> I spent years trying to convince people to build more secure IoT systems, but they always preferred cheap and easy solutions.

For me this has always been true of systems in general all across the decades that I've worked with technology. It's like pulling teeth to convince anyone in charge that backups or security are even a little bit important until after there's been a costly disaster, then it's all about "Why didn't you warn me this could happen?" - Umm... You mean like every single day for many months until you told me to shut up about it because my paranoia doesn't justify the tiny expense of ensuring you don't lose many tens of thousands of dollars or years of irreplaceable work or important records?

I went through a manual you mentioned in another comment. It listed "High level of security against undesired user access" as one of the features but it wasn't expanded upon. So I did more searching and found cybersecurity best practices from Danfoss.

https://www.danfoss.com/en/service-and-support/fix-and-troub...

They highlight connection through a firewall, mention secure remote access methods, monitoring for data breaches, strong access controls, etc. Reasonable, but these are just recommendations, so the stores could have followed all of them or none at all.

An article about Danfoss vulnerabilities mentioned in a different comment (https://claroty.com/team82/research/freeze-the-controller-de...) says

> we searched publicly available internet-wide scanning platforms, including Shodan and Censys, for signatures associated with its management interface. It didn't take long to find what we were looking for. Numerous controllers [2765] were directly accessible from the public Internet.

So none at all is a possibility.

IIoT (Industrial IoT) doesn't have time to deal with the load of bullcrap that cybersecurity is. Half of it is not even about security, but setting up moats and keeping control over users, which is very much not what you want to prioritize when setting up industrial infrastructure, and is rightfully rejected by engineers working there, who are concerned with safety and reliability first and foremost.

Though I'm afraid things are getting worse, or at least it looked so a few years ago, back when I worked in this space. The hot thing in IIoT / Industry 4.0 was basically taking all webshit technologies and deploying them on industrial hardware, to "leverage mature innovation and OSS ecosystem" or such nonsense. The problem (one of many) being, once the engineers were done trimming excessive security measures that negatively impacted safety, they were still left with node.js running on industrial controllers, now even less secure in general than it was originally.

Yes, there is little demand for this sort of thing when the potential loss, should it even come, is already insured. Your customer might actually not be users themselves but their insurance companies. It may be a better model to say pitch to them and then have them offer discounts to their clients who are using your tech that mitigates whatever % risk. Someone pitched that car probe to Progressive after all.

They're on Shodan and there's an admin account with a password that apparently *cannot* be changed.

So you can find one, log in, and have a look for yourself.

You shouldn't.

But you can.

But you shouldn't. Okay? Don't.

I would have said let them be doomed. But due to late stage capitalism so much has been centralized that everybody is doomed in many cases...