Silas Cutler - Fridges 'n Scripts
===

​[00:00:00] 

Paul Roberts (Editor, Security Ledger): Hey, everybody. Welcome back to another episode of the Security Ledger podcast. I'm your host, Paul Roberts, the editor-in-chief here at the Security Ledger. This month as you know, and probably read about, hundreds of supermarkets across France found themselves confronting an unusual kind of cyber attack.

Hackers reportedly take control of remotely monitored refrigeration system and turn them into defrost mode. They even spiked the temperature on some of them up to 50 degrees centigrade, spoiling food, in some cases causing fires. The attacks targeted internet connected refrigeration controllers made by the Danish company Danfoss.

I'm in the studio

with Mr. Silas Cutler of Censys. I invited Silas in to talk about that because Censys had a really interesting blog post taking a look at that. But of course, in between when I invited Silas into the [00:01:00] podcast and today, when we're actually talking, there's been another huge cyber incident, this one involving vulnerabilities uncovered by a frontier model AI in PHP.

And Silas and Censys have been monitoring that as well. So I thought we're definitely gonna talk about the Danfoss refrigeration stuff, but let's start with the big news of the latter half of the week which is the PHP vulnerabilities. So Silas, welcome to Security Ledger Podcast.

Silas Cutler, Censys: thanks for having me. Yeah, it has been a, it has been a wild week and PHP has gotten the attention, but there are four or five other vulnerabilities -- there's also a React2Shell issue that's come up as well. So, there is no shortage of things going on this week.

Paul Roberts (Editor, Security Ledger): Let's talk about this PHP thing. First of all, for listeners who aren't totally clued in on what PHP is and why it matters maybe just give us a quick summary of that.

Silas Cutler, Censys: Yeah, so PHP is is a web scripting language. It's a programming [00:02:00] language that you would build things like websites in.

and it was one of sort of the first broadly adopted scripting languages for building really dynamic websites. So you can think back to the early like 2000s when people were just starting to put forms in their website where you could have dynamic content.

PHP really made that possible and practical to implement for a lot of places. I run a PHP based website for the better part of the past 12, 13, 14 years now. It is a malware repository and is fairly regularly attacked. It is though a, a language I enjoy working in, but it is also a language that there are a lot more secure options these days and there have been quite a few vulnerabilities in PHP over the past several years.

Paul Roberts (Editor, Security Ledger): I was gonna say, this is not new. There have been other vulnerabilities discovered and disclosed and patched by humans generally. This one, as we learned, was actually discovered by large language model AI agent obviously doing an analysis of the PHP code and, and [00:03:00] uncovering two critical remotely exploitable vulnerabilities.

And then as we learned, uh, other people, when they heard about this, just pointed their own AI agents at PHB and said, "Hey, find some vulnerabilities." And a lot of them found the same vulnerabilities.

Silas Cutler, Censys: A lot of them found the same vulnerability, but some of them also found different ways to implement it and different ways to go about essentially the same process. And that's, as bad as that looks right now, I guess for everyone that's seeing this from the outside, this is exactly, this is actually the best way that these things are supposed to work because we've seen this technique for years.

When a big vulnerability like this comes out, people that are professional vulnerability researchers and exploit developers, they're gonna, they're gonna retest it, they're gonna build their own proof of concepts for it. But with all the AI tooling, we're seeing a lot of cases where initially they start off with incomplete information, but it's helping to find more vulnerabilities that are tangential to it or closely related.

So it ensures that at as they're building patches for it, we're [00:04:00] gonna have hopefully more secure patches that are gonna have a broader effect on this rather than having a situation where we have a vulnerability this week and in two weeks there's another critical vulnerability that's just slightly related.

So hopefully it should shorten some of that, but we're definitely going to see a long tail for this just because of how broadly PHP is used.

Paul Roberts (Editor, Security Ledger): It also somewhat democratizes the ability to understand what the vulnerabilities are and presumably, absent a patch, even mitigate them on your own. Historically, as the, how these things typically played out was hopefully a, white hat cybersecurity company or internal researchers would discover this.

There would be days or months of them getting the patch developed and then they would disclose it and it would roll out and, hopefully everybody would apply it. Although as we know generally, we'll talk about this with the refrigerator issue, maybe not. But it was this kind of very drawn out thing and all of the [00:05:00] responsibility rested with the vendor to, address the issue, get it out and inform people about it and get them to apply the patch.

And I guess as you're saying, one of the things AI does is maybe democratize that a little bit.

