Comment by renyicircle
8 hours ago
I went through a manual you mentioned in another comment. It listed "High level of security against undesired user access" as one of the features but it wasn't expanded upon. So I did more searching and found cybersecurity best practices from Danfoss.
https://www.danfoss.com/en/service-and-support/fix-and-troub...
They highlight connection through a firewall, mention secure remote access methods, monitoring for data breaches, strong access controls, etc. Reasonable, but these are just recommendations, so the stores could have followed all of them or none at all.
An article about Danfoss vulnerabilities mentioned in a different comment (https://claroty.com/team82/research/freeze-the-controller-de...) says
> we searched publicly available internet-wide scanning platforms, including Shodan and Censys, for signatures associated with its management interface. It didn't take long to find what we were looking for. Numerous controllers [2765] were directly accessible from the public Internet.
So none at all is a possibility.
I get that having networked devices is a very nice to have feature. However, putting them directly to the open internet is bewildering. Any person worth their salt in IT would know that's a bad idea. Were these people never brought into the conversation? Do they connect to the store's WiFi so that IT isn't actually needed to install once the WiFi creds are obtained?
I imagine a very conscientious vendor could easily set up a system that detects if the device is trivially exposed to the internet, causing warning messages and beeps and general pestering.
... And then the customer demands it be turned off, and the customer is always right...