Idiot design and engineering for the sake of cheep managers. Same reason they are taking all the air gaps out of critical infrastructure. Instead of having Internet connected monitoring separate from the controls like a normal person, they hook controllers to the Internet too, so they don’t have to pay a technician to come in.
For added stupidity, the department at my job which has monitors and controls online just caused a number of techs who only do monitor and control to retire by making them return to work in office.
That was a rather cold move.
Thanks a lot jackasses
Being “smart” and connected to the internet is about to devalue a lot of manufactured goods that have no business being either one of the those things.
One can only hope
Having fridges connected to the internet and getting them Hijacked is stupidity, not a cyberattack.
The executives that allowed the system to be built this way belong in prison for the value of the destroyed food. An engineer armload certainly told them this system needed better design and security and was told no by some cheap ass trying to preserve their executive bonus.
Nothing will ever change until these monsters have personal consequences.
This is exactly what happened to the US Army about a month ago.
Why the fuck are all of your fridges controllable from the Internet? We didn’t have to build such a stupid, stupid society.
Because shops don’t want to run hardware on site, so they outsource the hosting of management and monitoring to the cheapest contractor. Unsurprisingly they don’t spend on security.
Because this way the bill of materials, design work, and labor cost are all higher; and that way the company can earn more money!
Capitalism is so far detached from what capitalists pretend it’s like. Wealth distribution is so uneven in the U.S. that there’s extremely little incentive to lower costs, even if the business is worse off because of it.
Attacking a countries food supply and food reserves really seems like a act of war.
The term “hackers” really downplays the severity of these kinds of cyber attacks IMO. It makes it kind of sound like a teenager in a basement somewhere, as opposed to some foreign state cyber warfare group or something along those lines.
Also it’s madness that systems like these are connected directly to the internet without read-only permissions implemented. Controls should only be accessible locally on some kind of airgap or local seperate VLAN.
Please stop with the acts of war or terrorism BS. The article also mentions “in-store pricing powered by electronic shelf labels” so lets not ignore this is about multi-billion companies trying to suck every penny out of our pocket. If these companies design and manufacture and buy stupid hardware that is susceptible to such hacking, they really deserve it. I mean they really do.
Second, this is a good thing. Systems will be hardened now. You think there would be any other fucking way they would upgrade their security unless something like this happens? Beatings will continue until security improves. This is why even chaotic hackers that cause damage and inconvenience are ultimately a positive force on our IT infrastructure. Think of it as an ecosystem and evolutionary pressure. Free marketplace of security models.
The disconnect between how systems “should” be and how they actually are is disappointingly enormous.
Retailers are surprisingly enough just like consumers and want things to “just work” without caring about security.
And so they get Internet-connected fridges, and it’s all fine, until the very moment it isn’t.
I hope this is a learning experience and they beef-up their systems.
I hope this is a learning experience and they beef-up their systems
I hope this is a learning experience and they realize that commercial refrigerators don’t need to have internet access.
And it’s not just retailers. I’ve seen this just about everywhere, especially in toxic workplaces.
I’m sure the admins managing this infra did implement strict permissions… Separate vlans are safe until you find a vulnerability in the switch OS, or find a way to access the admins account.
Also it’s madness that systems like these are connected directly to the internet without read-only permissions implemented.
Water systems in the US are, too. And they have been hacked.
Hacks and attacks like this will explode with AI.
AI is absolutely incredible at finding vectors for arbitrary code execution. It can jump from layer to layer to layer to find an exploit. I want all of my appliances from now on to be dumb and not connected to the internet.
I like physical media too.
We’re making sentient refrigerators that can’t keep food frozen.
Just wait until some cars get hacked to accelerate as fast as possible because we just had to have telemetry in them for surveillance and profit.
Hackers using AI can absolutely hack into a Tesla and make it do anything they want. I’m surprised they haven’t to the point where it’s major news.
Search YouTube for “Michael Hastings Accident”.
