A good article which covers a lot of aspects, including what happened technically, which software flaws were exploited, that the problem affected refrigerators which did not have updated firmware. It also mentions the EU cyber resiliency act, which has the specific goal to avoid such events.

Making industrial systems secure will be many years of work, since many are decades old and software and protocols were not designed with security in mind. This also affects consumer “smart home” systems and things like “smart TVs”, which are often not designed to have needed updates.

Worth mentioning that the effects of systematic attacks could be far worse - they can take out electricity, energy, and water infrastructure, payment systems, and bring things like chemical plants into an catastrophically unsafe state. The thriller “Blackout - Tomorrow will be too late” by Marc Elsberg describes such a (fictional) scenario with hacks targeting smart meters and industrial control systems for power plants, and it is in parts more realistic than one would wish. IIRC there have been such hacks targeting the oil company Saudi Aramco.

  • HaraldvonBlauzahn@feddit.orgOP
    link
    fedilink
    English
    arrow-up
    0
    ·
    2 days ago

    Here is a detail that the Guardian article does not mention:

    https://cyberplace.social/@GossiTheDog/117429502412235079

    So, it looks like the account was “admin” and the default password was the current date.

    Assuming this is true - No, with that level of security you really don’t need a nation state attacker to take all your infrastructure out. With the knowledge that there is a search engine called “Shodan” which lists internet-connected systems of a specific type, any teenager can do this.