Supermarket Freezers Across Europe Hit By Second Suspected Cyberattack (theguardian.com) 84
An anonymous reader quotes a report from The Guardian: Supermarket chains in Sweden, Belgium and Luxembourg have said the temperatures of their refrigerators and freezers in dozens of stores rose overnight, prompting fears of a cyber-attack similar to one that caused millions of euros of food losses in France. Sweden's Coop chain told the daily Aftonbladet on Monday that six of its stores had been affected, while ICA said it was "aware that a limited number of stores were affected by an incident overnight which impacted their refrigeration and freezer systems".
The Dutch retailer Ahold Delhaize, which last month reported a cybersecurity incident to police in the Netherlands, said an "IT incident" had hit fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg. A company spokesperson, Sarah De Meester, said the supermarket chain had established that temperatures in the cooling systems had increased, adding that the incident was being investigated. Belgium's Le Soir newspaper reported that dozens of stores and supermarkets were affected, including five Spar outlets, multiple Shop & Go convenience stores attached to Q8 service stations, and a number of smaller Proxy Delhaize minimarkets. "We started mobilizing technicians at 1am," Stephan Moelans, the chief executive of Sabcobel, which specialises in refrigeration system installations, told the paper. "We spent all night and morning disconnecting the affected installations from the grid."
The Dutch retailer Ahold Delhaize, which last month reported a cybersecurity incident to police in the Netherlands, said an "IT incident" had hit fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg. A company spokesperson, Sarah De Meester, said the supermarket chain had established that temperatures in the cooling systems had increased, adding that the incident was being investigated. Belgium's Le Soir newspaper reported that dozens of stores and supermarkets were affected, including five Spar outlets, multiple Shop & Go convenience stores attached to Q8 service stations, and a number of smaller Proxy Delhaize minimarkets. "We started mobilizing technicians at 1am," Stephan Moelans, the chief executive of Sabcobel, which specialises in refrigeration system installations, told the paper. "We spent all night and morning disconnecting the affected installations from the grid."
Has Battlestar Galactica taught us nothing (Score:5, Insightful)
playing the odds (Score:1)
Re: (Score:3)
The previous attack was based around old software that hadn't been upgraded. Default passwords are security failures of the manufacturer in any case; let's not try to blame the victim for stuff that software developers should have been eliminating since at least 1970s when there were public warnings about the problem.
Re: (Score:2)
The previous attack was based around old software that hadn't been upgraded. Default passwords are security failures of the manufacturer in any case; let's not try to blame the victim for stuff that software developers should have been eliminating since at least 1970s when there were public warnings about the problem.
You are assuming buyers are not demanding default passwords because they erroneously consider them to be a type of backup. Sometimes you are just not allowed to do the right thing.
Re: (Score:2)
I worked in the Physical Security world for 17 years (key cards, cameras, alarms, that stuff). Default passwords are generally a necessity, since you need to be able to set the equipment up the first time. If the manufacturer doesn't require it to be changed after initial config that's an issue, but even if they do require it there's almost never any requirement that the installers **NOT** change it back to the default and that's what will be done more frequently than not. The reason is for ease of servi
Re: playing the odds (Score:2)
"even if they do require it there's almost never any requirement that the installers **NOT** change it back to the default"
Ok, but we already knew these guys were incompetent at security...
So dumb (Score:2)
Re: (Score:2)
Enlighten me.
What could possibly be gained by having the ability to change temperatures in freezers remotely?
Re: (Score:1)
If there is insufficient electricity generation to balance the grid, you can either
1) pay an expensive standby power-plant to come online
2) pay big consumers to stop consuming
What we are seeing is (2). Electricity company says "Drop your consumption between 18:00 and 18:30, and we'll give you X dollars"
So they can remotely lower the temperature a few degrees before the shortage, then allow it to rise (within limits) until the end of the shortage.
Free money. But you need to be able to remotely control thou
Re: (Score:2)
That sounds like an invitation to mass sickness.
And mass lawsuits.
Re: (Score:3)
Service. Testing. Troubleshooting. Dispatching a service tech is very expensive, to the tune of $150/hr or more from the moment they leave the shop. If they unexpectedly need a part they then have to charge for going to get it. If they can access the system remotely and know they need Part #1234 and Filter #5678 before they leave the shop it's a huge saving for both the customer and the service company. If meat rather than milk is going to be stored in the unit the service company can make the change
Re: (Score:2)
Re: (Score:2)
* There's that word again...
