This is what happens when you over-optimize and over-automate. You should just be able to plug those freezers into power and turn a knob to set the temperature. There is no reason for them to ever have an internet connection.
The temperatures of these freezers need to have a centralised audit trail, to comply with foodchain regulations. While such an audit trail could be built without Internet, Internet seems like an obvious solution.
The true problem doesn't lie with Internet access, it lies with low quality software.
The internet seems like the easy solution, not the obvious solution. For years, we have used the internet for things that didn't need it because it was easier and it seemed safe enough. I think that the coming months and years are going to see a lot of companies burned by that decision and scrambling to undo it.
The fact was that it was never safe, it was never secure, but that taking advantage of those problems was hard, and generally not monetarily worth it, meant we ignored the issues. That's no longer the case.
As for low quality software, the floor for the quality that internet connected software needs to have is now dramatically higher than the quality that non-connected software needs. I think that in many applications, it may no longer be economically worth it, or maybe even possible at all, to hit the necessary quality.
isn't it closer to the internet is owned by business interests, even though most of it was built out by the public and it was just slowly moved into the hands of people who don't care particularly about how it's secured.
The audit trail (status in general) could be read only. Enabling remote defrost (control in general) is an optional convenience which requires better quality software.
Nearly all software is low quality software. The programmers at the fridge company are likely 4 underpaid engineers in Pennsylvania or some other equivalent.
Saying the problem here is bad code is like saying the problem with gun violence is humans are too squishy to deflect bullets.
I'm not sure about freezers (I guess there was no monitoring) but when I worked for a large UK supermarket chain in the 2000s this was how the POSs worked.
When I first started credit cards were not taken as online payments, the system just stored your card details and the amount. That was sent to server in the back office, which collected all the data, then every night it would make a dial up or ISDN connection to the head office and send all the data there.
It's useful to have a central monitoring system, so you can detect if a particular device fails so you can dispatch someone to fix it, move the stock elsewhere, etc. Of course, such systems can also be weaponised against you, as this proves.
I'm extrapolating a bit here based on Reddit hearsay, but I think this may have to do with rural stores having essentially consumer-grade internet routers connected to the mobile broadband network.
Much of the coverage in Swedish media drives the point that only 4G-uplinked stores have been hit so far. I think that's unfortunate, because really it wouldn't have differed if these stores were connected by 5G.
I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router. In Scandinavia you can bypass CG-NAT on mobile connections by setting a particular APN, so my guess is that these control systems were simply findable on Shodan.
This also explains why this wasn't discovered after the recent French breach. Supposedly all the stores with "proper" uplinks were in compliance, and no one had thought of a way in for those non-compliant stores, because they "weren't even connected, so how would an attacker get in?"
Many of these smaller stores (and probably some of the larger ones too) rent or lease refrigeration equipment from one of a handful big providers. These are large and expensive systems, and there is costly paperwork involved together with logistics suppliers to show that the cold chain is satisfactory.
These refrigeration providers work with local contractors and HVAC companies to set things up. Their installation techs do what they think is required to remotely operate these systems. If you bring up the question keeping these systems offline or at least on airgapped networks you will most likely get a shrug as reply.
This is not a technology problem. This is problem of responsibility. One can hope things will improve when litigation starts happening, but it doesn't look good considering these people had literally months of notice since the well-publicized attacks on the American fridges, then the French fridges, and now these.
Litigation is not how we fix things in Sweden, the system is very different from the US. The companies will have to take the losses or try to recoup from insurance and update their systems. They might be able to negotiate deals w the fridge install companies.
> I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router.
Why would there be accidental port mappings on their router though? I could maybe see owners setting it up so they could monitor from home, but even that is a bit of a stretch for rural supermarket owners
What's the incentive here? Just some tech anarchism? I would have figured that they at least demand bitcoin to reverse it or something. I know, people will blame the Russians, but seems not super productive for them to do such mundane sabotage on such non-critical systems.
On the contrary, sabotaging things that impact everyday life and give a generalized feeling of decline throughout society is water on the mills of Russia's allies in Europe, notably the nationalist and populist parties.
The incentives are that Europeans will vote in isolationist parties that are either friendly with Russia, or at best neutral. Those parties will then be anti-EU, anti-NATO. Key word here is isolationist.
