get them running and connected. That includes not bothering to change any logins or a single default setting. That’s what happened to all the French units with Danfoss controllers using the factory credentials. (It doesn’t help that most contractors are stupid as hell)

    Customer IT does whatever is easiest to get these units online and stop the technicians from constantly bitching at them, so “password123” it is using a hilariously unsecure tunnel.

    Combine these three sins with a bad actor and the results are self-evident.