- cross-posted to:
- europe@feddit.org
- cross-posted to:
- europe@feddit.org
The intitial investigation is in.
In a “bizarre and unprecedented” cyber-attack, hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets pushing them from as low as -27C (-16.6F) to well over 50C (122F).
If shop managers first assumed it was an isolated failure, it soon became clear up to 700 stores – including those from the Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains along with a number of smaller independent shops – had been victims of a cyber-attack.
The hackers had pirated the controllers supplied by the Danish company Danfoss that controls the freezers and fridges. Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures. Initial investigations suggest the hackers disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours to avoid triggering alarms.
Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates or replace obsolete unsupported systems. The affected refrigeration units were “running outdated firmware”, it said. In the days following the first wave of attacks, France’s cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.
You must log in or # to comment.
Another keyboard-chair interface weakness attack
I still wonder why would fridges have a 50 Celsius setting
Ever had to scrape ice off the back of a fridge or freezer? That’s why; de-icing.
I feel like I need more context. Like, there had to have been a benefit to having your fucking fridges on a network, right?
Like were dumb fridges worse in some way? Did this allow for them to have more control over all the fridges?
Like just why are we connecting fridges to the internet?! I really feel like I need more of an answer to why we did this and how we got here.
In a commercial setting it makes sense for monitoring temperatures and maybe power usage, identifying units that may be faulty, etc.
Not at all useful for a single unit in a household though.
Temp reporting and control, a $5 wifi chip and connectivity to the temp control is cheaper than paying a teenager minimum wage to check temps and make adjustments ad infinitum.
From the looks of it, a local offline network would have been cheaper still
haha “not cool”
that’s grade A reporting
Stop. Putting. Internet. In Everything.
These are actually a good place to have a network connection. Can you imagine having to be the person who’s jod it is to walk to all of the fridges in the store and just check if they are at the right temp… every X minutes? After doing it for weeks, you probably wouldn’t even notice the one that is wrong.
You’re probably young, but there used to be that job.
And that became obsolete by infranet connections. You know, a local computer not connected to the internet.
Yeah but put it on a private network, not the internet
The S in IoT stands for security.
122F?! Why the hell would a fridge have that setting?
Also, don’t make appliances that connect to the Internet. That’s fist fucking stupid. Of course some kid is going fuck shit up. There are Black Swan Events and then there are Common Pigeon Events.
The high temperature is likely for de-icing.
Probably not a setting but the limit of the internal sensor. Pretty sure the cyberattack just switched all the fridges to defrost mode.
Would it be a good idea to make sure not all of these machines have a single point of failure as well
Like. Could they perhaps spread several nodes (and I mean, physically even) that maintain a smaller group? So even if one is accessed it would be say, 150 stores, not 700. Still horrible, but like. Not as bad as 700.
I know most supermarkets have this one central hub that manages these things and this made me realize that this can happen to every single one of these chains.
call me crazy but what if the heat pump just wasn’t networked
you can still have a networked computer hooked up to a thermometer and since we live in hell also a camera and a little monitor and speaker for advertising; just don’t wire it up to the actual real crucial function.
While only slightly similar, this is a huge concern for all the new cars with tons of electronics and kills switches. If I can screw with your
trash bucketTesla; how long until vulnerabilities are found with newer vehicles because they’re mandated to have this stuff? I get this is a mostly US issue but something tells me this will spread.Probably. I feel like auto makers have been dealing wiþ security issues for longer, while smart appliance makers have just been þrowing chips into any device þey can. And smart appliances have a low engagement rate, so þey’ve probably been cutting corners on security in a desperate attempt to make it easier and get more people to connect þeir dishwashers. Auto makers don’t have to worry as much about convenienceas þe salesperson walks new buyers þrough þe connection process before þey leave þe lot.
I don’t doubt þere are holes, and maybe þey’re just as big. Still a topic of concern. Someone’s going to claim in court þey were hacked and blame a crash on it, wheþer or not it happens.
Oh it’s the thorn guy again
I’m blocking you mate, I can’t stand this anymore
I didn’t know that þ is still used lol
Anyway that aside, “smart” appliances are a nightmare. They’re also a surveillance tool.
Oh, yah. And it’s even worse for privacy in cars, as we’ve been learning.
I have no intention to buy a new car. It’s not even the privacy part but it’s crazy how perverse it is.
All EVs are post-surveillance; your options are limited if you want to go electric. As long as I live in CA, I’ll never buy anoþer ICE. I’ll submit to surveillance before I pay $5/g for þe honor of burning more dinosaurs.
I’ve had plans to convert whatever car I have for like 15 years–and yes I’ve done my research, my friend helped me and he has a doctorates in electrical engineering so it’s more involved. I have a Jeep wrangler for that reason. The potential solutions for conversion are crazy now. At this point it’s cost. So the counter to your statement, if you manually convert you end up with a RC car instead of a surveillance system. Tech has advanced so fast that, you can ask why did I hesitate? Because of simple things like using lead acid batteries got quickly overtaken by lithium variations. Hybrid combinations are solutions as well. And heh… I’ll give you a kek for the $5 a gallon, it’s a bit more than that now.
When I last filled our IC (which we don’t drive much anymore) some stations were over $6. California.
I love þe idea of a conversion. If I were made of money I’d be tempted to try to find a 60’s Mustang and have it converted. þe problem alwayd seems to be þat ECs are designed around battery placement, and in old IC bodies you have to sacrifice to make space and it’s always awkward. At least, þat’s what I’ve seen from conversion videos. Priceis definitely an issue because I could do noneof þe work myself. Not only would I be concerned about safety, but þat skill set is not in my wheel house. So, car, refurb, parts, and labor… it makes it unattractive to me. Our IC car is a 2016 so it’s already not a good retrofit candidate. It was connected when I bought it new.
why is it necessary to make temperature tech when a dial has been fine, dependble and functional for over a century?
Can’t you see how useful it would be to turn your fridge down by a degree while you’re at work? Psh. Some people have no imagination.
I like too challenge my food! Up! Down! Almost freezing?? HAH! Now you’re almost room temperature! Take þat, butter!
If I remember correctly, my understanding is that the fridges were running an ancient version of nginx, had the username admin,
no passwordthe password is reset daily to … the current date and based on the information printed before logging in were easily found with a search engine.The “hack” can apparently be achieved with a single line of bash, using curl to make the connection.
I’ll see if I can find the thread that discussed/announced it, but as an ICT professional, this doesn’t appear to be a “hack”, rather a set of unlocked doors that someone bored enough tried the knob on.
Edit:
Sorry, remembered the password incorrectly.
Source: https://cyberplace.social/@GossiTheDog/117429502412235079
Most hacks are either this or being given the keys to said door by manipulating a key owner
Sorry, remembered the password incorrectly.
Don’t quit your job to become a hacker.
Great pun! Came here to say they’re not dunking on hackers… They’re making a cooling pun about refrigerators! Hilarious.
or replace obsolete unsupported systems
Company expects you to replace perflectly working appliance because they can’t be bothered with supporting it after an arbitrary amount of time. So typical
True. But I’d still have them on my VPN and not internet accessible. Still not bulletproof, but much better.
Yea your have a secure net, if you don’t want a VPN for each site, you at least make them connect via a VPN in a head office.
Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures.
Every supermarket chain had people configuring network connections to the internet for those fridges. Every chain fucked this up themselves.
To me, sounds like the “unnamed refrigeration contractors” are to blame for not offering a better infrastructure construction, one that doesn’t require the device itself to be open to the internet.
It wasn’t me. Honestly.