Russia knows that if they want to keep annex countries, they'll have to take them piece by piece, with little resistance.
Hybrid warfare. Anything that does damage but does not rise to the level of severity and attribution to be overt war. Russia at a minimum wants Ukraine (and Europe is supporting Ukraine heavily), some analysts think it's not impossible they try a direct attack on Europe in a decade or so, dumb as that sounds.
We've been in an information/intelligence "cold war" for decades and if low-cost, low-risk, high-economic-impact exploits can be exploited, they always will be.
Given the fact that public awareness will quickly push companies to scan all software for vulnerabilities using AI, attackers will be making the most of this period to find daily flaws in hundreds of software packages that we previously saw as either "robust" or "robust enough" given the attack time/cost vs. incentive, before these defensive tools are deployed and operationally effective.
Nation state security services and rogue actors must surely all be scrambling to decide what to do with the millions/billions of dollars worth of exploit development time that forms their tool-set, including potentially using up zero day exploits etc.
The other factor is in the midst of such hysteria as "rouge agents" and other crap piped by the media, along with the actual risks of individuals with a few hours now having as much power as teams with weeks of time to spend did just a few years ago, coherent reports of what's actually going on is drowned in the noise. Attackers take full advantage of this.
So instead of doing this during a potential future war when it could be a strategic advantage, Russia is doing piecemeal attacks right now to show Europe where the weaknesses are and give them time to upgrade their defenses?
In Russia various security services and oligarchs are always trying to win Putins good will. Which is why they will try various low level sabotage actions like paying some losers on signal to firebomb a warehouse or hack into freezers. Remember there is no possible downside for them.
As a reminder: Russia gave Ukraine tutorial level war from 2014 to 2022, allowing them to fix many problems in armed forces. Resulting in 2022 being far less lopsided than it would be with Russia attempting the same in 2014 or 2015 or 2016 or 2017 or 2018 or 2019 or 2020 or 2021.
Why you would assume that Russian strategy is optimal?
"Every bad thing that happens is the Russians" sounds very similar to "Every bad thing that happens is the Israelis." It's unhinged, Candice Ownens level nonsense.
Russian hybrid warfare focuses on stoking fear and unrest.
Basically making everything more shitty, and having people walk on eggshells - so that they'll vote for isolationist parties that are either neutral, or will outright appease Russia.
The idea is that no-one in Europe actually wants to go to war with Russia, and small remainders like these is enough to increase that fear.
That last line sounds like not wanting to go to war with Russia is a bad thing. Most Russians don't want to go to war either which is why those who can are dodging Putin's draft.
>Russian hybrid warfare focuses on stoking fear and unrest.
Basically making everything more shitty
Except that everything that is shitty in the EU right now has been the consequence of the last ~20 years of EU leadership and individual EU member policies.
Russia didn't increase the EURO supply during covid devaluing our wages and purchasing power. Russia didn't connect our fridges on the internet without a VPN with credentials admin:admin that any script kiddie could pwn. Russia didn't open our borders to unvetted criminals. Russia didn't offshore our industry leading us to fall behind on everything manufacturing related from cars to leading edge semiconductor fabs. Russia didn't create our NIMBYistic housing policies that made our current housing shortage. etc, etc, etc.
Blaming Russia (and China and Trump) for every single shortcoming of the EU right now seems the default scapegoat for the incompetence of everyone in the EU from politicians to business leaders. Have those people ever taken any accountability for their mistakes?
What about the rant I was replying to? Only one PoV is allowed for political rants? The one where criticism of EU's faults is not allowed, and all fault of EU's policies put on Eurasia? Or was it Eastasia? Sorry, I meant Putin and Trump.
> Except that everything that is shitty in the EU right now has been the consequence of the last ~20 years of EU leadership and individual EU member policies.
at risk of being autistic: no, not everything
plenty of shitty things is happening for reasons utterly unrelated to that
Some (or even all) EU policies being dumb does not make impossible to have problems caused by something else.
For example Russia was directly involved in making migrant crisis worse.
>For example Russia was directly involved in making migrant crisis worse.
Yes, obviously Russia will weaponize every single weakness of the EU (just how Ukraine, EU, US, NATO and China will weaponzie every weakness of Russia right now), but ultimately it's still a self inflicted weakness, that the EU could close at the snap of the finger if it actually cared about stopping it, and Russia would not be able to weaponize any longer.
