- cross-posted to:
- europe@feddit.org
- cross-posted to:
- europe@feddit.org
The intitial investigation is in.
In a “bizarre and unprecedented” cyber-attack, hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets pushing them from as low as -27C (-16.6F) to well over 50C (122F).
If shop managers first assumed it was an isolated failure, it soon became clear up to 700 stores – including those from the Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains along with a number of smaller independent shops – had been victims of a cyber-attack.
The hackers had pirated the controllers supplied by the Danish company Danfoss that controls the freezers and fridges. Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures. Initial investigations suggest the hackers disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours to avoid triggering alarms.
Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates or replace obsolete unsupported systems. The affected refrigeration units were “running outdated firmware”, it said. In the days following the first wave of attacks, France’s cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.
You must log in or register to comment.
Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures.
Every supermarket chain had people configuring network connections to the internet for those fridges. Every chain fucked this up themselves.
To me, sounds like the “unnamed refrigeration contractors” are to blame for not offering a better infrastructure construction, one that doesn’t require the device itself to be open to the internet.
Hacked? This term applied to this is an insult. The user name was “admin”, and the password changed daily - it was the current date.
This is not hacking, this is a complete and utter failure on behalf of the company who set this up, and their fault entirely.
It’s not even social engineering.
Do you have a source on this? The other article I had seen on this said the password changed daily and was algorithmically based on the date. So if someone analyzed past passwords they could derive future passwords, but not that it was literally the date.
Password changed daily
Wow, that’s crazy security practice!
it was the current date
Oh…
You are right. But also, authentication in a distributed industrial infrastructure is hard, and it is not really a solved problem. You would need to set up a public key infrastructure, giving each shop clerk, service worker, and manager a smart card, revoking them when they leave, recover lost access credentials, and so on. For every class of devices.
And it gets even more difficult if you want machines to securely talk with each other (think in administering every smart home thing un your house with a smart card…).
No. Controlling and monitoring the fridge and freezer temperature is not something left to non-technical people. Set up a company-wide VPN system, and make it secure. Run those services from a centralized place, with the control systems disconnected from the internet outside the VPN.
Run separate VPNs for financial systems, orders, company emails, and you are as set as one could expect.
Wtf would each ship clerk need access to remote monitoring of each fridge
And no, this is absolutely solved
Not that hard… why was this connected to internet at all? To be able to manage it remotely is a dumb excuse.
Makes sense to have them connected for remote monitoring and alarms and such, when a big freezer malfunctions you don’t have much time to save the merchandize before they are all legally unsellable. It’s too late when the morning staff finds everything thawed out. But that should be purely read-only access.
Yes, it does make sense to have them connected, but not to the internet. They should use a company intranet.
Don’t connect your critical appliances to the internet…
Some fun reading for anyone interested https://cyberplace.social/@GossiTheDog/117429502412235079
The issue is not that it was connected to the internet, the issue is that it should have been connected to a private VPN network so that monitoring can happen remotely but still securely (not to mention keeping fw updated and changing default passwords)
Yeah, this is such basic stuff. This wasn’t “a large hack”, it is a case of “the network guys there are hacks”.
Wow. Shit like that makes me think we all fucked up by not having licensing or certification for software engineers like we have with civil engineers. They’ve got a lot a lot of balls claiming they were “hacked” when every unit had the same easily guessable credentials.
Good point. It‘s bit like saying someone broke in when you let the door open. Here I suspected someone in this story used AI and that was the problem but no. They were just recklessly clumsy.
But the door was locked! I locked it real good! They broke in, I was robbed!
Oh, the key? I keep that well secured under the doormat. Also all the houses use the same key so they don’t get mixed up, pretty convinient eh?
It wasn’t me. Honestly.
So the insurance companies will probably give the supermarkets the middle finger since they didn’t do basic stuff like updating their appliances.
Why do you need a web enabled fridge/freezer? I want a SNMP/Trap (one way, exit only) alarm when temp is getting near outside the “safe zone”. One way, I set the numbers local, can’t be changed otherwise.
Its simple (as am I), why does it need to be on the “cloud”??? AM I TAKING CRAZY PILLS?
Management wanted a killswitch they could control. Then they lost control.
More likely they wanted a system that collects fridge temps and setpoint to a central database for so they can document compliance to food inspection authorities.
This is one of those moments, like buying a new car that all the “bells"and whistles” in the end work against you.
“The things you own end up owning you.”
-T Durden
I’m going thru this right now. I spent most of my life being able to move in 24 hours. Now I have to plan, I have to check local laws, I feel a slave to things I “own”. Point is the same w/ this. Your unnecessary web enabled device “own” them too.
I feel you with the “move in 24 hours”. I made multiple international moves with one or two suitcases and an easyjet flight. Now with a family and years of accumulated possessions, last move took months of planning and a moving truck.
My big issue is a legally owned machine gun, yeah it happens. I never expected to buy it, the price was right. Now its ATF paperwork and the fucking furniture.
Hacked? This term applied to this is an insult. The user name was “admin”, and the password changed daily - it was the current date.
This is not hacking, this is a complete and utter failure on behalf of the company who set this up, and their fault entirely.
Plus hooking these systems to the public internet. Noone prevented these fuckwits from isolating these systems properly outside of “we do not give a fuck” or “VPNs are arcane magic for me”
Russia
Might be, but the needed level of sophistication for this “hack” was actually “none at all”. This could just be a bad prank by bored teenagers who discovered the laughable security implementation.
Teenagers might have done 1 supermarket, this isn’t a prank - it’s an attack.
Probably more like a young person/people who thought it was fun/funny.
I get it, appliances shouldn’t be connected, and don’t need to be connected, but groceries are expensive enough.
Baduntss
Think about what tech will be out in 10 years if not sooner that has to be on the internet.
