Chains in Sweden, Belgium and Luxembourg say fridge temperatures rose overnight, similar to hack of French stores
Supermarket chains in Sweden, Belgium and Luxembourg have said the temperatures of their refrigerators and freezers in dozens of stores rose overnight, prompting fears of a cyber-attack similar to one that caused millions of euros of food losses in France.
Sweden’s Coop chain told the daily Aftonbladet on Monday that six of its stores had been affected, while ICA said it was “aware that a limited number of stores were affected by an incident overnight which impacted their refrigeration and freezer systems”.
I work for the food industry, in automation. Our whole factory is connected. To the point that from my office, I can control most of the factory machines. From my office, from my laptop that needs to be connected through an ethernet cable to one of the tech network of the factory.
If I want to connect from another device, I need to set up a vpn with credentials and an authorised IP.
The only way to access our tech network from the outside is stealing my credentials and then ask some of my colleagues to authorise a device and IP for my credentials, something highly suspicious that would raise a lot of alarms.
I’m not going to say that a system like this is infallible but turns an attack like this extremely unlikely. This is how you should have your systems “connected”. Not through a login portal exposed to the damn internet.
Thanks I’m now in your system
Oh shit! While you’re in, can you please check my email and maybe answer some so I don’t have to tomorrow?
Thanks in advance!
They had their warning from similar attacks a few weeks ago. Whoever was stupid enough not to pull the plug on this interface deserves the losses. From the costs for the freezer contents, they could have hired even a pricy security specialist.
You mean to tell me that none of these people thought to disconnect them the first time?
Maybe we should stop putting appliances on wifi? Like, for everyone everywhere?
It’s worse. They were connected by 4G.
you would think people owning these stores might have prepared for this by not having those fridges online anymore…
on the other hand… why should they, as long as the insurance pays
Insurance is not free, they increase your premium when you make large claims
obvio, but that is a problem in their future, not in their present which these type mainly seem to spend on “how to make a load of cash quick?”
Stop connecting shit to the internet, this is not a difficult problem to fix.
I was gonna argue that a local remote control alternative doesn’t exist, but I really don’t know why you’d need freezers to be remotely controlled. They’re more of a set and forget.
imagine having a freezer that’s susceptible to a cyber attack. Why the fuck is it connected to the internet? All it needs is a thermostat. The closest thing to a “smart feature” that might benefit is the ability to send a notification if power fails or temperature falls below a set value, neither of which should be hackable by an outside party.
Right!? Haven’t we had these solutions for commercial fridges/freezers for quite a while now? Why on earth did we bring the internet into it? 😅
Even then, you can just have a battery powered thermometer connected for alerts. These have been available for a decade or more. No need to have the fridge involved at all…
To warn the technical department when the temperatures start rising and something is wrong. Sellers would not really pay attention to some fridge or freezer being warmer.
There are four ways of doing that:
- people on site
- an internal network that can only be checked locally
- proper supervision network that can push its state outside, but not be altered from the outside
- whatever the fuck they did
Guess what option was picked.
I mean, part of my job as a stocker of the frozen and refrigerated foods was checking to make sure the fridge and freezer’s temps were within spec every time I entered them, and to report if it was too warm or cold so it could be fixed.
Not to mention alarms and other ways of indicating issues. There could easily be a one-way signal that is inaudible to customers for example.
That’s a great reason to be on an internal network, but it surely doesn’t need to be on the internet.
Why these on network with outside access?
Because stupid. There’s zero reason for them to be on the public internet beyond incompetent operational IT security.
In theory they gather all sorts of data so they can see how efficiently they’re running, whether maintenance is needed. If something goes wrong with one of the units they can dispatch a repair guy immediately, or have the store shift the food before any spoilage. If they’re smart about it they can use the data to set up an efficient preventative maintenance schedule and really stay on top of things.
A chain that has 500 stores with 20 units a piece adds up fast. They probably have a person at headquarters whose only job it is to stay on top of these units.
You do that with your own internal network or, at max, with a vpn. You don’t need them to connect to the internet at all.
No reason not to connect to the internet. Put the units on their own VLAN and firewall that off from anything but the IP of the monitoring end. Plenty of other ways to make this secure, that one’s off the top of my head.
Exactly why do you need to do this instead of just keeping everything out of the internet and then connecting through a vpn tunnel?
If you need to monitor these 24/7 for some reason, pay a department that works 24/7 locally. Otherwise is just half-assing solution that will end like this sooner than later.
