Being “smart” and connected to the internet is about to devalue a lot of manufactured goods that have no business being either one of the those things.
The executives that allowed the system to be built this way belong in prison for the value of the destroyed food. An engineer armload certainly told them this system needed better design and security and was told no by some cheap ass trying to preserve their executive bonus.
Nothing will ever change until these monsters have personal consequences.
This is exactly what happened to the US Army about a month ago.
Why the fuck are all of your fridges controllable from the Internet? We didn’t have to build such a stupid, stupid society.
Because shops don’t want to run hardware on site, so they outsource the hosting of management and monitoring to the cheapest contractor. Unsurprisingly they don’t spend on security.
We’re making sentient refrigerators that can’t keep food frozen.
Hacks and attacks like this will explode with AI.
AI is absolutely incredible at finding vectors for arbitrary code execution. It can jump from layer to layer to layer to find an exploit. I want all of my appliances from now on to be dumb and not connected to the internet.
I like physical media too.
Attacking a countries food supply and food reserves really seems like a act of war.
The term “hackers” really downplays the severity of these kinds of cyber attacks IMO. It makes it kind of sound like a teenager in a basement somewhere, as opposed to some foreign state cyber warfare group or something along those lines.
Also it’s madness that systems like these are connected directly to the internet without read-only permissions implemented. Controls should only be accessible locally on some kind of airgap or local seperate VLAN.
I’m sure the admins managing this infra did implement strict permissions… Separate vlans are safe until you find a vulnerability in the switch OS, or find a way to access the admins account.
The disconnect between how systems “should” be and how they actually are is disappointingly enormous.
Retailers are surprisingly enough just like consumers and want things to “just work” without caring about security.
And so they get Internet-connected fridges, and it’s all fine, until the very moment it isn’t.
I hope this is a learning experience and they beef-up their systems.
And it’s not just retailers. I’ve seen this just about everywhere, especially in toxic workplaces.
Im surprised that the EU doesnt have a secuirty requirement for IT infrastructure in the food supply. Seems like an oversight
I can understand a lightweight IoT network to monitor temperatures and get alarms automatically. But why on earth would it allow controlling the fridge remotely?
You need that if you want to let managers remotely control settings via mobile apps.
Next time, the manufacturer will learn to use a local-only protocol like Matter.
Maybe they learned they need to air gap critical infrastructure, and leave the management to on-site humans who are paid well enough not to hold their inventory for ransom.
“Learn” hahahahaha
Did having centralized control and monitoring of coolers save a fake number of man-hours on a spreadsheet instead of paying a store employee already on the clock to check temperatures occasionally?
They’re going to keep doing it because the spreadsheet says the risk is worth saving those fictional man-hour costs.
They will calculate that they spend less on recovering from these cyberattacks than they would on paying staff fairly, and carry on.
Morgan Freeman Narrating: It was in that moment, they realized the IoT was a very, very dangerous idea.
Remote monitoring 👍
Remote control 👎
David Attenborough butting in: “That’s when they should have realized it, but did not. A fatal mistake.”
What’s missing from this report is more detail on how exactly this attack went down. Did the attackers compromise supermarket networks and manipulate the fridges through lateral movement within the network; or were the fridges accessible from the open internet? If the latter is the case (and there’s a non-zero likelihood they were): why the fuck?
I had a picture of the device since I was curious, but I spotted at Walmart, and some other stores, a Cellular/Wifi/BT gateway that was branded by some company providing facilities services. As far as I can tell, the device was intended to provide secure connectivity to some service provider. I found a similar device in the freezer section of another store.
I imagine that there is remote control/remote monitoring of all the freezers or other on-premise machinery (which, is a perfectly sound thing to do), but if the central provider doesn’t take security seriously, and stay on top of their systems operations, can easily be the target for any kind of attacks.
More practically, I suspect that everyone involved has insurance whose cost is much less than ongoing proactive security + maintenance of their systems, which is why these incidents don’t seem to instantly put these companies out of business.
Bwahaha… my hats off to those hackers. This is the social activism we need.
Removed by mod
Removed by mod
