French Blood Banks Hit Alongside Cyberattack On European Supermarkets (yahoo.com) 78
An anonymous reader quotes a report from Reuters: The refrigerators at three regional blood banks in France were hit by a cyberattack overnight between Sunday and Monday, at the same time hackers struck supermarkets from Sweden to Belgium. "Several regional facilities of the French Blood Establishment (EFS) were affected by a cybersecurity incident that impacted certain cold storage room monitoring and control systems," the health ministry said in a statement.
The incident had no impact on blood supplies, EFS spokesperson Charley Dubois said. "We have staff round the clock since blood can be needed at any time. They were warned about the problems by alerts and moved the blood to other refrigerators that were not connected," she said. [...] Investigations are under way into how the attack was carried out, what equipment may have been affected and when systems can safely return to service. The attack followed a similar incident in France last month when police said hackers seized control of cooling units at hundreds of supermarkets, causing fires and food losses.
The incident had no impact on blood supplies, EFS spokesperson Charley Dubois said. "We have staff round the clock since blood can be needed at any time. They were warned about the problems by alerts and moved the blood to other refrigerators that were not connected," she said. [...] Investigations are under way into how the attack was carried out, what equipment may have been affected and when systems can safely return to service. The attack followed a similar incident in France last month when police said hackers seized control of cooling units at hundreds of supermarkets, causing fires and food losses.
Question is (Score:3)
Re:Question is (Score:4, Informative)
You say that like they had a Samsung smartfridge. They have industrial systems, the kind of thing that talks over network, is managed by an IT department and is behind firewall. Still risky, but a bit less stupid. The press cited the brand "Cool World" as the one under attack. They make freezer rooms and containers https://www.coolworld-rentals.... [coolworld-rentals.com]
Re: Question is (Score:5, Insightful)
A fridge doesnt need to be managed by an IT dept. It keeps to a fixed temperature and if it deviates by X amount a very loud alarm goes off which someone on duty will hear. Job done.
Re: (Score:3)
It's easy to say that right now but those industrial refrigerated containers were installed a decade or two ago when it was fancy to have everything managed centrally, and every industry and hospital was doing that, and the bigger security risk was thought to be worms brought on pen drives.
Re: Question is (Score:2, Insightful)
At the time that was a bigger risk, but it was also a good reason not to do this crap
Unidirectional ports, no RX lines (Score:5, Informative)
At the time that was a bigger risk, but it was also a good reason not to do this crap
These industrial fridges do things like broadcasting status for logging and notification generation. A friend works on similar stuff in a different industry. They have, for decades, used unidirectional serial adapters. An adapter WITHOUT the RX lines connected to anything. An onsite technician can connect directly to the diagnostic port. Internet logging connects only using the unidirectional adapter.
Re: (Score:2)
That's great, but these fridges being attacked obviously also "feature" remote control, so they have bidirectional communications.
I actually get the appeal of having remote control features, but it simply shouldn't be possible to do the parts which have caused these problems remotely without on-site approval. For example they could use a limited interface (probably serial again) with a time switch on the RX line such that a person on site has to turn a key to enable access for a limited time.
There are also
Re: (Score:2)
The move back offline (Score:3)
I think I'm the longer term people will be shifting things back offline... and that is the correct thing.
I was flabbergasted by the thought of garbage door openers connected to wifi. Bluetooth maybe, but wifi?
Those people with Smart homes have fun times ahead.
Re: (Score:2)
Re: (Score:3, Insightful)
A fridge doesnt need to be managed by an IT dept. It keeps to a fixed temperature and if it deviates by X amount a very loud alarm goes off which someone on duty will hear. Job done.
On duty?
Exactly how many grocery stores in your area, are manned by human personnel 24/7/365? Pretty sparse? Doubt the little stores can afford it. Soo, how loud do you want that not-an-internet alarm to be for every fridge holding products meant for human consumption? Like, one person on duty per 5 city blocks? Figure 140db will do the ear-piercing trick?
Still think you can't get food poisoning when "job done" happens to be days later when reality wakes up Monday to realize fridge power went out somet
Re: Question is (Score:3)
Your argument is invalid as the reason to be connected was for someone to be alerted and done something way before the food / blood went bad. Done something, manual override, disconnect from system, something.. not look post mortem and been like, yup something made a change.