Silas Cutler, Censys: Yeah, I think so. And like there was a lot of people I was working with and I've been working with through this week

and I'm seeing a lot of people using AI tooling as part of their investigations first just to help them understand these things better and be able to look at these things in ways that they never have before.

So even as early as like Tuesday afternoon, there were people that were talking about various settings that you could apply that might be able to mitigate it because they suspected that somewhere, like a rough region of where the issue would be. And they were like, okay maybe if we disable some of how session uploading works if you're not using that functionality, these were, I would say in the trenches, the duct tape fixes of but those things that in the field become really important for building up and doing that initial testing in terms of what mitigations are actually gonna hold. 

Paul Roberts (Editor, Security Ledger): So Censys, as I mentioned, did some [00:06:00] research into the kind of impact of these vulnerabilities. What, what kind of data do you guys have as to the scope of th- these flaws and how many different devices out there are affected?

Silas Cutler, Censys: Yeah, so we actually launched a site, I think maybe last night, it could have been this morning. So P php2shell, censys.com takes you to the landing page that we put together. It was put together by one of my

Paul Roberts (Editor, Security Ledger): link to it. Yes.

Silas Cutler, Censys: Awesome. Yeah, he did an incredible job on it. And it's got there's an old joke in the threat intel world about spinning globes on portals, and so seeing that also definitely was a trip.

But the, the numbers are high and staggeringly high, especially when looking at a vulnerability like this but there's some important context as well. So right now, the number that we saw that were vulnerable in total was around 41 million. And that includes not just, an IP address, but that's a website.

So there is going to be a lot of overlap in terms of the actual devices behind those. Right now, I think we're sitting at 33 million but we're already seeing incredibly fast [00:07:00] patch adoption. Since October 21st 8.1 million have been patched. So there is a lot of work going on for this.

So behind the scenes though, like, because the way we see it as Censys is we see what you could think of as websites and then the actual hosts on the internet, so the IP addresses. If you go down to just the IP address level it looks to be closer between one to three million actual direct hosts that are that are vulnerable.

But once you start piling on all the websites, and also websites that don't have a sort of traditional IP address, but are going through something like a, Cloudflare or another content delivery network we see those as well in our data.

Paul Roberts (Editor, Security Ledger): And what would an attack leveraging one of these vulnerabilities look like? What types of things should organizations be looking for?

Silas Cutler, Censys: Yeah, so it's gonna come in looking like pretty much a standard web request.

So it's gonna look like somebody's trying to upload a, upload data. So if you have a web form, it'll look similar to that type of request. However, inside the actual body of the data that's getting sent, there's gonna be a long string of characters, and then probably a couple commands that are, download this file and run it on the system.

[00:08:00] So if you're watching it, it's the process level, you'll see your web server process, and then a process will start under it, that will be like a command line session, and then a payload's going to get run and ideally land in a different process. So some of the things that folks have been talking about, there's been a little bit of confusion around, is there active exploitation in the wild?

And it gets to be a little bit of a definitional challenge because there's definitely people that have been using some of the, like early vibe coded proof of concepts, ones that really hadn't been tested. People have been throwing those since the minute they were put up on GitHub. So people have been just trying everything they can to gain access before patches go out.

Paul Roberts (Editor, Security Ledger): I mean, one of the issues this raises w - is similar to the Log4j vulnerability that came out, whatever it was, you know, five years ago, which is this is a ubiquitous technology that is part of many different applications that you are relying on as an organization. But you may not [00:09:00] know that you're actually reliant on it, right? And that was the case with Log4j, it's incredibly widely used, open source library that a lot of organizations didn't even realize they had in their environment. How do... So what would be your recommendation for companies to try and get a gr - like, is it possible that your first scan for, PHP dependencies within your organization might not be comprehensive?

Is there a, are there things that you might miss as you go looking for your exposure to these?

Silas Cutler, Censys: Absolutely. And some of that is going to simply because, especially during these times, a lot of infrastructure is moving, things are shifting around.

But secondarily even at least on the Censys side, in response to this vulnerability, we had folks who have been working since the notification came out, tuning and making modifications to the way that we're scanning in order to better ensure and expand our visibility to be a little closer.

So, things in general are just best practices. One is, first, [00:10:00] know your attack surface and know what you have exposed on the internet. A lot of vendors have been reaching out to customers to say, "Hey, if you're using our appliance, we're gonna have a patch for you soon or we already have a patch available."

So keeping both a watch on, first, your public the communications that you're receiving as well as what's actually going on, table stakes for visibility.