It's very simple. Anything that hurts the enemy is good. That includes the civilian population. Actions like this increase general discontent, produce negative economic impact and divert attention from other areas.
Seems likely that its either a capability demonstration for a future extortion campaign, or some kind of state-level hybrid warfare campaign. In the latter case the obvious culprit is Russia, but who knows?
Or another ai has broken containment and has a fixation about freezers...
General unrest, as well as stress testing critical infrastructure, and perhaps most importantly shifting the window for what counts as acts of aggression that don't trigger retaliation.
>but seems not super productive for them to do such mundane sabotage on such non-critical systems.
The hell makes you think food supply chain refrigeration is non-critical? How do you think safe food supplies work? This type of attack should be treated as an overt act of war.
Probably most of them had exactly zero inhouse expertise in cybersec and just pretended there’s nothing to worry about because having to worry would be inconvenient. Maybe some of them made a call to their cold chain supplier and were told that there’s nothing to worry about.
Not many, probably, but their cold chain people definitely would have known. Instrumented and remote monitored cold chains are standard these days because keeping stuff refridgerated end to end is a pretty big deal.
have you seen how big enterprises operate? It would generally take much longer from a decision to do something to any action happening, budget approvals etc.
And for anything infosec, unfortunately people who know a lot about infosec have a habit of 'crying wolf' and talking about infosec as some kind of absolute rule that everything has to bow down to with no willingness to balance against other business risks, so probably leadership is used to ignoring the people who knew that this was a big deal and were calling for action.
Monitoring, alerting, remote diagnostics and trouble shooting.
Commercial cold chains are expensive, high value collections of equipment that even small errors at the edges can cause huge monetary losses. And grocery stores are in an extremely low margin business.
I wouldn't be surprised if its their own agencies hacking these systems preemptively in order to force the issue and increase robustness against a larger multi-pronged attack.
I would love to read about how insurance premiums are driving technology changes, in general. How insurance companies are tabulating risk from AI hacking. Risk of noncompliance probably brought the store operators to networked fridges, how is the network risk evaluated in general?
Insurance risk and premiums might be the main drag on the AI future.
In France I believe that the password on the monitoring software, or the controllers, was updated daily. The date was somehow used as the new password, or as an input to the password sequence. So rolling the passwords didn't do anything when the attackers are aware of the "algorithm".
Hope all the fridges in hospital keeping medicines at exact temperatures are better protected these days then they used to be.. The can't exactly be air-gapped wither as they need monitoring for compliance etc.
Imagine they where internet exposed due to simplicity. It will take longer than three weeks to set this up. Not for you but imagine you are a store owner with 0 IT knowledge.
The issue is this needs to be handled centrally by the parent org also. They have IT of course but they usually do POS and desktops/servers.
The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.
ICA is franchised, so stores are owned and run by operators. The central company offers some services, but a lot of the decisions comes down to the individual stores.
No joke, yes they did. The markets hit here in Sweden are all in rural communities with very low number of tech workers. They likely order their system from a supplier, that should have alerted them and helped them, but apparently did nothing.
But then the supplier is responsible, why would you ever put a fridge online if you are are tech noob. Someone told these people to put these fridges online, they didn't put an Ethernet cable in the back by themselves for the fun of it.
The company installing the fridges did. The person who is an expert in food chain logistics bought the shiny fridges and was enamoured by the real business benefits they had of centralised monitoring and alarming of their fridges.
ICA Baronen on Odengatan is one of several stores in Sweden that have suffered a major hacker attack. On Monday, their freezers were cancelled at 50 degrees.
So no lack of IT workers/tech workers... Nor is it very rural.
>They likely order their system from a supplier, that should have alerted them and helped them, but apparently did nothing.
The first thing to do when you get access to these as a hacker? You disable the alarms...!
Now, the supplier should have set them up correctly over VPN, good passwords, Zero Trust etc but these an OT/SCADA are usually just open to the internet due to the simplicity of use.
After the PHP vulnerability, we got some clients asking if our SaaS product used PHP (it didn't). It's possible that they just contacted their vendor, who assured them that everything was fine.
This is actually good news. Accountability is everything when it comes to food supply. Forcing people to witness spoiled food is the slap people need to feel else they will never take action. The prolific insecure code that is keeping you from eating today will always be fixed.
