'Unprecedented' Cyberattack cripples supermarket fridges across Europe as hackers activate automatic defrosting — delivery and store prices also impacted by incident
6 days ago by return2ozma to c/technology
I wonder how much money was saved by having someone manage the freezer section, or how much money was earned by not having an empty fridge.
Attacking a countries food supply and food reserves really seems like a act of war.
The term "hackers" really downplays the severity of these kinds of cyber attacks IMO. It makes it kind of sound like a teenager in a basement somewhere, as opposed to some foreign state cyber warfare group or something along those lines.
Also it's madness that systems like these are connected directly to the internet without read-only permissions implemented. Controls should only be accessible locally on some kind of airgap or local seperate VLAN.
The disconnect between how systems "should" be and how they actually are is disappointingly enormous.
Retailers are surprisingly enough just like consumers and want things to "just work" without caring about security.
And so they get Internet-connected fridges, and it's all fine, until the very moment it isn't.
I hope this is a learning experience and they beef-up their systems.
I hope this is a learning experience and they beef-up their systems
I hope this is a learning experience and they realize that commercial refrigerators don't need to have internet access.
And it’s not just retailers. I’ve seen this just about everywhere, especially in toxic workplaces.
Please stop with the acts of war or terrorism BS. The article also mentions "in-store pricing powered by electronic shelf labels" so lets not ignore this is about multi-billion companies trying to suck every penny out of our pocket. If these companies design and manufacture and buy stupid hardware that is susceptible to such hacking, they really deserve it. I mean they really do.
Second, this is a good thing. Systems will be hardened now. You think there would be any other fucking way they would upgrade their security unless something like this happens? Beatings will continue until security improves. This is why even chaotic hackers that cause damage and inconvenience are ultimately a positive force on our IT infrastructure. Think of it as an ecosystem and evolutionary pressure. Free marketplace of security models.
Agreed. It's also a massive jump to call a grocery chain's fridges a countries 'food reserves'
Not a leap at all, it's the food in the county as much as the next morsel.
An apparently untargeted attack on food supply is an attack on society before it has anything to do with that specific company, in my eyes.
Well, it is true. It is an attack on a society with internet connected refrigeration units with bad security. But fuck that society in particular.
Also it’s madness that systems like these are connected directly to the internet without read-only permissions implemented.
Water systems in the US are, too. And they have been hacked.
I'm sure the admins managing this infra did implement strict permissions... Separate vlans are safe until you find a vulnerability in the switch OS, or find a way to access the admins account.
This is exactly what happened to the US Army about a month ago.
https://www.militarytimes.com/...
Why the fuck are all of your fridges controllable from the Internet? We didn't have to build such a stupid, stupid society.
Because this way the bill of materials, design work, and labor cost are all higher; and that way the company can earn more money!
Capitalism is so far detached from what capitalists pretend it's like. Wealth distribution is so uneven in the U.S. that there's extremely little incentive to lower costs, even if the business is worse off because of it.
Because shops don't want to run hardware on site, so they outsource the hosting of management and monitoring to the cheapest contractor. Unsurprisingly they don't spend on security.
See, this is the kind of hack (if that's what it was) I can get behind. This is a military target of a nation that is currently at war. Fuck up their food supply all day every day.
But what is described in OP is just shitty.
I think Samsung had some sort of failed update that killed their refrigerators as well, makes you wonder.
Morgan Freeman Narrating: It was in that moment, they realized the IoT was a very, very dangerous idea.
Remote monitoring 👍
Remote control 👎
What's missing from this report is more detail on how exactly this attack went down. Did the attackers compromise supermarket networks and manipulate the fridges through lateral movement within the network; or were the fridges accessible from the open internet? If the latter is the case (and there's a non-zero likelihood they were): why the fuck?
why the fuck
Because, despite us being in the Information Age, and computers surrounding us everywhere, only a very small portion of the population consider that learning how they work may be useful.
Tell that to my developer colleagues who are busy defining "skills" for the AI to do the mundane things our tools could already do. It may waste huge amounts of electricity, water and money, make us dependent on American megacorporations, cause their skills to atrophy, and be a gamble every time, but at least they don't have to read the manual.
I assume because of the monitoring cloud-based IoT thing from Danfoss fridges were so comfortable to use. Ok, you don’t need it so often, but hey it’s a cool IoT feature.
Yes, they did. Keep the defrost button pressed.
