Someone on Twitter is saying that the username for the fridges was “admin” and that the password was the current date… Prime security in effect here, clearly /s
Well, this means the password is very often changed, so it is secure /s
I think it’s a funny warning by a good guy. The message is “get your shit together now before an all-out war”.
There’s nothing funny about wasting this much food
Funny as long as you don’t have to buy food in the affected area
Wouldn’t be surprised if we learned in a few months that this was done by state sponsored hackers.
2010s - We made everything smart, networked, and IOT!
2015-2025 - We need you to put your personal details into everything, everywhere, all the time!
2026-??? - We invented a machine that can hack everything on earth and steal all data for nefarious purposes.
Why the fuck does a refrigerator need to be on a network?
Controls have to be put somewhere, and networked interfaces mean fewer physical controls that may be difficult to access, tampered with or fail. Having a standard control protocol means interfaces can be changed and improved without modifying the hardware. They’re not a bad thing.
However, having networked controls exposed on anything other than private, air-gapped, wired-only LANs seems rather foolish, to me.
Speculation to your question, for monitoring and control.
For monitoring, log temperatures and send error message if it gets too high. Data could be used if any legal question come up about food spoilage.
For control, I’m guessing there’s times you want to shut it off or enable/disable defrost. Easier to do that at a computer than have controls that are either a pain inthe ass to get to, or too easy for some moron to mess with.
That being said, it should be on a local network and have no access to the internet. However a chain store would probably want the data sent to HQ, so the computer would need to be on the network.
That was a rather cold move.
Thanks a lot jackasses
Idiot design and engineering for the sake of cheep managers. Same reason they are taking all the air gaps out of critical infrastructure. Instead of having Internet connected monitoring separate from the controls like a normal person, they hook controllers to the Internet too, so they don’t have to pay a technician to come in.
For added stupidity, the department at my job which has monitors and controls online just caused a number of techs who only do monitor and control to retire by making them return to work in office.
But you can whittle down your labor costs to a single untrained guy monitoring by notifications in the closet they converted to the IT room.
Having fridges connected to the internet and getting them Hijacked is stupidity, not a cyberattack.
Being “smart” and connected to the internet is about to devalue a lot of manufactured goods that have no business being either one of the those things.
One can only hope
We’re making sentient refrigerators that can’t keep food frozen.
The executives that allowed the system to be built this way belong in prison for the value of the destroyed food. An engineer armload certainly told them this system needed better design and security and was told no by some cheap ass trying to preserve their executive bonus.
Nothing will ever change until these monsters have personal consequences.
Hacks and attacks like this will explode with AI.
AI is absolutely incredible at finding vectors for arbitrary code execution. It can jump from layer to layer to layer to find an exploit. I want all of my appliances from now on to be dumb and not connected to the internet.
I like physical media too.
This is exactly what happened to the US Army about a month ago.
Why the fuck are all of your fridges controllable from the Internet? We didn’t have to build such a stupid, stupid society.
Because shops don’t want to run hardware on site, so they outsource the hosting of management and monitoring to the cheapest contractor. Unsurprisingly they don’t spend on security.
Because this way the bill of materials, design work, and labor cost are all higher; and that way the company can earn more money!
Capitalism is so far detached from what capitalists pretend it’s like. Wealth distribution is so uneven in the U.S. that there’s extremely little incentive to lower costs, even if the business is worse off because of it.
Im surprised that the EU doesnt have a secuirty requirement for IT infrastructure in the food supply. Seems like an oversight
We do, but companies are given a billion years to implement that because The Economy ™️
There’s nothing as far as I know, even in industrial settings. Some companies are better than others, and some fields are better than others, but at the low level everyone does whatever the fuck they want. Always-connected teleservice routers and similar devices are everywhere, with outdated firmwares just waiting to be hacked. It’s improving but very slowly.
Erh we have the NIS2 directive… requirements are skyyyyyy high for critical infrastructure which is surprisingly a lot of industries. Among other things vulnerability management is a topic companies subject to NIS2 must cover. Not saying that it cannot happen to have outdated crap connected somewhere but the exposure is getting fast smaller and smaller.
The problem as that these directives and standards are completely beside the point. They do manage a lot of security-relevant stuff, but in the end what’s hacked isn’t the documentation the standards require but the actual code running on the machine.
And there’s pretty little that the standard can do against actual honest bugs and mistakes in the code.
Very limited scope
As in what?
As in for example this case isn’t covered
Food food supply chain isn’t covered? Isn’t it under « important entities »?
Distribution not retail
The whole field is evolving, there is the EU Cyber Resiliency Act and some provisions for critical infrastructure.