It's not insecure code that's the problem, it's an insecure system, driven by project managers, information security departments, and box ticking.
For large companies, infosec will never allow some POS IOT device on their network without a 50 page form and large amounts of funding. The business however needs this to happen for whatever goals they have.
So the project manager goes back to the supplier, who recommend sticking it on a 4g simcard with a public IP address, and "install this app" to manage it
The project manger finishes the project, gives the app to the store manager, and rides off into the sunset, and nobody actually owns the equipment or even knows its there.
For small companies they likely don't have a technology provider at all, and just use the ISP's router.
Holy fuck don't connect your freezer to the internet. And if you do, have it be read-only, not change settings. Did we learn nothing from Battlestar Galactica?
It seems more like an economic annoyance campaign or something?
If I were a country with this kind of attack sitting around and I wanted to use it for war stuff, I’d probably wait until a hot war had started. Destroy the freezers when everyone is busy making weapons or manning trenches, might actually cause a food situation.
Let's say China and Russia have hacked into FBI and CIA. It helps those countries build a psychological profile of the centers of power in Western countries. This can help in many ways. E.g. if it is known that Bitcoin is actually a CIA plot to transition the whole world into post-dollar economy, then China can plan ahead and ask its citizens to buy gold. But china started buy gold propaganda in 2002. Or as Putin says this because Russia has access to Epstein files.
"Western elites have been accustomed for centuries to fill their bellies with human flesh and their pockets with money. But they must understand that their vampire ball is ending."
My fridge beeps loudly when something is wrong, and it has no connectivity to any network. Exactly how a fridge is supposed to be, why are we reinventing fridges…
"Fool me once, shame on you, fool me twice, shame on me." But it should have been, like Bush said: "Fool me once, shame on — shame on you. Fool me — you can't get fooled again."
Probably a central company that manages maintenance and preventative maintenance and uses them for monitoring and control. Taking them offline would probably cause more failures, and much higher costs in tech labor, tech travel, etc.
Admin interface available on the internet without 2fa and automatic password change once a week? Anyone gaining sufficient experience and seniority in the industry becomes instantly unemployable, so it is what it is.
1) "They" have no idea what exposed to open internet vs LAN vs VPN even mean. They have no idea what these terms mean, they just want the easy access. Same reason why open RDP to 3389 used to be so common. Vendors install these so the store owner and them have easy access to alarms and controls. So they vendor installs it for easy access, shows the store owner, store owner trusts vendor, but vendor has done the bare minimum. Because the vendor wants it easy too.
A VPN per store would be too complex for the vendor so they just expose these to the open.
Same story as with all the hacked OT/SCADA systems in the past. Like those hacks where some SCADA system is open as a website with pump controls.
Imagine they where internet exposed due to simplicity. Imagine you are a store owner with 0 IT knowledge.
The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.
2) Yes, obvious it is Russia doing this. Very handy to be able to disrupt food supply and they are also checking our response and time to restore.
I love how we're back to good ol' times that there is only one "evil empire", and it's completely impossible that anyone else from dozen of others possible bad actors is involved
Can't tell if it will be some asshole hacker group, Russia, the us, or what. But for the love of God please stop connecting everything to the Internet and also ai...
Highly doubtful. More than likely someone is picking targets here. Going for food supply is a war crime. So it could be an extremely hostile nation state. Or some really psychopathic disgruntled person/group. If there's no ransom it strongly leans toward a nation state in my opinion. A lot of turmoil between Europe and Russia+the us lately. That's my guess.
>A lot of turmoil between Europe and Russia+the us lately. That's my guess.
Attacking power plants, grocery stores, sending drones into multiple countries over and over, setting up gun/dead-drops in German forests, sabotaging warehouses and factories, etc wasn't enough?
That implies you also ensure that they monitoring system is isolated from the control system. No one can be bothered to do that, and no one wants to spend the money on an extra microcontroller (a tiny fraction of the cost of each unit, but it comes straight out of your margin because no one pays extra for security).
Analytics are very different from controls. People who model them the same tend to suffer. A lot of academics and project managers don't understand this unfortunately.
I wonder if any of EU reactors is connected to the open Internet with a weekly password reset policy, where you can use the control rods from the convenient of your home.