I was going to say, done and done.
I can understand a lightweight IoT network to monitor temperatures and get alarms automatically. But why on earth would it allow controlling the fridge remotely?
It’s fucking stupid, you don’t use the manufacturer’s systems for that, or you’ll need one system for the fridges, one for the ovens, one for the lighting… You’re supposed to connect them all to YOUR control system, over isolated VLAN/LANs and then secure your system only.
Control systems will have to be air gapped going forward. This IOT fetish that the MBAs had is going to come back and bite a bunch of products in the ass.
Control systems need to be gated behind a properly secured SCADA server, then you can monitor whatever you want by connecting to your company’s VPN.
Perhaps that’s how the fridge company keeps you paying for the service. Allowing you to set temps, time defrost is all operational. You can do power saving and make sure that defrosts only happen during the store’s downtime. You could also isolate a screwed up unit, have the store unstock it and shut it down until maintenance can come out to repair it.
You need that if you want to let managers remotely control settings via mobile apps.
Next time, the manufacturer will learn to use a local-only protocol like Matter.
Probably fof some remote control BS. My wife was really keen on being able to set up þe slow cooker and turn it on remotely while she was at work. I don’t understand þe appeal, but I’ve stopped trying to guess at why stuff appeals to people.
Also, when I bought our last dishwasher it came wiþ some features I only got because þe model got good reviews and I couldn’t get a version wiþout þem. One of þe ones I þought would be useless was an interior light þat illuminates it when þe door is opened. A year in, it was my favorite feature, and next dishwasher I buy is going to have it too. But when I was shopping, I could have cared less. Turns out, I’m really bad at predicting what features I’m going to like.
oh thank god. My brain has finally started automatically turning the symbol into ‘th’. That took forever.
Nope, not for me. Still hurting my eyeballs and brain.
I just skip the rest of the post as soon as I hit one.
Im surprised that the EU doesnt have a secuirty requirement for IT infrastructure in the food supply. Seems like an oversight
We do, but companies are given a billion years to implement that because The Economy ™️
There’s nothing as far as I know, even in industrial settings. Some companies are better than others, and some fields are better than others, but at the low level everyone does whatever the fuck they want. Always-connected teleservice routers and similar devices are everywhere, with outdated firmwares just waiting to be hacked. It’s improving but very slowly.
Erh we have the NIS2 directive… requirements are skyyyyyy high for critical infrastructure which is surprisingly a lot of industries. Among other things vulnerability management is a topic companies subject to NIS2 must cover. Not saying that it cannot happen to have outdated crap connected somewhere but the exposure is getting fast smaller and smaller.
The problem as that these directives and standards are completely beside the point. They do manage a lot of security-relevant stuff, but in the end what’s hacked isn’t the documentation the standards require but the actual code running on the machine.
And there’s pretty little that the standard can do against actual honest bugs and mistakes in the code.
Very limited scope
As in what?
As in for example this case isn’t covered
Food food supply chain isn’t covered? Isn’t it under « important entities »?
Distribution not retail
The whole field is evolving, there is the EU Cyber Resiliency Act and some provisions for critical infrastructure.
Maybe they learned they need to air gap critical infrastructure, and leave the management to on-site humans who are paid well enough not to hold their inventory for ransom.
They will calculate that they spend less on recovering from these cyberattacks than they would on paying staff fairly, and carry on.
“Learn” hahahahaha
Did having centralized control and monitoring of coolers save a fake number of man-hours on a spreadsheet instead of paying a store employee already on the clock to check temperatures occasionally?
They’re going to keep doing it because the spreadsheet says the risk is worth saving those fictional man-hour costs.
It decisions with skilled professionals not budget skimming project managers.
Somebody learns the term “single point of failure” now…
I wonder how much money was saved by having someone manage the freezer section, or how much money was earned by not having an empty fridge.
The management quarterly meeting PowerPoint presentation says x3 more yachts for us.