I had a picture of the device since I was curious, but I spotted at Walmart, and some other stores, a Cellular/Wifi/BT gateway that was branded by some company providing facilities services. As far as I can tell, the device was intended to provide secure connectivity to some service provider. I found a similar device in the freezer section of another store.
I imagine that there is remote control/remote monitoring of all the freezers or other on-premise machinery (which, is a perfectly sound thing to do), but if the central provider doesn't take security seriously, and stay on top of their systems operations, can easily be the target for any kind of attacks.
More practically, I suspect that everyone involved has insurance whose cost is much less than ongoing proactive security + maintenance of their systems, which is why these incidents don't seem to instantly put these companies out of business.
Stuff like eWon routers are everywhere, they're basically openvpn (thank you open source devs, of course we won't contribute shit or share any of the money you made us) devices that connect to a bunch of central servers and allow you to tunnel to them. Compromise such a system and you're spoiled for choice on what to hit.
Guess...
Just wait until some cars get hacked to accelerate as fast as possible because we just had to have telemetry in them for surveillance and profit.
Search YouTube for "Michael Hastings Accident".
Hackers using AI can absolutely hack into a Tesla and make it do anything they want. I'm surprised they haven't to the point where it's major news.
Idiot design and engineering for the sake of cheep managers. Same reason they are taking all the air gaps out of critical infrastructure. Instead of having Internet connected monitoring separate from the controls like a normal person, they hook controllers to the Internet too, so they don’t have to pay a technician to come in.
For added stupidity, the department at my job which has monitors and controls online just caused a number of techs who only do monitor and control to retire by making them return to work in office.
Maybe they learned they need to air gap critical infrastructure, and leave the management to on-site humans who are paid well enough not to hold their inventory for ransom.
“Learn” hahahahaha
Did having centralized control and monitoring of coolers save a fake number of man-hours on a spreadsheet instead of paying a store employee already on the clock to check temperatures occasionally?
They’re going to keep doing it because the spreadsheet says the risk is worth saving those fictional man-hour costs.
I worked in an American grocery store for a while, and the employees, even the managers, did not take cooler temperatures seriously. They were eager to shrug off, make excuses for, anomalies. Because they were too busy, and a freezer meltdown (which happened as the result of malfunctions more than once) was a ton of work, a huge disruption.
Far from saving money, I'm sure an automatic monitoring and control system that raised an alarm at headquarters would have cost that store more money. But it also would have resulted in better monitoring. It would have done a better job than the people who were avoiding that job were doing.
Much later, I worked at an engineering sub-contractor for a hospital equipment manufacturer. One of my projects included adding automatic temperature monitoring and logging to some pretty simple OR appliances. Humans were supposed to be checking the temperatures of these things on a regular basis, but I got the notion that we weren't trying to save staffing costs so much as we were trying to make sure the mandated monitoring actually happened. Who really has time to check the temperature of the blood cabinet every hour? When things get busy, that's the kind of thing that gets skipped first. If anyone was even taking it seriously in the first place.
Why the fuck does a refrigerator need to be on a network?
Controls have to be put somewhere, and networked interfaces mean fewer physical controls that may be difficult to access, tampered with or fail. Having a standard control protocol means interfaces can be changed and improved without modifying the hardware. They're not a bad thing.
However, having networked controls exposed on anything other than private, air-gapped, wired-only LANs seems rather foolish, to me.
Speculation to your question, for monitoring and control.
For monitoring, log temperatures and send error message if it gets too high. Data could be used if any legal question come up about food spoilage.
For control, I'm guessing there's times you want to shut it off or enable/disable defrost. Easier to do that at a computer than have controls that are either a pain inthe ass to get to, or too easy for some moron to mess with.
That being said, it should be on a local network and have no access to the internet. However a chain store would probably want the data sent to HQ, so the computer would need to be on the network.
The executives that allowed the system to be built this way belong in prison for the value of the destroyed food. An engineer almost certainly told them this system needed better design and security and was told no by some cheap ass trying to preserve their executive bonus.
Nothing will ever change until these monsters have personal consequences.
Being "smart" and connected to the internet is about to devalue a lot of manufactured goods that have no business being either one of the those things.
One can only hope
Okay Mr. Moneybags, with a house so big you can't just hear the ding from the other end.
(I'm just kidding; even in my small house it's possible to miss it when the laundry closet door is closed.)
Because Samsung likes knowing when the wash is done from across the world.
Timer on my phone also does that!
It doesn't change that drastically in my experience, generally with full loads and a small selection of programs we regularly use. The dryer OTOH can often be done much sooner and the displayed time is more of an upper limit.