The magic question is: why isn’t this fixed yet? And then the specifics, the nitty grift of why not. Thousands of industrial fridges. They presumably all need new hardware, or at least tenporarily all need a RPi with additional software on the network cable, or it could even worse… are they on regular company wifi? Don’t these companies have VLANs? It’s astonishing that this is what brings billion dollar companies in a key supply chain down.
This little gimmick cost Ahold in the Netherlands an estimated 300 M€ a few weeks back. Enough money for any firm to set the engineers to work? Where they waiting it out? Having read some more… another part of Ahold (the Belgian part) was hit and has (only now…) taken all fridges down from the internet. What is IT risk doing in a firm like that? Internet of Shit is a decade old. I am
not amazed non tech sectors are perhaps a bit slower in IT risk management. I am amazed that an ongoing attack situation can still cause trouble 4 months after publication and months after board level headline grabbing numbers are widely publicized.
Me and my crew (yet to form ;) will visit any fridge for a measly 100 K€ a pop to take them offline. Book early, because once the script kiddies hit, we are on the road.
The way some of these publicly listed companies work now they would "rather have" a cyber incident and claim the damages on insurance than hire engineers, because that looks worse on a quarterly report to have salaried workers.
People (and media) seem to regularly link the two, but there was never any confirmation and the issues that AH showed had nothing to do with store fridges. They took down a system responsible for stocking stores, fridges, registers, etc were still functional.
You are right. That was never made public. They were hit on exactly the same day as the French hack of fridges and took what look like a forward looking step of taking a lot of infrastructure down.
That does lead to harder things to think about. Multiple different attacks on EU supermarktes? Resilience? And then the questions I point to above: how hard is it for non tech firms to fix an emerging IT risk situation.
Considering how Europe has embraced huawei and I saw a lot of their gear in consumer use when I was there, I’d be interested in seeing the Ben diagram of huawei gear and impacted stores
Hackers remotely override settings on thousands of freezers, fridges and chiller cabinets, pushing them from as low as -27C to well over 50C. Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains among those affected.
The true problem doesn't lie with Internet access, it lies with low quality software.
The fact was that it was never safe, it was never secure, but that taking advantage of those problems was hard, and generally not monetarily worth it, meant we ignored the issues. That's no longer the case.
As for low quality software, the floor for the quality that internet connected software needs to have is now dramatically higher than the quality that non-connected software needs. I think that in many applications, it may no longer be economically worth it, or maybe even possible at all, to hit the necessary quality.
Nearly all software is low quality software. The programmers at the fridge company are likely 4 underpaid engineers in Pennsylvania or some other equivalent.
Saying the problem here is bad code is like saying the problem with gun violence is humans are too squishy to deflect bullets.
The auditors should have their own devices separate from the temperature control to monitor them. All it needs is a few sensors, temp, humidity, etc.
No need for complicated cloud this-and-that nor air-gapping a grocery chain. Keep it simple.
When I first started credit cards were not taken as online payments, the system just stored your card details and the amount. That was sent to server in the back office, which collected all the data, then every night it would make a dial up or ISDN connection to the head office and send all the data there.
At least with CC's this would get your account cancelled now.
Much of the coverage in Swedish media drives the point that only 4G-uplinked stores have been hit so far. I think that's unfortunate, because really it wouldn't have differed if these stores were connected by 5G.
I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router. In Scandinavia you can bypass CG-NAT on mobile connections by setting a particular APN, so my guess is that these control systems were simply findable on Shodan.
This also explains why this wasn't discovered after the recent French breach. Supposedly all the stores with "proper" uplinks were in compliance, and no one had thought of a way in for those non-compliant stores, because they "weren't even connected, so how would an attacker get in?"
These refrigeration providers work with local contractors and HVAC companies to set things up. Their installation techs do what they think is required to remotely operate these systems. If you bring up the question keeping these systems offline or at least on airgapped networks you will most likely get a shrug as reply.
This is not a technology problem. This is problem of responsibility. One can hope things will improve when litigation starts happening, but it doesn't look good considering these people had literally months of notice since the well-publicized attacks on the American fridges, then the French fridges, and now these.
Litigation does of course occur but it's not the main mechanism.
someone manually poking a hole in their firewall is way more likely
Why would there be accidental port mappings on their router though? I could maybe see owners setting it up so they could monitor from home, but even that is a bit of a stretch for rural supermarket owners
That's the point of NAT-PMP / UPnP, it just works (for game servers, torrent clients, industrial control systems etc.)