Re:So dumb (Score:4, Insightful)
Re: (Score:3)
You've never worked in retail, I take it. Stuff gets moved around all the time, what's in the cabinet next week may be bags of ice or frozen salmon.
Service is the big need, I've covered it a bit in https://it.slashdot.org/commen... [slashdot.org]
Cyberfreezers (Score:5, Interesting)
The temperatures of these freezers need to have a centralised audit trail, to comply with foodchain regulations.
Sometimes you have to do something silly just because the insurance companies demand an audit trail. As usual, accountants are to blame.
Re: (Score:2)
umm yeah so you have a piece of paper that records that twice a year if that.
Re: Cyberfreezers (Score:4)
Re: (Score:3, Insightful)
The temperatures of these freezers need to have a centralised audit trail, to comply with foodchain regulations.
Sometimes you have to do something silly just because the insurance companies demand an audit trail. As usual, accountants are to blame.
I would think that an audit trail only needs temperature readings, not adjustments.
Re: (Score:2)
You don't want to know who made the adjustment? Nor the time the adjustment was made? What adjustment was made?
Might as well gut audit logs in Windows or Linux if all you want to know is a reading.
Re: (Score:3)
I would think that an audit trail only needs temperature readings, not adjustments. You don't want to know who made the adjustment? Nor the time the adjustment was made? What adjustment was made? Might as well gut audit logs in Windows or Linux if all you want to know is a reading.
"You don't want to know who made the adjustment? Nor the time the adjustment was made? What adjustment was made?".
All of that information is read only. There is absolutely no reason to allow manipulating the setting using the same connection because that's a major security risk.
Re: (Score:2)
Service on the device. If a company charges $150/hr for a service tech would you rather they make changes remotely or charge you an additional two hours minimum for travel (for each site)?
Re: Cyberfreezers (Score:2)
Auditing only requires that information go one way, so no, and also you don't understand the argument you're making.
Re: (Score:2)
You're right there, I am definitely way behind the curve on commercial refrigeration technology and associated regulations. I have no idea what I'm talking about here. Apparently I just quoted some random guy on Hackernews.
Re: (Score:1)
The temperatures of these freezers need to have a centralised audit trail, to comply with foodchain regulations.
Sometimes you have to do something silly just because the insurance companies demand an audit trail. As usual, accountants are to blame.
Sadly, I almost see this requirement more born from unscrupulous foodchain suppliers not really telling the public about that "one" time the fridge went down for 10 hours overnight..every other Thursday.
Blaming the accountants for our litigious society, is one hell of a way to get the lawyers to all agree to start charging double. You seem to like not blaming the one entity mandated by law who gets rich all day every day by both attacking and defending the right side, the wrong side, and both sides.
Re: (Score:2)
If there was any sort of centralized monitoring involved here, they would have caught the problem as soon as the temperatures rose above $AlarmHigh or remained above $AlarmLow for more than X minutes. They did not. The exploited interface was therefore a funct
Unidirectional serial adapter, TX lines but no RX (Score:2)
The temperatures of these freezers need to have a centralised audit trail, to comply with foodchain regulations.
Sometimes you have to do something silly just because the insurance companies demand an audit trail. As usual, accountants are to blame.
A friend works in an environment like that. There is a serial diagnostic port where status information is regularly dumped for logging purposes. They install a unidirectional serial adapter, TX lines but no RX lines.
Re: (Score:2)
And that is how you do it if you have a clue. Not even expensive, just requires understanding.
Re: (Score:2)
And that is how you do it if you have a clue. Not even expensive, just requires understanding.
Alas, it's historically been easy for people to slip into a mindset of "no hacker would ever know or care about OUR little system, because [reasons]", and use that as a justification for ignoring security concerns altogether.
Of course that's never really been the case, but now that any bozo with $200 in their pocket can just pay an AI to find every possible security hole and report back, it's REALLY not the case.
Re: (Score:2)
It is bot historically and currently true that most people are incompetent and suck at risk management.
Of course that's never really been the case, but now that any bozo with $200 in their pocket can just pay an AI to find every possible security hole and report back, it's REALLY not the case.
By far not "every possible", but enough to massively increase the pool of attackers with a newly discovered vulnerability. And since most software is missing redundant security (because most software does not qualify as a product of professional engineering) this is far too easy. All engineering disciplines had to eventually accept that the thing that protects you is redundancy, because mistakes cannot be
Re: (Score:2)
And how many people out there "have a clue" these days? Do you know anyone under 30 who has ever replaced parts in their computers, or repaired their own cars? We're becoming a society of hardware illiterates. If it doesn't have a GUI the majority of the people have no clue that it even **CAN** be accessed.
