hedgerow-dev

Great input, thanks! My next step is to deploy on a normal ISP and not on a cloud provider. Just let it sit there. I think we should give back to those companies as much as possible. OT is not where the big money is and all security experts are flocking to. I've already started some actions in this direction btw.

Many of these supermarkets are part of big brands but operate independently. I doubt cyber insurance is top of mind for those small owners

The more people that can deploy it, the higher the chance of discovering something about the attacks. Also this gave me an incentive to look deeper into the real software.

Thanks! To be honest, using AI helps 'gettings things out' instead of shelving it because it's never perfect.

Agreed, that's the real fix. The honeypot is just to see who's looking while they're still out there.

New ideas are popping up. I started with fridges because of the recent attacks, but the code makes it easy to add personas. Electric car charing stations and coffee machines were my initial idea, but HVAC and building controllers are probably better ideas. Thanks!

One thing keeps coming back, (and it's the story of industries where security and patching is an afterthought).

a supermarket has no security team. If a fridge controller needs patching, a VPN and a strong password to be safe, that work has to come from the vendor or installer by default. One would hope that all these come by default or as a feature on these devices. It could even be a selling feature and not part of an expensive maintenance contract. A supermarket manager cannot be expected to do this work.

It's most certainly a form or hybrid warfare. While being very easy to perform, it's still quite effective. Empty supermarkets and supply chains being disturbed. Hopefully this is a wakeup call for the industry.

I agree, I rushed this one a bit. Glad to share with the industry at least.

My view is that some companies installing this have not implemented any defense in depth and cut corners all around. Installing a firewall with a simple vpn service would probably have prevented lots of pain (unfrosting). In general we also see almost every security expert working at banks or other high paying companies and not for supermarkets. My feeling is that this 'niche' is probably interesting to spend some 'tokens' and time on.

At this point the honeypot I'm running is not marked as honeypot. Guess that it's a good sign?