Russia knows that if they want to keep annex countries, they'll have to take them piece by piece, with little resistance.
Given the fact that public awareness will quickly push companies to scan all software for vulnerabilities using AI, attackers will be making the most of this period to find daily flaws in hundreds of software packages that we previously saw as either "robust" or "robust enough" given the attack time/cost vs. incentive, before these defensive tools are deployed and operationally effective.
Nation state security services and rogue actors must surely all be scrambling to decide what to do with the millions/billions of dollars worth of exploit development time that forms their tool-set, including potentially using up zero day exploits etc.
The other factor is in the midst of such hysteria as "rouge agents" and other crap piped by the media, along with the actual risks of individuals with a few hours now having as much power as teams with weeks of time to spend did just a few years ago, coherent reports of what's actually going on is drowned in the noise. Attackers take full advantage of this.
Will it work, or will it harden their resolve to fight?
Why you would assume that Russian strategy is optimal?
For start several bad things are happening for very clear reasons not involving Russian state at all.
Though "sabotage in Europe has decent chance to be run by Russia" is in my opinion true statement, especially as some cases were linked.
But overdoing "omnipotent Russia is doing everything" in itself may be Russia-run campaign.
Basically making everything more shitty, and having people walk on eggshells - so that they'll vote for isolationist parties that are either neutral, or will outright appease Russia.
The idea is that no-one in Europe actually wants to go to war with Russia, and small remainders like these is enough to increase that fear.
Except that everything that is shitty in the EU right now has been the consequence of the last ~20 years of EU leadership and individual EU member policies.
Russia didn't increase the EURO supply during covid devaluing our wages and purchasing power. Russia didn't connect our fridges on the internet without a VPN with credentials admin:admin that any script kiddie could pwn. Russia didn't open our borders to unvetted criminals. Russia didn't offshore our industry leading us to fall behind on everything manufacturing related from cars to leading edge semiconductor fabs. Russia didn't create our NIMBYistic housing policies that made our current housing shortage. etc, etc, etc.
Blaming Russia (and China and Trump) for every single shortcoming of the EU right now seems the default scapegoat for the incompetence of everyone in the EU from politicians to business leaders. Have those people ever taken any accountability for their mistakes?
at risk of being autistic: no, not everything
plenty of shitty things is happening for reasons utterly unrelated to that
Some (or even all) EU policies being dumb does not make impossible to have problems caused by something else.
For example Russia was directly involved in making migrant crisis worse.
Yes, obviously Russia will weaponize every single weakness of the EU (just how Ukraine, EU, US, NATO and China will weaponzie every weakness of Russia right now), but ultimately it's still a self inflicted weakness, that the EU could close at the snap of the finger if it actually cared about stopping it, and Russia would not be able to weaponize any longer.
And the required investment is minimal.
Or another ai has broken containment and has a fixation about freezers...
Not saying we know anything about who did it, but senseless vandalism is usually a hallmark of kids.
The hell makes you think food supply chain refrigeration is non-critical? How do you think safe food supplies work? This type of attack should be treated as an overt act of war.
It is staggering to me the difference in people that come to HN.
This is one of the thousands of ways a hybrid war is fought!
And for anything infosec, unfortunately people who know a lot about infosec have a habit of 'crying wolf' and talking about infosec as some kind of absolute rule that everything has to bow down to with no willingness to balance against other business risks, so probably leadership is used to ignoring the people who knew that this was a big deal and were calling for action.
Snark aside, supermarkets are not in the tech business. The extent of their involvement is ringing their IT vendor to complain about it.
https://en.wikipedia.org/wiki/Schwarz_Digits
Commercial cold chains are expensive, high value collections of equipment that even small errors at the edges can cause huge monetary losses. And grocery stores are in an extremely low margin business.
Insurance risk and premiums might be the main drag on the AI future.
Was it a password break or an open admin console or SNMP or what?
The real issue is geniuses in food stores connecting to the open internet systems with 100K+ EUR of products exposed.
Remember, the 'S' in 'IoT' stands for Security.
https://www.bbc.co.uk/news/articles/cq1kd1nee80eo
The issue is this needs to be handled centrally by the parent org also. They have IT of course but they usually do POS and desktops/servers.