Paul Roberts (Editor, Security Ledger): It does really raise questions about just the incredibly rapid speed at which these issues go from, random post on X to global crisis right? Because, I mean, one of the things that seems to have changed is, I mean, you, you know, 10 years ago, you definitely might have heard whispers about some, you know, serious vulnerability in some widely used platform.

But finding whatever they're talking about would still take you days or weeks or longer. And just hearing whispers about it didn't mean anything. But now, you can just point [00:11:00] your AI agent at it and find exactly what they're talking about. And that really changes the dynamics of this threat landscape.

Silas Cutler, Censys: Oh, absolutely.

And, this vulnerability has been really interesting in that regard because a lot of folks have immediately turned to things like AI tooling to help them build build out proof of concepts. But this fast follow practice has been something that we've seen for years.

I remember when the Microsoft Exchange vulnerability that everybody called "Hafnium" happened

orange Sci, I think, was the, the vulnerability researcher that found it. But there was immediate follow on of other vulnerability researchers also looking down the same pathways, looking for things that Orange Cy had missed and trying to come up with their own vulnerabilities.

Paul Roberts (Editor, Security Ledger): Where there's, smoke, there's fire, right? Okay, if they found that vulnerability, we're gonna go look there too. We're gonna find other stuff. 

Silas Cutler, Censys: Yep. Even with a lot of the AI co- coding tools one of the first kind of vulnerability exercises I did was to take the source code for the old Mirai computer virus and put that through it saying, "Find me vulnerabilities." And it was fairly effective and found a couple of things that I had long since forgotten about.

Paul Roberts (Editor, Security Ledger): The other thing also is just the ability of [00:12:00] AI to find flaws that clearly, because PHP, like you said, has been out there for a couple decades now. Humans, it's not like nobody's looking at PHP, but it's able to find things to detect vulnerabilities in ways that humans maybe cannot.

Silas Cutler, Censys: So there's actually a, an interesting silver lining though to this because with PHP

having been out for so long and there being so many different ar - like architectures that it has been deployed on and different setups that it, that people have used it in, the, there's not a sort of uniform pattern across all PHP sites.

So yeah, it's a, it's a language and it's, it is a, an old one as well. So the proof of concepts that have been coming out, you know, if, if you're developing an exploit like with AI coding and you have your test set up, an AI may get to the, that, uh, a full working chain on that test setup, but that doesn't necessarily mean that it's going to apply to 90% of the vulnerable instances out there.

So there have been a lot of POCs that just have not quite had the broad impact that I [00:13:00] think attackers though they would. There are some folk, there are some folks that have said that they've managed to get a sort of a universal proof of concept working. Uh, I haven't seen any of those fully come out yet, but suspect in a few weeks or days we will.

Paul Roberts (Editor, Security Ledger): Okay. Let's shift focus from the PHP issue, which is just blowing up right now, to what preceded it as a issue that a lot of people were writing and talking about, which was attack on flaws in some refrigerator management software from a firm named Danfoss that makes, uh, industrial refrigerators that caused just huge disruption in France, uh, by, you know, they targeted some major supermarket chains and basically disabled their refrigerators, jacked up the temperature and spoiled, hundreds of millions of dollars in food.

Talk to us a little bit a- and when you dig into it not surprisingly, what you find, what you [00:14:00] often find, yeah, there were known vulnerabilities in this software. There were a lot of these refrigerators that were no longer supported, end of life but still actively used and managed. And publicly internet accessible.

These were, yeah, dis - systems that were air gapped for generations, but s- suddenly within the last 10 years or so have become internet connected and remotely managed. A really common scenario, but talk to us a little bit about because you guys also looked into the Danfoss issue. Talk to us a little bit about what you found.

Silas Cutler, Censys: Yeah so the, I think the vulnerability came out, or the incident happened, I think, on the 10th of October.

Paul Roberts (Editor, Security Ledger): 10th and 11th, yeah. Yep.

Silas Cutler, Censys: Yeah, so it was interesting because, so this was a really inter - like, really great example of exploits being changed together in order to achieve a direct outcome.

the actual first vulnerability that this involved was that you basically send a, a web request to one of these controllers that were out on the internet, and it [00:15:00] would send you back essentially what that day's password was.

This was disclosed back in March. It, and the, that password was based also on the, the current date of the system. Then in August, someone was able to find a second vulnerability where if you were logged into the system, you could change the email alert settings on it but there was a field within that form, which if you added a, a pipe command and then a bash command afterwards, you could run commands on the remote system.