Re: (Score:2)
"ut who cares because fridge is at X temp now. Reset the alarm and forget about it."
A power trip alert light along with a max temp reading could be done electromechanically with 1940s tech FFS.
Re: Question is (Score:2)
"Exactly how many grocery stores in your area, are manned by human personnel 24/7/365? Pretty sparse?"
Many of them. Some of them are even open 24 hours. I used to do security in a Safeway like that.
Re: (Score:2)
A fridge doesnt need to be managed by an IT dept. It keeps to a fixed temperature and if it deviates by X amount a very loud alarm goes off which someone on duty will hear. Job done.
I can see you understand in great detail how to manage one fridge and run that to failure. That's not at all how you run 1000s of fridges and maintain them based on conditional parameters necessitating realtime reporting.
Hint: if the alarm goes off, you've already fucked up.
Re: (Score:2)
You make sure the alarm goes off BEFORE the temperature goes out of safe range you muppet.
Re: (Score:2)
a very loud alarm goes off which someone on duty will hear. Job done.
That kind [theguardian.com] of someone on duty ? :)
Re: (Score:2)
I can speak from experience that audible Alarms on medical fridges are of limited use. They can be in rooms where someone rarely visits. You need a secondary reporting mechanism. For example a fridge can contain expressed milk for neo natal babies from their mother. Losing that can cause extreme distress to the mothers involved and is not ideal for the baby.
Re: (Score:2)
For medical products they need alarms for both minimum and maximum temperatures, and they need a record showing that they never exceeded the limits. So some logging at a minimum, which has to be available on demand and the data stored long term.
It's possible to do entirely offline, but it's extra work and an extra point of failure because if the person in charge of it goes sick and their temporary replacement doesn't cover it, resulting in a gap in the data, a lot of material has to be discarded. Not just b
Re: (Score:1)
The temp logging part and a notification (email, text, automated phone call) when the temp goes 5-10F above the minimum is okay, but having remote access to the temp control board isn't.
And, if you're going to enable the remote access part, have the only login possibility through the store (like, login to ADP, and that'll give you access to temp management) or medical program (like MyChart for medical).
I do agree, I'll add that the interface shouldn't just be a totally public-facing website.
Re: (Score:2)
They probably also did not expect to get hit. Competent attackers hit targets that make sense. This seems to be cretins with LLMs.
Re:Question is (Score:5, Informative)
This wasn't even really a hack. Well, I wouldn't call it one. It was "someone left the keys in the door and someone else turned them".
Apparently from what I can gather, the issue was that the controllers in the refrigerators have a web interface. They don't connect to a cloud, you connect to them directly... and this is where we find the keys in the front door.
The installers don't know how to ask for IT support and don't know how to get internet connectivity sorted out. They had a much better idea... install a 4G router and open the port for the controller on a public IP address. And this is important too, because more or less every LTE/5G provider on earth uses CG-NAT and IPv6. You'd have to pay extra to get a public IPv4 address but compared to the cost of a managed refrigerator, this was a trivial cost. The installers did this specifically because to give the customer access to the web interface, they would need a public IP or an open port.
So, you have a basic controller running a computer approximately in the same category of an Arduino.. maybe a Raspberry Pi Pico... running software written by people who were focused on the operation of the refrigerator rather than IT security. And there are no software updates... if the fridge works... it works.
Next issue, these ARE NOT IT PEOPLE and the people making the controllers ARE NOT IT SEC PEOPLE. There were default passwords. Things like admin/admin.
There were no firewalls. And Samsung is much more secure because it connects out to cloud which is centrally secured (or compromised).
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Not Connected (Score:5, Insightful)
Why not all of them?
You know that you could install an Internet-connected monitoring system. Without putting the control function on line. And include a premises, non-Internet alarm bell, should someone hack the monitor.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
How about an unconnected mechanical thermostat?
Re: (Score:2)
You can't charge a subscription fee for that.
Re: (Score:2)
Getting alerts when something goes wrong is kind of important. Mission critical equipment like what a blood bank would have often gets contracts with Service Level Agreements where a tech gets alerted to come fix it before the product goes bad.
