The intitial investigation is in.
In a “bizarre and unprecedented” cyber-attack, hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets pushing them from as low as -27C (-16.6F) to well over 50C (122F).
If shop managers first assumed it was an isolated failure, it soon became clear up to 700 stores – including those from the Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains along with a number of smaller independent shops – had been victims of a cyber-attack.
The hackers had pirated the controllers supplied by the Danish company Danfoss that controls the freezers and fridges. Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures. Initial investigations suggest the hackers disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours to avoid triggering alarms.
Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates or replace obsolete unsupported systems. The affected refrigeration units were “running outdated firmware”, it said. In the days following the first wave of attacks, France’s cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.
Hacked? This term applied to this is an insult. The user name was “admin”, and the password changed daily - it was the current date.
This is not hacking, this is a complete and utter failure on behalf of the company who set this up, and their fault entirely.
Password changed daily
Wow, that’s crazy security practice!
it was the current date
Oh…
If I remember correctly, my understanding is that the fridges were running an ancient version of nginx, had the username admin,
no passwordthe password is reset daily to … the current date and based on the information printed before logging in were easily found with a search engine.The “hack” can apparently be achieved with a single line of bash, using curl to make the connection.
I’ll see if I can find the thread that discussed/announced it, but as an ICT professional, this doesn’t appear to be a “hack”, rather a set of unlocked doors that someone bored enough tried the knob on.
Edit:
Sorry, remembered the password incorrectly.
Source: https://cyberplace.social/@GossiTheDog/117429502412235079
While only slightly similar, this is a huge concern for all the new cars with tons of electronics and kills switches. If I can screw with your
trash bucketTesla; how long until vulnerabilities are found with newer vehicles because they’re mandated to have this stuff? I get this is a mostly US issue but something tells me this will spread.Probably. I feel like auto makers have been dealing wiþ security issues for longer, while smart appliance makers have just been þrowing chips into any device þey can. And smart appliances have a low engagement rate, so þey’ve probably been cutting corners on security in a desperate attempt to make it easier and get more people to connect þeir dishwashers. Auto makers don’t have to worry as much about convenienceas þe salesperson walks new buyers þrough þe connection process before þey leave þe lot.
I don’t doubt þere are holes, and maybe þey’re just as big. Still a topic of concern. Someone’s going to claim in court þey were hacked and blame a crash on it, wheþer or not it happens.
I didn’t know that þ is still used lol
Anyway that aside, “smart” appliances are a nightmare. They’re also a surveillance tool.
Oh, yah. And it’s even worse for privacy in cars, as we’ve been learning.
I have no intention to buy a new car. It’s not even the privacy part but it’s crazy how perverse it is.
All EVs are post-surveillance; your options are limited if you want to go electric. As long as I live in CA, I’ll never buy anoþer ICE. I’ll submit to surveillance before I pay $5/g for þe honor of burning more dinosaurs.
I’ve had plans to convert whatever car I have for like 15 years–and yes I’ve done my research, my friend helped me and he has a doctorates in electrical engineering so it’s more involved. I have a Jeep wrangler for that reason. The potential solutions for conversion are crazy now. At this point it’s cost. So the counter to your statement, if you manually convert you end up with a RC car instead of a surveillance system. Tech has advanced so fast that, you can ask why did I hesitate? Because of simple things like using lead acid batteries got quickly overtaken by lithium variations. Hybrid combinations are solutions as well. And heh… I’ll give you a kek for the $5 a gallon, it’s a bit more than that now.
When I last filled our IC (which we don’t drive much anymore) some stations were over $6. California.
I love þe idea of a conversion. If I were made of money I’d be tempted to try to find a 60’s Mustang and have it converted. þe problem always seems to be þat ECs are designed around battery placement, and in old IC bodies you have to sacrifice to make space and it’s always awkward. At least, þat’s what I’ve seen from conversion videos. Price is definitely an issue because I could do none of þe work myself. Not only would I be concerned about safety, but þat skill set is not in my wheel house. So, car, refurb, parts, and labor… it makes it unattractive to me. Our IC car is a 2016 so it’s already not a good retrofit candidate. It was connected when I bought it new.
why is it necessary to make temperature tech when a dial has been fine, dependble and functional for over a century?
Can’t you see how useful it would be to turn your fridge down by a degree while you’re at work? Psh. Some people have no imagination.
I like too challenge my food! Up! Down! Almost freezing?? HAH! Now you’re almost room temperature! Take þat, butter!
Why do you need a web enabled fridge/freezer? I want a SNMP/Trap (one way, exit only) alarm when temp is getting near outside the “safe zone”. One way, I set the numbers local, can’t be changed otherwise.
Its simple (as am I), why does it need to be on the “cloud”??? AM I TAKING CRAZY PILLS?
Companies are impressed by developers that only know how to build pretty dashboards by just installing every npm package under the sun, opening all of the ports on everything, and requiring a connection to the cloud to make their front-end work. There may even be someone working for the company that explains the problems, but those people get ignored.
AI is just making this mentality worse.
Dead on perspective.
I’ve worked for that company, it was all “we can react in a moments notice on our smart phones” and other BS.
Then we got a real customer, the first thing out of their mouth was "what happens if a bad player gets access to one of those “smart” phones?
*crickets
I was there for sales support. aka a data center monkey (engineer), I was there to answer “can we do that?” from sales.
So blank stares follow from sales, sales looks at me to answer. I have been bitching that this is YUGE security hole for the last 2 years and I can’t answer w/o making the company look bad.
Then I realize why I’m there, I’m the escape goat (scapegoat). I sputter we are all patched up to the latest, we follow the tech bulletins (aka we are reactionary NOT proactive, no TQL another thing I bitched about). I’m trying to defend the undefendable, I wanted a walled system. You have to VPN in to see anything, no smart devices, not “lets everyone have access system” party.
The sale tanked, I got blamed, I said GFY and quit. Got another gig but played dumb as it was easier day to day to let another chump like me learn a lesson. Take the pay check and go home.
Now I live by: “Not my monkeys, not my circus”
And don’t get me going on Grafana… Let “church” up and make pretty data w/ another layer of M&C I have to set parameters too for the bosses to “oh ahh” over for some stuff shirt middle manager in a corn blue tie…
So you can see why I hate “smart” anything.