So chaining these two together, you could go from complete unauthenticated internet to full compromise of the system. And so it wa - this was a really interesting one as it broke as well because, so from our visibility on October 11th, we saw 2,991 of these store Danvos StoreView control panels on the internet.

61% of them were in France 240 were in Belgium so 1800 versus the 240 in Belgium. And what was interesting is, as we started tracking this after the incident had occurred, we saw a pretty significant drop in the instances that were publicly [00:16:00] accessible. Likely this wasn't them actually doing patching, but just pulling them off the internet and hopefully doing the actual updates to them.

Paul Roberts (Editor, Security Ledger): And, and so just so people understand, so these are just the, like, you go into a supermarket, you have a, have a, an aisle that, with these large refrigerators with ice cream and, you know, frozen food and stuff in it. And, and these, this was software that was used to remotely monitor and manage these devices, right?

Silas Cutler, Censys: I'd actually looked up initially, because the thing that initially came to mind for me was, like, is this a SCADA device? Because it's a supervisory system. Like it... I actually had to go and ask Claude about this and debated it for a few minutes, but it's right on the line of, is this a, a full SCADA system?

But they do perform a function of being able to monitor and provide that remote interface for for the manufacturer, for repair entity to keep track of the systems.

Paul Roberts (Editor, Security Ledger): And the device itself, does it, is it have a form factor or is it merely just, you know, a virtual machine?

Silas Cutler, Censys: The closest analogy of what I can give that looks, what it looks like is if you're walking through somewhere like Target and they have the [00:17:00] like that red box that's attached to a pole where you can scan the the device,

Paul Roberts (Editor, Security Ledger): Y- yes.

Silas Cutler, Censys: touch panel that looks like that.

Paul Roberts (Editor, Security Ledger): Okay. Okay. And as I understand it from what I read a lot of these supermarkets have outsourced management of the refrigerator hardware. So it was third party that was managing these, and then they had deployed these management devices on the public internet.

So no VPN, these were just publicly exposed IP addresses. And had been called out by Clarity on this, that there were these exposed controller devices, right?

Silas Cutler, Censys: Exactly.

Paul Roberts (Editor, Security Ledger): Yeah. Which is just mind-blowing, but brings up so many issues that are so relevant for so many com - for the third party risk, and then just the lack of kind of basic operational security, right?

Silas Cutler, Censys: I'm sure there was the debate about accessibility for these devices because for the initial deployment, it was probably a we need to get this online. Can I see the devices working? The ideal setup, I think, for something like this, but where it gets to be s - [00:18:00] challenging is being able to just plug it in, have it be accessible.

If this was, like, a internal network to a supermarket, that may be fine. Ideally, you don't wanna leave vulnerable systems sitting, or you don't wanna have vulnerable systems at all, and you always wanna maintain the best level of patching that you can.

But if you're working with a, a third-party contractor that's going to be doing the monitoring of these devices, they're going to need to be able to connect to them.

And I think for me, the setup that I can imagine that I would like to see on something like this, and the way that I try and set up some of my systems is if I have something like a control panel, I would rather be able to only connect to it through an internal network or have it VPN back into a central hub and then be able to access and manage them through what would essentially be then a, a managed private network.

Paul Roberts (Editor, Security Ledger): Sure. But presumably, the supermarkets should be in the loop on all this, right? So if you're hiring someone to manage your refrigerator systems that have millions of dollars worth of food sitting in them. Okay, so you remotely manage it.

Okay. T- talk to us about the [00:19:00] security of that system. Like, how do you prevent these from getting hacked and turned off?

Silas Cutler, Censys: And that's a really important question that places need to be asking, because it's entirely possible that the local IT just would do the walkthrough and, check the temperature settings and write it out on a, a clipboard every day.

Paul Roberts (Editor, Security Ledger): Yeah. , Sneaker net, right?

Silas Cutler, Censys: The, the classic way to do it. So even actually in response to this, because there was a large discussion about this targeting France but there was some rumors that it also would hit Belgium and possibly Germany. I spent some of that day just calling local supermarkets where I could sit within, looking for small towns where there's one or two grocery stores, and they're just calling each grocery store being like, "Hey, calling with an odd question."

But then I realized about three calls in that I was calling grocery stores, asking them if their refrigerator was running, and most of them likely assumed that this was all just a prank call. 

Paul Roberts (Editor, Security Ledger): Yeah. And were you calling grocery stores in the United States?

