Hackers Hit Supermarket Freezers Across Europe for the Second Time
Supermarket freezers across Europe hit by second suspected cyber-attack
Following an attack in France that destroyed food in up to 700 stores, refrigerators and freezers in Sweden, Belgium, and Luxembourg rose in temperature overnight. Coop and ICA reported affected stores, while Ahold Delhaize called it an IT incident. Technicians worked through the night disconnecting systems. The French hackers had remotely pushed freezer settings from -27C to over 50C, causing losses exceeding €130,000 at some stores.
Hackers had remotely overridden the settings on thousands of freezers, fridges and chiller cabinets, pushing them from as low as -27C to well over 50C.
- chromaton
As I mentioned in the thread regarding the previous attacks, I worked in a closely related field back in 2008-2009.
One thing I see repeatedly brought up here in this discussion is "Why can't we just set the refrigerator temperature with a knob and walk away?"
The problem is that these refrigerator cases are not as simple as your refrigerator at home. As a simple example, many systems allow you have control over the deadband: the exact low temperature at which the compressor turns off and the high temperature at which the compressor turns back on. You also have control over defrost cycles, compressor pressure and many other things (I worked with this a long while ago, and I don't remember all the details).
Take a look at some of these manuals, for example: https://www.hillphoenix.com/resource/installation-manuals-2/... As far as I can tell, those manuals just cover the refrigerator cases, and not the outside compressors and heat exchangers, which are another layer to deal with.
This is not something that a non-expert supermarket employee would be able to handle well. The purpose of all these settings is optimize around energy usage, maintenance costs, customer experience, etc. Even if you only save $500/store/year, you can see that it really adds up over a chain of 1000 stores.
That's why this equipment is remotely accessible: it's not like your fridge at home and requires a lot more knowledge to get the most out of it. Of course, that does not excuse poor security implement […]
- fritzo
Bless those hackers for firing a warning shot over our freezers, that we may take heed and secure our neonatal care units, stoplights, and air traffic controllers.
- bedstefar
I'm extrapolating a bit here based on Reddit hearsay, but I think this may have to do with rural stores having essentially consumer-grade internet routers connected to the mobile broadband network.
Much of the coverage in Swedish media drives the point that only 4G-uplinked stores have been hit so far. I think that's unfortunate, because really it wouldn't have differed if these stores were connected by 5G.
I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router. In Scandinavia you can bypass CG-NAT on mobile connections by setting a particular APN, so my guess is that these control systems were simply findable on Shodan.
This also explains why this wasn't discovered after the recent French breach. Supposedly all the stores with "proper" uplinks were in compliance, and no one had thought of a way in for those non-compliant stores, because they "weren't even connected, so how would an attacker get in?"
- hackingonempty
Back in 1995 this was so improbable it was one of the purported negative effects of the "Good Times" virus which was a parody of the virus warning e-mails that were being forwarded around at the time. Computers still can't give you Dutch elm disease, fortunately.
> It will recalibrate your refrigerator's coolness setting so all your ice cream goes melty.
- great_psy
I wonder if this might point to some efficiency loss coming from AI. Let me explain.
Say in 2015 they installed those smart refrigerators, they could go from 20 people monitoring temperatures to 1.
That was some profits being made by those companies, and they got to enjoy those benefits until now.
With AI finding exploits for so many things people wouldn’t spend time looking, we might need to go back to dumb fridges out of security concerns.
Now extrapolate to many other industries, the economic gain from AI might be hampered.
- jttnr
Discussion from 3 weeks ago on the refrigerator "hacks" in the french supermarkets:
https://news.ycombinator.com/item?id=50055304 (~1000 comments)
- liveoneggs
Why isn't the brand of cooler or cooler-controller being named?
Was it a password break or an open admin console or SNMP or what?
- c16
How did every supermarket chain around the world not jump at this and investigate?
- pbohun
This is what happens when you over-optimize and over-automate. You should just be able to plug those freezers into power and turn a knob to set the temperature. There is no reason for them to ever have an internet connection.
- ilkkao
This first happened in France over three weeks ago. It's unforgivable that many chains have failed to update their software in time. Or to take the freezers offline if an update isn't available.
I now read some interviews with local chains in Sweden and Finland, and they were still just investigating what to do at this point.