A simple timer still gets the job done when we're chaining laundry, don't need to maximize uptime by the minute. My devices are fine offline.
To add to it, I like to know water and electricity usage stats from my dishwasher, it's semi interesting. But generally I use the buttons on the thing.
Washing machine is easier to use via the app because it's stupid in on device controls
So you are telling me it is enshittified to the point it's unusable without the app that collects and sells all you data?
Yup, very happy with my purchase...
/s (in case it's not obvious 😔)
The reason they want to get people comfortable using the app is so they can move all control to an app to save money, which will be a worse UX. I'm so sick of using my phone or some ipad screen to do everything. Most appliances just need a few buttons.
Oh, we know, because the thing shrieks until we open it. I can hear my neighbor's washing machine beeping, they're so loud here.
I can understand a lightweight IoT network to monitor temperatures and get alarms automatically. But why on earth would it allow controlling the fridge remotely?
Perhaps that's how the fridge company keeps you paying for the service. Allowing you to set temps, time defrost is all operational. You can do power saving and make sure that defrosts only happen during the store's downtime. You could also isolate a screwed up unit, have the store unstock it and shut it down until maintenance can come out to repair it.
It's fucking stupid, you don't use the manufacturer's systems for that, or you'll need one system for the fridges, one for the ovens, one for the lighting... You're supposed to connect them all to YOUR control system, over isolated VLAN/LANs and then secure your system only.
Control systems will have to be air gapped going forward. This IOT fetish that the MBAs had is going to come back and bite a bunch of products in the ass.
Probably for some remote control BS. My wife was really keen on being able to set up þe slow cooker and turn it on remotely while she was at work. I don't understand þe appeal, but I've stopped trying to guess at why stuff appeals to people.
Also, when I bought our last dishwasher it came wiþ some features I only got because þe model got good reviews and I couldn't get a version wiþout þem. One of þe ones I þought would be useless was an interior light þat illuminates it when þe door is opened. A year in, it was my favorite feature, and next dishwasher I buy is going to have it too. But when I was shopping, I could have cared less. Turns out, I'm really bad at predicting what features I'm going to like.
Having fridges connected to the internet and getting them Hijacked is stupidity, not a cyberattack.
Anyone ever worked with management and chatted about security on this stuff, they never wanna know. They never want to pay, its a line item of risk that is just a problem to budget or deadlines....that's a tier three wish list item that we can deal with later. Surprise it never happens.
Being a manager is an invisible job. When everything goes smooth then 'that's just how it's supposed to go'. When things break or get hacked the manager looks like they aren't doing enough. Meanwhile manager responsibilities cover an unreasonable amount of work and stack up fast.
Managers can be in a good place work wise and then get 1 phone call that ruins their schedule for the week. When it rains it pours because then employees call out, some employees can't get along so you have to deal with their high school drama, then someone needs a report, then there was an inventory supply or a computer/accoubt isnt working etc etc etc. At some point the manager has to say 'this isn't my company and I'm not going to put in a bunch of unpaid overtime (your salary and only get paid 40 hours a week. Anything over is you working for free instead of enjoying your personal life) to fix this'.
Just like the people they manage, managers aren't very incentivized to sign up for their own big projects that don't require their immediate attention. Managers might get a bonus for a job well done at the end of the year but is it really a bonus if they worked a bunch of unpaid overtime all year? Feels more like a partial refund to pay some of that time back.
2010s - We made everything smart, networked, and IOT!
2015-2025 - We need you to put your personal details into everything, everywhere, all the time!
2026-???? - We invented a machine that can hack everything on earth and steal all data for nefarious purposes.
Someone on Twitter is saying that the username for the fridges was "admin" and that the password was the current date... Prime security in effect here, clearly /s
Im surprised that the EU doesnt have a secuirty requirement for IT infrastructure in the food supply. Seems like an oversight
There's nothing as far as I know, even in industrial settings. Some companies are better than others, and some fields are better than others, but at the low level everyone does whatever the fuck they want. Always-connected teleservice routers and similar devices are everywhere, with outdated firmwares just waiting to be hacked. It's improving but very slowly.
Erh we have the NIS2 directive… requirements are skyyyyyy high for critical infrastructure which is surprisingly a lot of industries. Among other things vulnerability management is a topic companies subject to NIS2 must cover. Not saying that it cannot happen to have outdated crap connected somewhere but the exposure is getting fast smaller and smaller.