Silas Cutler, Censys: Yes,

Paul Roberts (Editor, Security Ledger): Okay. So we're both in the United States. So Danfoss, so this hardware and software is also widely used here in North America, correct?

Silas Cutler, Censys: So it was a much [00:20:00] smaller count. Let me see if I have numbers for it, but definitely under 200. It probably was around 50 to 100 instances total.

Paul Roberts (Editor, Security Ledger): But are there similar deployments with other hardware and software? Very likely that's the case. Okay. So the other issue that came up in this is one that you and I are very familiar with and have been talking a lot about which is, uh, end of support, end of life devices. And many of these refrigerators that were compromised in this attack, as it turned out, uh, were running software that was no longer supported by Danfoss.

Uh, some of them, you know, more than a decade ago. But obviously, refrigerators got long lives decades potentially. But they were no longer receiving software updates, patches, and were, the vendor had basically kind of w- wash your hands of all this. This is a growing problem, right?

And we've talked about, the need for transparency around this and also some accountability.

Silas Cutler, Censys: Oh, yeah. I've seen it with the PHP thing going on at the same time.

One of my kind of, like, four horsemen of the internet [00:21:00] apocalypse is Mirai, it is it is so highly compatible across various devices that when these devices are left out on the internet and, and do find themselves in that final retired state of no vendor support, no, no patches they become susceptible sort of to, the forever day vulnerabilities where a vendor is not going to patch it or respond to it.

And they will get compromised. I think the hope is that, they'll hold on as best they can for as long as they can, but that people will pull them down before they essentially become a, a revolving door of

Paul Roberts (Editor, Security Ledger): And if, if you read the Danfoss, kind of statements on this, you know, they're sort of like, "Well, you know, we've issued patches, but if you're running software that isn't patching, you know, you should really think about replacing that device." But when you're looking at it from the perspective of a supermarket chain, you're like, "Why? We've got, you know, millions of dollars worth of industrial refrigerators here that work fine, but you just don't support the software. So why should we get rid of those?" And it's just a, it's this really big, very [00:22:00] fuzzy area of our economy right now, because the EU obviously has the Cyber Resilience Act, right?

They've got some legislation and laws about this, but even those are not totally clear on this. They apply, the CRA applies to devices sold after 2027. And they mandate, I think, five years of minimum support but they don't have hard rules around devices like these that might live for 30 years or 40 years, right?

And so it's just an open question of how are vendors going to respond to stuff like this?

Silas Cutler, Censys: This is where I'd really love to see more opportunities for...

if a vendor says, "We're not gonna support it," then I think that they should also, in some cases, allow other people to maintain it as well, because fundamentally the hardware, if the hardware is all still working and someone else wants to take on the role of managing it, or potentially find a better way to, to use it going forward, or if it's possible to still just use the device and disable the monitoring, maybe that's the right route.

Especially even with these devices, if the vendor had [00:23:00] said, "Hey, we're not gonna support these anymore." If you want a short-term patch, unplug it from the internet, buy a Linksys router from a, a neighborhood electronic store, and just plug them all into that. And you can still have your management interface from there, but it's going to be off the internet.

Paul Roberts (Editor, Security Ledger): And change the default password on that router. Yeah.

Silas Cutler, Censys: too, but...

Paul Roberts (Editor, Security Ledger): Yeah. There's also the concept of, like, code escrow, right? Of, you know, maybe just, um, a vendor like Danfoss saying, like, "Yeah, we don't wanna do software patches and stuff, but we're happy to let third parties come in and take that business from us, make money themselves doing it, and keep these products patched and updated and so on.

And, you know, so we're gonna do code escrow. We're gonna have, a whole bunch of vendors who have access to that. It's not open source code, but it's accessible if you wanna do maintenance and upkeep."

Silas Cutler, Censys: This is also an area that AI may, may be able to come in and handle some of that as well because, I've been doing this for a couple of the IOT-like devices that I have where I don't necessarily [00:24:00] want to use the vendor's software anymore, so I'll just build my own Equivalent of the software.

Paul Roberts (Editor, Security Ledger): And you and I know, because we both testified on behalf of like end of life software legislation and stuff like that: the conversation obviously is mostly around consumer electronics and home appliances and stuff like that. But I think an issue like Danfoss really makes clear no, there is a B2B a - aspect of this end of life problem that it, if anything, is even bigger and more serious than the consumer aspect.

Silas Cutler, Censys: Absolutely. We saw this also as there's end of life Palo Alto firewalls that are running. And in fairness to Palo Alto they have incredible security team and a big, good friends with a lot of the, the folks on their unit 42 team. But there have been instances where end of life Palo Alto firewalls have become the intrusion vector for groups like ransomware actors.