Re: (Score:2)
Yes to both questions about people, but both are engineers. I do not think technical illiteracy is getting larger. It was always very large, with brief periods where more people had basic knowledge about some specific tech as the alternative was simply no or no meaningful access to that technology.
Re: (Score:2)
Sorry store, you can't return all of that melted ice cream - because you never put it in a freezer. We know because we tracked the temp from the plant to your store and inside your store. You need to know who to blame.
Beyond stupid (Score:2)
Why would ANYONE need a centralized grid of fridges and freezers, especially if this runs in both directions and you can remotely control these stupid devices and not just read temperature stability?
Re: (Score:3)
because cloud and greatness and ai
Re: (Score:2)
Why would ANYONE need a centralized grid of fridges and freezers, especially if this runs in both directions and you can remotely control these stupid devices and not just read temperature stability?
Last summer my local Tesco had the fridges break down because they were overloaded. If the managers could see that the staff continually leave the doors open then this problem would happen much less often. Also, if they allowed the temperatures to rise slightly in chosen units at the key times whilst keeping other ones full and cold, they could probably have protected most of the stock of the shop.
Re: Beyond stupid (Score:2)
The managers could find that out by viewing security footage.
Management requires effort, it doesn't just magically happen.
Re: (Score:2)
Last summer my local Tesco had the fridges break down because they were overloaded. If the managers could see that the staff continually leave the doors open then this problem would happen much less often.
what exactly are the store managers and their subordinates doing all day that they're not noticing staff leaving the fridge doors open continually?
Re: Beyond stupid (Score:2)
An even better idea would be to ditch the cretinous vertical fridges where cold air pours out as soon as you open the door, and go back to horizontal ones where, by its nature, the cold air just sits there.
Re: (Score:2)
Chest freezers meant things like chips [french fries] get frozen into one solid mass at the bottom which customers avoid. Verticals have less temperature graduations and also provide more display area per fridge/freezer which supermarkets can charge for [eye levels = more money]. Everything in a large supermarket chain is incredibly optimised for sale potential and also rebate extraction from the suppliers.
Re:Beyond stupid (Score:5, Insightful)
Re: (Score:2)
The control system are exposed to the open internet, but often coupled with simple passwords.
In the previous similar attack in France it was revealed that the freezing systems were protected by a trivial password.
An upgrade from 4G to 5G was scheduled for Wednesday, a measure that would have made the system more secure.
The irony is that the monitoring system existed precisely
Re: Beyond stupid (Score:2)
Maybe you just have a lot of dead bodies to hide and need centralised management.
Of note: (Score:2)
So uhh (Score:4, Insightful)
Re: (Score:2)
Because people are stupid.
Re: (Score:3)
Re: (Score:2)
We're talking here about a lot of freezers in many shops, all supplied and controlled by Danfoss.
Remotely controlling this without internet access is hardly possible.
I heard of a smaller outfit that set it's own alarm when the regular -22 degC temperature would go up above -18, although the alarm came after midnight they rushed to the store and saved their produce. Larger shops usually don't have their own control, they depend on the manufacturer
Re: So uhh (Score:2)
It could however be segregated to a VPN.
Re: (Score:1)
Why is the manufacturer and not the store in charge of monitoring and adjusting the temperature setpoints?
Re: (Score:2)
Because retail stores are cheap. They don't want to pay to hire someone competent to do it, much less pay them enough to maintain them in the position.
Re: (Score:2)
Pretty easy to understand why they are internet connected. We're talking here about a lot of freezers in many shops, all supplied and controlled by Danfoss. Remotely controlling this without internet access is hardly possible.
Thank you for offering your security expertise, which absolutely explains why these endpoints needed to be accessible to the public internet [claroty.com]. Like you said, it's "hardly possible" to just restrict connectivity from Danfoss's network only.
Re: (Score:2)
As we've seen several shops were affected so it looks like the hackers got access via the Danfoss site.
Maybe an air gapped system would help.
Re: (Score:1)
Exactly... a freezer should be a set-it-and-forget thing that never needs tending to (the temp, anyway) unless it breaks down, and then it just starts blinking a strobe light on the top of it.
Maybe some kind of notification system (send you an email or an automated call) so that when it breaks down overnight, it'll let you know... that'd be okay, but why would you need the ability to change temps remotely?