Obviously, how they set this stuff up was down right bad. But there can be sane business continuity reasons for electronic monitoring...
Re: (Score:2)
Found the guy who hasn't heard of one-way network links or serial connections.
Perhaps Slashdot is not for you.
Re: Not Connected (Score:2)
Perhaps you could not be a coward.
Hahahhahahah no wait, I take that back
Re: (Score:2)
You know that you could install an Internet-connected monitoring system.
The press says that that refrigerated container had a maintenance contract with a company that used remote maintenance. A few years ago this was a selling point.
Hospitals now want medical equipment that prints a small paper ticket that later someone can digitize, rather than full integration within an intranet, but this is a very recent move.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Yeah, technology is always 2 steps forward (what a great idea!) and then one step backwards (let's see how we can fuck it up)
This sort of thing... (Score:5, Funny)
Let me tell you what I mean (Score:2)
makes my blood boil.
Well, I should say.
Now friend, let me tell you what I mean...
Missing the 90's yet? (Score:2)
Missing the 90's yet? No interconnected cars, no interconnected fridges/freezers, no interconnected anything, as far as appliances go.
Sometimes progress for the sake of progress is derp, and interconnected cooling units is an example of "Jumped the Shark"
Google the phrase if you're too young to know what it means and how it came about.
Re: (Score:3)
In the 90s they'd just be wardialing for remote freezer controls. People still did the same stupid shit, but the blast zone was much smaller at least.
just change to offline ones and let the Cleaner fu (Score:2)
just change to offline ones and let the Cleaner fuck them up.
https://news.slashdot.org/stor... [slashdot.org]
dont attack Healthcare (Score:1)
Maybe you dont always know who you are attacking when you take advantage of vulnerabilities in connected things. But it is very shitty to attack Heathcare.
Re:dont attack Healthcare (Score:5, Interesting)
it is very shitty to attack Heathcare.
As reminded in the summary, on October 12, a simultaneous, large-scale attack targetting national grocery chains (Intermarché, E.Leclerc, Super U) and wasted hundreds of tons of frozen food over France. At the time, a vulnerability in the temperature controller Danfoss AK-SM 800A was used. It was first reported last June by Claroty Team82 https://claroty.com/team82/res... [claroty.com]
With several grocery chains and now healtchare, without even ransom asked for, it makes think that France has pissed off a State actor.
Re: (Score:1)
With several grocery chains and now healtchare, without even ransom asked for, it makes think that France has pissed off a State actor.
..until we find out that "state" actor is named Trolly McTrollface, President and CEO of Trolling Trolls, Inc. A subsidiary of FOMO Industries.
"Sic semper tyrannis..? Please. We silly bitches be doin' it for the 'gram, bro. YOLO-gang 4 lyfe."
Re:dont attack Healthcare (Score:5, Interesting)
Re: (Score:1)
Technically, the blood bank is supposed to be protected from attacks under the Geneva Convention, but... try enforcing it to a nameless, faceless group.
It's entirely possible France's leadership pissed someone off in whatever way, and this is retaliation. Who knows.
Again, the temp controller shouldn't be seeing the 'Net... the temp logging page can be accessed, but that doesn't need to be remotely accessible. A freezer or fridge should be set to a temp and stay there.
Re:dont attack Healthcare (Score:4, Informative)
Russia deliberately targets civilians [cbsnews.com]. Why would they care if they hit something healthcare related?
Re: (Score:2)
Seems every time we do something on a computer we soon figure out why the meat space version of that thing is regulated. Even war has conventions.
https://www.eda.admin.ch/en/ge... [admin.ch]
You can figure out on your own why you shouldn't indiscriminately harm civilians. Are you a psychopath?
Re: (Score:2)
You can figure out on your own why you shouldn't indiscriminately harm civilians.
You can if you're not a psychopath.
Are you a psychopath?
They weren't condoning it. Putin is the psychopath.
Re: (Score:3, Interesting)
As for the European supermarkets, two pro-Russian hacker groups could be behind it. One of the groups even claims responsibility, while pointing to the other group as an accomplice. However, an expert suggests that it could be the work of a single individual or perhaps the Russian security service seeking to maintain a bit of distance, and therefore steering suspici
Re: (Score:2)
The damage is not significant enough to be a politically motivated attack. To me this sounds like pure vandalism, probably with LLM support.