The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.
Want something simple? Don't connect it.
I have some unfortunate news for you.
There's a lot of scary shit online.
Hej! You are wrong, here in the middle of Stockholm got hit.
https://www.mitti.se/nyheter/icabutikens-frysar-hackades--fi...
ICA Baronen on Odengatan is one of several stores in Sweden that have suffered a major hacker attack. On Monday, their freezers were cancelled at 50 degrees.
This is in Stockholm - https://maps.app.goo.gl/BwbDST4dPVkjcdgA8
So no lack of IT workers/tech workers... Nor is it very rural.
>They likely order their system from a supplier, that should have alerted them and helped them, but apparently did nothing.
The first thing to do when you get access to these as a hacker? You disable the alarms...!
Now, the supplier should have set them up correctly over VPN, good passwords, Zero Trust etc but these an OT/SCADA are usually just open to the internet due to the simplicity of use.
(I mean, you need also a bunch of other things but yes)
For large companies, infosec will never allow some POS IOT device on their network without a 50 page form and large amounts of funding. The business however needs this to happen for whatever goals they have.
So the project manager goes back to the supplier, who recommend sticking it on a 4g simcard with a public IP address, and "install this app" to manage it
The project manger finishes the project, gives the app to the store manager, and rides off into the sunset, and nobody actually owns the equipment or even knows its there.
For small companies they likely don't have a technology provider at all, and just use the ISP's router.
https://news.ycombinator.com/item?id=50335252
What sort of electronic shitfight is about to go down between major powers?
If I were a country with this kind of attack sitting around and I wanted to use it for war stuff, I’d probably wait until a hot war had started. Destroy the freezers when everyone is busy making weapons or manning trenches, might actually cause a food situation.
Have been for a few years now.
"Western elites have been accustomed for centuries to fill their bellies with human flesh and their pockets with money. But they must understand that their vampire ball is ending."
but you just know someone will eventually if not already
because some vendor thought it would be easier for monitoring or firmware update
This is the bad part. Frequent password resets suck.
https://en.wikipedia.org/wiki/2026_French_supermarket_refrig...
1) I hope they learn some hard lessons about security and what should be exposed to the internet vs LAN.
2) These are some evil ass people doing this shit.
A VPN per store would be too complex for the vendor so they just expose these to the open.
Same story as with all the hacked OT/SCADA systems in the past. Like those hacks where some SCADA system is open as a website with pump controls.
Imagine they where internet exposed due to simplicity. Imagine you are a store owner with 0 IT knowledge.
The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.
2) Yes, obvious it is Russia doing this. Very handy to be able to disrupt food supply and they are also checking our response and time to restore.
I love how we're back to good ol' times that there is only one "evil empire", and it's completely impossible that anyone else from dozen of others possible bad actors is involved
/sarcasm
how is that possible? we're all dead from the plague.
Attacking power plants, grocery stores, sending drones into multiple countries over and over, setting up gun/dead-drops in German forests, sabotaging warehouses and factories, etc wasn't enough?
The hybrid war goes DEEP and has been happening for a long time. https://en.wikipedia.org/wiki/Russian_sabotage_operations_in...
Who ever thought it was OK to control freezers over the internet should be hung.
I've got really bad news for you about how many critical systems are connected to the Internet.
This little gimmick cost Ahold in the Netherlands an estimated 300 M€ a few weeks back. Enough money for any firm to set the engineers to work? Where they waiting it out? Having read some more… another part of Ahold (the Belgian part) was hit and has (only now…) taken all fridges down from the internet. What is IT risk doing in a firm like that? Internet of Shit is a decade old. I am not amazed non tech sectors are perhaps a bit slower in IT risk management. I am amazed that an ongoing attack situation can still cause trouble 4 months after publication and months after board level headline grabbing numbers are widely publicized.
Me and my crew (yet to form ;) will visit any fridge for a measly 100 K€ a pop to take them offline. Book early, because once the script kiddies hit, we are on the road.
That does lead to harder things to think about. Multiple different attacks on EU supermarktes? Resilience? And then the questions I point to above: how hard is it for non tech firms to fix an emerging IT risk situation.
https://en.wikipedia.org/wiki/Venn_diagram
Hoax?