Re: (Score:2)
It's so the company can more easily push a firmware update that fixes the malware, obviously!
But seriously, it's so the refrigerators can be sold before the firmware is completely debugged.
Re: (Score:3)
Fool me once, shame on you. Fool me twice, shame on me.
Re: (Score:2)
Because centralized management is cheaper by guideline
(Pun intended) (Score:2)
Re: (Score:2)
Would you believe, so they can be used as an energy storage system [leadingedgeenergy.com.au]?
It's actually a pretty good idea, but only if you can keep the command-and-control system secure.
Re: (Score:2)
Service, maintenance and monitoring.
The Negative-Engagement Economy (Score:4, Interesting)
It cost a lot of money to create this problem. And solving it will cost a lot more money. And all of that, will somehow generate revenue and a massive tax credit.
The freezers were a bad product that every everyone said was a bad product at the time of it's adoption. The hack was an obvious outcome that everyone predicted tat the time of it's adoption. Well, a system's function is what it does. Creating a massive problem, while reducing Americans' access to the food.
False scarcity, self-dealing, embezzlement, loss-harvesting, insurance, when all of these scams are combined they create an perverse Bizzaro economy where failures are the most profitable business model.
Dafuq Are You Talking about? (Score:3)
The freezers were a bad product that every everyone said was a bad product at the time of it's adoption.
I missed that part. Got any citations?
The hack was an obvious outcome that everyone predicted tat the time of it's adoption.
Plausible. But did they? Citations welcome.
Well, a system's function is what it does.
Yea. Is that supposed to be enlightenment or insightful? It isn't either, Captain Obvious.
Creating a massive problem, while reducing Americans' access to the food.
What? Is there an American dependency on European supermarkets that I'm unaware of? These hacks have had no impact on Americans at all. You're making less and less sense as you go.
False scarcity, self-dealing, embezzlement, loss-harvesting, insurance, when all of these scams are combined they create an perverse Bizzaro economy where failures are the most profitable business model.
I don't usually engage with schizophrenics. But when I do, it's usually to say; Dafuq?
Presently modded 4: Interesting. Slashdot is getting weirder than Portland.
Re: (Score:2)
Likely, it's the general sentiment of "I told you IoT fridges was stupid" that's getting modded up rather than "this specific model of large scale European commercial coolers with requirements for auditing, service, and alerting was called out as bad at the time".
For example even TV shows were making fun of consumer IoT fridges [youtube.com] a decade ago. Here's a news article about the practicality of an Silicon Valley-like attack from 2017. [northeastern.edu]
The rest of your point though... Dafuq, indeed.
This is just AI doing it's thing. (Score:5, Funny)
shame (Score:2)
So sad (Score:3)
Re: (Score:2)
Programmable logic controllers (Score:2)
The grocery chains have had weeks to shore up things up since the first incident. I guess the attackers found one(s) that didn't act in time?
Am I mistaken, or isn't this the same issue facing water treatment plants, electrical grids, and other critical systems?
If so, it seems like there's a long way to go in the way of robust access controls, timely vulnerability remediation, etc--basically defense-in-depth--when it comes to industrial controls.
Re: (Score:2)
The hardware running water/sewer systems, electrical grids, irrigation dams and the like are generally SCADA systems on their own air-gapped network. Generally they're required to be air-gapped by law if they're considered critical infrastructure. **HOWEVER** the organization that runs them is more frequently targeted through its back office systems, which can still be pretty disastrous . Imagine if your electrical utility's phone and/or email system is taken down and they have no way to dispatch service
Re: (Score:2)
What planet do you live on ? You don't rip out and replace a commercial control system used across hundreds of stores in a few weeks.
You wouldn't have to spend all night (Score:2)
Disconnecting freezers from the grid, if you would disconnect the freezers from the internet
Tell me again... (Score:3)
Plus 50 (Score:1)
Re: (Score:1)
Refrigeration systems have heaters on the evaporator coils to defrost them periodically. Telling the control system to turn on that heater and leave it on will easily accomplish that.
GOOD. Stupidity should hurt. (Score:3)
Only destructive attacks can coerce wise choices.
Fool me once.. (Score:2)
Fool me twice...
Free Food (Score:3)
Freezer attack at 11am.
Dumpster diving at 2pm.
Making Groceries Affordable Again.
Insansity (Score:1)
Commander Adama had the right idea... (Score:1)
"It's an integrated computer network, and I will not have it aboard this ship."
-Commander Adama, Battlestar Galactica