{
  "id": 18758321,
  "title": "Show HN: Coldframe, a honeypot that poses as a supermarket fridge controller",
  "url": "https://urgent.news/2026/11/07/show-hn-coldframe-a-honeypot-that-poses-as-a-supermarket-fridge",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-07T17:27:30.000Z",
  "source": {
    "name": "Hacker News",
    "slug": "hacker-news",
    "url": "https://github.com/hedgerow-dev/coldframe"
  },
  "original_language": "en",
  "account": "Coldframe is a honeypot designed to mimic supermarket refrigeration controllers. In 2026, attackers gained access to internet-facing refrigeration supervisors across Europe using default passwords and outdated, unpatched firmware. Once inside, they forced defrost cycles. Coldframe acts as one of these controllers, recording the identities of connected users, the passwords they attempt, and the exploits they employ. It never grants access to real systems.\n\nThe Danfoss persona of Coldframe replicates the behavior of actual AK-SM 800A units. It mirrors various elements like the nginx server header and header order, the Danfoss StoreView page title, TLS 1.2 only, and a one-year certificate issued by a fake authority. By generating unique keys with each build, Coldframe can successfully accept weak logins, such as Supervisor/12345, and a specific CVE-2025-41450 code. Upon successful login, the attacker gains a session token and a dashboard displaying fake refrigerated cases with defrost buttons. Every action taken by the attacker is logged as a control event, with no actual impact on the system.\n\nSimilarly, the Dixell persona of Coldframe operates in a similar manner to real XWEB EVO units. It employs the same security measures, asset paths, page size, and login flow as the actual units. The login process uses the documented factory login of Admin/Admin. Five consecutive login failures within five minutes will lock the user, and attempts to bypass the XWEB Pro auth_mode (CVE-2026-25085) are recorded. Real units of both vendors display their respective favicons, and scanners identify devices using these icons. Coldframe replicates this behavior by including the vendor's artwork as its icon, provided it is available. By pointing the FAVICON_FILE variable to a copy of the vendor's artwork, a private deployment can utilize the decoy. The same applies to the Danfoss start page. Coldframe loads the same Angular loader page as the real units, with a corresponding Last-Modified and ETag header. If the firmware's assets/images/Danfoss-logo.png is present, Coldframe will use it as well.\n\nColdframe also offers an optional Modbus TCP service, serving fake case temperatures, setpoints, and a defrost register. By default, this service is disabled. When enabled, it can catch generic industrial scanners. Requests matching public exploits will trigger a log entry with an \"exploit\" field. To test Coldframe, deploy it on a low-cost Ubuntu 24.04 server (e.g., a $4 DigitalOcean droplet). Copy the provided cloud-init.yaml to the User data box and select either the Danfoss or Dixell persona by changing the PERSONA variable in the configuration. Upon boot, Coldframe will listen on port 80 (and 443 for Danfoss) and is hardened according to the specifications. Restrict access to only the necessary ports and block all outbound traffic, except for DNS and package updates. Only allow SSH connections from your own IP address. Use rootful Podman or Docker to build the container, and run it with root privileges on the host. Exclude any unnecessary services and services that could expose the decoy to the internet.",
  "summary": null,
  "key_points": [
    "Coldframe mimics supermarket refrigeration controllers for honeypot purposes.",
    "Danfoss and Dixell personas replicate real units' behavior and security measures.",
    "Coldframe logs all attacker actions without impacting the system."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}