- cross-posted to:
- technology@lemmy.ml
- cross-posted to:
- technology@lemmy.ml
Chains in Sweden, Belgium and Luxembourg say fridge temperatures rose overnight, similar to hack of French stores
Supermarket chains in Sweden, Belgium and Luxembourg have said the temperatures of their refrigerators and freezers in dozens of stores rose overnight, prompting fears of a cyber-attack similar to one that caused millions of euros of food losses in France.
Sweden’s Coop chain told the daily Aftonbladet on Monday that six of its stores had been affected, while ICA said it was “aware that a limited number of stores were affected by an incident overnight which impacted their refrigeration and freezer systems”.
No reason not to connect to the internet. Put the units on their own VLAN and firewall that off from anything but the IP of the monitoring end. Plenty of other ways to make this secure, that one’s off the top of my head.
Exactly why do you need to do this instead of just keeping everything out of the internet and then connecting through a vpn tunnel?
If you need to monitor these 24/7 for some reason, pay a department that works 24/7 locally. Otherwise is just half-assing solution that will end like this sooner than later.
No reason at all to connect any kind of sensitive machinery to the internet, especially if remote operation of it can cause harm or damages.
AH! I don’t think you have an idea of how much even a minimum wage employee actually costs. Whatever you think, double it. $15/hr.? OK, that’s $30 cost to the company.
And then you lose the ability to manage and collect data centrally. You could have a couple of dude likes me sitting at home in shifts, monitoring a thousand locations, putting in tickets for issues and submitting fancy charts to corporate. And you want 3,000 dudes like me on site in shifts? Yikes.
Point being, securing a device on the internet is child’s play. There’s simply no excuse not to do so. Even the dumbest SOHO router allows one to control a firewall. Aside from labor, setting up a corporate VPN for this use case would cost beans. I’m dumb and I can, and have, done this.
Wow… where do I start?
If the department is that important, you pay people to have it manned 24/7. Yes, despite the cost, because it’s that important. Where I work, we have an NH3 cooling system and it is that important, so it’s manned 24/7 locally. But I digress…
You can collect that data locally, in a machine that is only reading the data (not writing it) and that then relays it to the outside through a VPN to which are connected only the relevant people. That way the machine is kept local, but gives your central the data it asks for. Again, no need for a freezer to be connected to the internet at all.
Then, to keep it local and safe, if you don’t want to pay someone 24/7 what you do is set a series of setpoints to trigger warnings and alarms that will notify your local team (which, even if it’s not 24/7, should be on call) to intervene in case of need. That way, if your freezer temps raise above the threshold, your local team will get a call automatically and act before even the central knows.
But ok, let’s say you, for some absurd reason, need to micromanage the freezers of the whole country from the central offices. If that’s the case, and I guess you have a good bunch of freezers to manage then, what you do first and foremost is creating a VPN to connect them all. And with that done, you allow access to it only to a controlled set of devices from which you can manage the freezers and that is separated from your administrative network to keep it safe.
And yes, all this costs money, but if you are big enough to be a target, you should be spending in security because the bigger you are, the bigger your loss when an attack happens. Looks to me that you’re just trying to save poor corporate some money by cutting corners when it comes to security and well… that’s a valid strategy… until you’re targeted.
That one’s not very secure.
Why not? Firewall off that VLAN and it doesn’t exist to the outside world. Port scan the supermarket IP (how did they get those?) and you’ll see nothing. Only way in is to hack all those routers, and if there’s a mix of brands and models, that just got way more complicated. Then you have to proceed with the attack.
Because spoofing. More complicated for sure but an attacker with knowledge of the layout could get some data through in some typical setups. Stop messing about and vpn or airgap it, if you want any sort of secure.