No reason at all to connect any kind of sensitive machinery to the internet, especially if remote operation of it can cause harm or damages.
pay a department that works 24/7 locally
AH! I don’t think you have an idea of how much even a minimum wage employee actually costs. Whatever you think, double it. $15/hr.? OK, that’s $30 cost to the company.
And then you lose the ability to manage and collect data centrally. You could have a couple of dude likes me sitting at home in shifts, monitoring a thousand locations, putting in tickets for issues and submitting fancy charts to corporate. And you want 3,000 dudes like me on site in shifts? Yikes.
Point being, securing a device on the internet is child’s play. There’s simply no excuse not to do so. Even the dumbest SOHO router allows one to control a firewall. Aside from labor, setting up a corporate VPN for this use case would cost beans. I’m dumb and I can, and have, done this.
Wow… where do I start?
If the department is that important, you pay people to have it manned 24/7. Yes, despite the cost, because it’s that important. Where I work, we have an NH3 cooling system and it is that important, so it’s manned 24/7 locally. But I digress…
You can collect that data locally, in a machine that is only reading the data (not writing it) and that then relays it to the outside through a VPN to which are connected only the relevant people. That way the machine is kept local, but gives your central the data it asks for. Again, no need for a freezer to be connected to the internet at all.
Then, to keep it local and safe, if you don’t want to pay someone 24/7 what you do is set a series of setpoints to trigger warnings and alarms that will notify your local team (which, even if it’s not 24/7, should be on call) to intervene in case of need. That way, if your freezer temps raise above the threshold, your local team will get a call automatically and act before even the central knows.
But ok, let’s say you, for some absurd reason, need to micromanage the freezers of the whole country from the central offices. If that’s the case, and I guess you have a good bunch of freezers to manage then, what you do first and foremost is creating a VPN to connect them all. And with that done, you allow access to it only to a controlled set of devices from which you can manage the freezers and that is separated from your administrative network to keep it safe.
And yes, all this costs money, but if you are big enough to be a target, you should be spending in security because the bigger you are, the bigger your loss when an attack happens. Looks to me that you’re just trying to save poor corporate some money by cutting corners when it comes to security and well… that’s a valid strategy… until you’re targeted.
The first and foremost sign of intelligence is the ability to learn. Somehow, those supermarket owners seem to lack this important trait.
IT Security sits in cost center side of the business for these Legacy companies.
It’s very much a " everything is fine why do we pay you?" Or everything is broken why do we pay you?" Situation
Yeah, this is why I resist getting a job actually doing mainly IT security despite having been part of far too many incident response and recovery teams over the years. It seems like a no-win job at the moment because leaders rarely value it.
Looks like people didn’t learn any lessons from the past cyber-attack. Well, these kinds of attacks will continue as long as users don’t take corrective measures !
Maybe not everything needs to be on the internet.
I think these fridges are only supposed to be on the local network so they can be controlled centrally, and I assume the attackers gained access to the network. I HOPE these aren’t connected to a Datacenter like those cheap Chinese smart lights
Oh im willing to bet they are connected outside in someway. How else is the company gunna sell a subscription for fridges?
YTF does a refrigerator need to be on net control??? Isn’t it a set once and forget it device? Maybe to monitor it to report a failure… but to CONTROL it???
it’s so they can sell subscriptions to the cloud bullshit.
It’s more convenient for the hackers this way, duh
They’re sitting exposed to the public internet with a well known and super basic password. If your shit is on Shodan, you better know in detail the multiple layers of protection in use. Today’s date is not a password.
I think the takeaway here is how lucky these supermarkets have been. Any threat actor who’s organized would recognize the potential here and work to establish a proper foothold in the organization and try to pivot to corporate or payment networks. Instead they’re just turning off the refrigerators.
They are grocery stores, not some break room fridge. This attack is both economic (for the spoiled food that needs to be thrown out and the price increase that will come with that reduced supply) and on health (because not all spoiled food will necessarily be recognized as such in an effort to avoid the first consequence, plus if the fridges containing milk go warm for a few hours, they can test some milk and it’ll probably still be fine, but that best before date is now likely useless at best or misleading at worst). Also, even if most food is fine, if some food isn’t, it will mess with some people’s heads pretty badly.
If the intention behind the hack was disruption and damage, IMO this is one of the more effective angles they could attack.
If someone has gained access to controlling their fridge temperatures and they don’t know what the hell happened in that time they should be getting rid of all that product. They shouldn’t be trying to guess what will be okay to sell to customers lol and they don’t have time to go through every product so it’s a toss all situation. Ridiculous waste for an unnecessary feature.
Milk will not have any problems if it was not opened in the first place
Milk will have problems if it’s the 50c fast-defrost cycle that the fridges in the first attack reportedly hit.