So having better options for how to manage that post-life of these devices is critical.

Paul Roberts (Editor, Security Ledger): That's right. That's right. Really interesting. What would you, if you were you were advising Danfoss on how to proceed after this what would you be suggesting to them?

Silas Cutler, Censys: That's a tough [00:25:00] question. I always wanna see some type of way for vendors to still reach out to customers that are using the devices still. Even from the Censys perspective we can help answer some of those questions for them. You don't even need to be a f - like an enterprise customer.

Like you can do all, a lot of that hunting just even as a free user. There's a combination of, look out for customers long term and also have your own awareness of what your deployment looks like and what is out there.

Paul Roberts (Editor, Security Ledger): Yeah. It really makes me wonder too about, the need for governments to be getting more, because that clarity research on the freezers, the exposed controllers for freezers, that came out in early August, right?

Silas Cutler, Censys: Yep.

Paul Roberts (Editor, Security Ledger): It's not, I don't think it's a stretch to be like are, are supermarkets and refrigerated goods critical infrastructure?

Yeah, for sure, like it's food. And yet, was there any kind of big response to that? Was there any, either in France or United States or other [00:26:00] countries, government saying, "Hey, whoa, we gotta deal with this now because otherwise this is gonna be really, easy prey for some ma- malicious actor."

Silas Cutler, Censys: Not that I saw, but the, the proof of concept I saw was written actually by a friend of mine and it's someone I trust where I suspect that they def - like reached out to Danfoss ahead of time to be like, "Hey, just here's the standard vulnerability notification process. Wanna let you know about a problem."

So it's becoming

increasingly important. 

Paul Roberts (Editor, Security Ledger): but as for a company, yeah, if it's some white hat hacker, they, you could anywhere get from, stop trying to extort me to oh yeah, we'll take a look at it. But if it's the head of your government's cybersecurity agency, that's a call. That carries a lot more weight and you're gonna definitely respond to it in a lot more, pointed way.

Yeah.

Silas Cutler, Censys: This is also the CISA challenge as well. Like one of the things that I saw over the past several years is the influence that CISA has had has been incredible.

And I've spent a lot of time calling companies and doing the cold call of like, "Hi, I'm Silas. I'm from the internet and calling to [00:27:00] report a problem on your network."

It's like a 90% of the time, the first time is a hangup, but when it's CISA calling and when it is the government coming and saying "Hey, we have a existing relationship with you. We know you through this ISAC and we, you've attended these things and you've heard from us before. We're just calling to let you know about some things that we're seeing that we think you should be aware of."

Like that carries a lot of weight. One of the CISA programs involving ransomware which was their like early notification program where they were getting information from researchers about potential ransomware attacks or ransomware attacks that were, where they hadn't started the actual encryption, but there was a clear sign that the threat actor had gained access to a company that was going to conduct a ransomware attack.

And it was something like $8 billion they were able to prevent going to ransomware groups. So the, the impact is there to be made. And one other thing also that I remember from the Danfoss was after the vulnerability had been reported in August, there was a very minor story that popped up. I think I saw it on Facebook initially about military bases where they had a similar problem with their freezers.

And it is the same story on repeat. They haven't [00:28:00] confirmed if it is the same, but I'm still very curious to know to know if that story is directly related.

Paul Roberts (Editor, Security Ledger): Here at Security Ledger, we're gonna look into that.

Silas Cutler, Censys: It's definitely something to dig into.

Paul Roberts (Editor, Security Ledger): Absolutely. Which again, even more astounding if that were the case, that it didn't immediately get elevated of being like, "Oh, hold on these things are being actively targeted. It's not just military bases, this is out in the public as well."

And there's so much going on, there's so much noise, and honestly, I feel like a lot of these agencies are really understaffed and just, they're just struggling to keep their head above water that, yeah, it's I think both of these incidents, the PHP and the Danfoss refrigerator incident make the case that we need to be a lot more on our toes and a lot more responsive to these because things are really picking up steam.

Silas Cutler, Censys: Oh, absolutely.

Paul Roberts (Editor, Security Ledger): Yeah. Hey, Silas, is there anything I didn't ask you that you wanted to say?

Silas Cutler, Censys: I think we covered it.

Paul Roberts (Editor, Security Ledger): It's always great talking to you.

Silas Cutler, Censys: Thanks for having me.

[00:29:00]