Re: (Score:2)
And the hack didn't require any AI, since it was just a simple password, one that was easy to guess over a visible 4G network. Today most freezer use secure private 5G networks.
Re: (Score:2)
The stores? Probably. But the stores are not France and rational, competent attackers understand that.
Re: (Score:2)
There are eve reports that freezers have been knocked out in the United States.
The European Commission (EC) is going to launch an investigation into the freezer attacks.
Re: (Score:2)
Re: (Score:2)
Well, insofar as random vandalism can be "politically motivated" (the ones behind this are probably too dumb to actually understand politics...).
Re: (Score:3)
The damage is not significant enough to be a politically motivated attack. To me this sounds like pure vandalism, probably with LLM support.
I should have stated that this kind of thing is standard operations for Russia, but I assumed everyone knew that, since There have been so many strange incidents originating from Russia. As of October 1, Russia is suspected of having carried out 315 hybrid attacks against EU countries between 2022 and 2026.
A few years ago, when I went to the cinema, a staff member informed me that they couldn't sell tickets due to a Russian attack had shut down or damaged their IT systems.
Russia has long been accused of
Re: (Score:2)
As far as I know there was no ransom note, no nothing and the attacks do not make sense at all. This seems to be some assholes with LLMs doing damage to push their egos.
Re: (Score:2)
We all get sick sometimes. We all die. They'll learn the hard way to be careful what they wish for.
Re: (Score:2)
Yes. But the chaos-worshippers need to be kept under control or everything goes to hell.
Surprising (Score:3)
It turns out that I drastically underestimated the power of human inertia. Hospitals, blood banks, water systems and the food cold chain are all getting hacked nowadays, and everyone is like "ehhhh replacing hardware lowers my profit margin or raises my taxes by 0.01%, and I really dont feel like logging in and resetting my password to anything other than qwerty".
Humans.
Re: Surprising (Score:2)
Insurance is the problem, or at least part of it. They should not pay out when security is inadequate.
Re: (Score:1)
I do agree, drinkypoo. If your house/apartment is insured, and you leave the door propped wide open, and then find the place cleaned out... that's clearly your fault.
While being able to check the temps on the supermarket's freezers or the temperature critical fridges at the bloodbank would be handy (periodically check them and such), but it should be impossible to get into it from the outside to crank up temps... that kind of thing should require boots on the ground.
Re: (Score:2)
The reason society has not fixed any of the problem is that there is a layer of obfuscation between the people and criminals. That layer is built into every credit card fee, banking lack of interest rate, and retail price. Society appears willing to pay the cost of criminals continuing to interfere with the general goings on of society. Until that changes through an actual catastrophe nothing will change.
Re: (Score:2)
Humans.
No. Incompetent management and the desire to maintain status quo with the least amount of effort. In other words, laziness.
Pharmaceutical plants?? (Score:5, Interesting)
One would like to think those systems are ultra hardened... but they weren't before.... and now they are low hanging fruit
Re: (Score:1)
The best way to get to an adversary is through its stomach (and medical industry, also).
They can have semi trailers full of ammo of all kinds... cut off their food, and you can bring them to their knees.
(and, ultra-hardening a system isn't that easy if you still need access)
Re: (Score:2)
"It's a small leap from this to pharmaceutical plants - much smaller than you think!"
Big Pharma plants do NOT have their equipment INTERNET facing. I doubt they will do anything to fix anything that might cost anything, but just requiring physical access is a step up.
Investigating? (Score:2, Insightful)
" Investigations are under way into how the attack was carried out, "
Remotely, obviously. Get your fucking systems off the internet and quit being lazy cheap-ass humans.
Critical infrastructure (Score:2)
You gonna laugh but the EU has a whole monstrous heap of newer regulations for anything considered critical infrastructure, and you would think stupid default passwords would get caught that way and that blood banks are considered critical.
Re: (Score:3)
why? (Score:2)
This was a blood bank. It's mission is to help save lives. This is not the same as milk going bad in a supermarket fridge!