The problem as that these directives and standards are completely beside the point. They do manage a lot of security-relevant stuff, but in the end what's hacked isn't the documentation the standards require but the actual code running on the machine.
And there's pretty little that the standard can do against actual honest bugs and mistakes in the code.
The whole field is evolving, there is the EU Cyber Resiliency Act and some provisions for critical infrastructure.
Hacks and attacks like this will explode with AI.
AI is absolutely incredible at finding vectors for arbitrary code execution. It can jump from layer to layer to layer to find an exploit. I want all of my appliances from now on to be dumb and not connected to the internet.
I like physical media too.
Wasn't Delhaize just hit by ransomware? Must've been 2025 or 2024. That's very embarrassing to go through this shit and not learn anything from it.
Alright then, No more IoT refrigerators in my home.
That was a rather cold move.
It's smart fridges all over again.
Who could possibly have an interest in fomenting chaos in Europe?
Fomenting chaos, one fridge at a time. Because in year 4 of a full scale war there are no more valuable targets than fridges. There's nothing else that might contribute to issues like that, like unnecessary internet-connected devices in domains without any IT knowledge, an influx of "hacking" incidents due to LLMs getting better at cyber at an alarming rate, and somehow still the most basic security not getting implemented.
I guess it's a funny warning by a good guy. The message is "get your shit together now before an all-out war".
Don't worry. It is surely only a misbehaving LLM...
Wouldn't be surprised if we learned in a few months that this was done by state sponsored hackers.
Thanks a lot jackasses
I think it's a funny warning by a good guy. The message is "get your shit together now before an all-out war".
Bwahaha... my hats off to those hackers. This is the social activism we need.
I don't mind them hacking supermarkets but destroying food is drawing the line for me. Granted, most of the frozen goods sold there are probably highly processed and not very healthy, but still.
Hacking the price tags is definitely great.
Consider the benefit though--one HUGE reason for people not to automate everything and still have people running the store.
The best way to influence business behavior is to disincentive behavior you don't want by making it cost money, preferably a lot of money.
Typically IoT things controll the temperature in cold chain applications. This is about food safety and health.
Don’t know about those fridges. I assume the monitoring targets open door alarm (glass door fridges), temp controll at all, and saving energy.
But hey, shout out loud your bad energy first. Don’t start thinking.
Don’t know about those fridges. I assume the monitoring targets open door alarm (glass door fridges), temp controll at all, and saving energy.
And why does any of that need a constant internet connection?
Fast food chains destroy food rather than donate it. People get fired for taking food home that’s “supposed” to be thrown away.
On an unrelated note, your avatar is awesome!
Oh sure, but that's a separate issue. These guys are hacking the stores knowing it will spoil food. Fast food workers are reprimanded for trying to not spoil food. Both things are bad.
And thanks!
I still don't understand why people hate supermarkets so much. Yes food is expensive, it has nothing to do with supermarkets. They make one of the lowest profit margins in any industry (~3%). New York's government groceries will be heavily subsidized by taxpayers. You might be fine with that, but he could have just subsidized private groceries for the exact same effect and saved a ton of money (it just sound worse to do that).
Oh, I hate the Internet of Things, not supermarkets.
But making low profit margins doesn't mean they're not trying to run up costs as much as they can. And the whole concept of a supermarket is depedent on cars, and I definitely hate car dependency.
I remember living in a South American city and it was absolutely wild to walk a few blocks to gather everything I needed for the day--bakeries, butchers, roadside vegetable vendors....
I remember living in a South American city and it was absolutely wild to walk a few blocks to gather everything I needed for the day–bakeries, butchers, roadside vegetable vendors…
You can still do this in many (most?) US cities (at least the ones I'm familiar with).
I rented a room in Boston once and I had to go to a single, medium-szed grocery store. I think rents can get too high to sell staples... But, yeah, if rents are low and you have foot traffic, of course you can pull it off. But you also need to have a substantial population that isn't driving to work every day and consequently passing 3 supermarkets on their way home.
You might be fine with that, but he could have just subsidized private groceries for the exact same effect and saved a ton of money (it just sound worse to do that).
Yeah, that would not be the "exact same effect."
And to like (at least) half of the people in this country, the thought of a private solution is the only acceptable one. It absolutely would not sound worse to them to do that, they've been tricked into thinking that's better for them.
@lemmy.world
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
go to feed...
@lemmy.world
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
go to feed...
Somebody learns the term "single point of failure" now...
save