Fridges in French supermarkets hit by cyber attack

[Gordon_R]

This was flagged back in August, this has a break-down of the exploit:

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers

Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them in a new firmware version. Successful...

claroty.com

Still a bit crazy that this was directly on the internet as well, this should at least have been on an internal one. Doesn't matter that the device can't be patched, should have been taken off of the internet, this is going to be interesting to see if insurance pays out.

Just to add: hard coded in terms of the mathematical formula for the password was hard coded "code-of-the-day", in the article I linked (system serial + current day => same algorithm => master password, and serial number was easy to get).

The issue is that the older models it was a firmware patch, so had to be done manually for each one, and flashing the firmware lost all profiles/settings, so recalibrate etc., all of it, not being able to use any of the fridges anymore.

Still unsure why other guards weren't put in place so they can't connect to the internet etc. if known.

I got a chance to read the full article. These 'white hat' hackers are extremely thorough at indentifying all of the vulnerabilities in a system. It's a pity this only happens after they are deployed at scale in a live environment.

The whole point of the expensive controllers was to connect to the Internet for monitoring. IMO it was a security failure, not a design oversight.

The loss of stored food was expensive, but the unavailability of those fridges until they are upgraded may be even more costly.

 

[Rickster]

Oh, c'est pas vrai

 

[TheMightyQuin]

forcing some to warm to 50C (120F) overnight.

How does a refrigerator, suddenly CREATE heat?? It is designed to chill, not warm. There's no heating element in a fridge.

They just turned them off and the ambient heat, cause the damage.

 

[TheMightyQuin]

Oh by the way:

Albert Hein, the largest supermarket chain here, also suddenly had IT issues yesterday. Their online presence and app is non-functioning. Other payment issues as well and online purchases and orders are not working.

Part of the same attack perhaps?

 

[Jet-Fighter7700]

wait till they manage to Breach Checkers and our other local supermarkets and make all transactions R1 no matter what it is.

 

[Gordon_R]

How does a refrigerator, suddenly CREATE heat?? It is designed to chill, not warm. There's no heating element in a fridge.

They just turned them off and the ambient heat, cause the damage.

Y'all need some education in commercial refrigeration:
1. Refrigeration includes fridges and freezers.
2. Freezers that are open to humid air develop frost on the cooling coils.
3. The frost has to be melted 2-4 times per day, otherwise it blocks the system.
4. Melting of frost is done with a timer (30 mins every 6 hours), and electric heating coils.
5. The thermostat can be set to override the timer, or prolong the cycle if necessary.

Usually this happens at night, so that customers are unaware of the process. Years ago in was in our local supermarket, and all the freezers stopped. I mentioned this to the manager, and he said it's normal, which it was.

 

[TheMightyQuin]

Y'all need some education in commercial refrigeration:

TIL

Thanks.

 

[Gordon_R]

TIL

Thanks.

During the lockdown I got to watch some channels which I would not normally bother with. This example is a purely mechanical defrost timer, with all of its pros and cons:

 

[Johnatan56]

I got a chance to read the full article. These 'white hat' hackers are extremely thorough at indentifying all of the vulnerabilities in a system. It's a pity this only happens after they are deployed at scale in a live environment.

It should be both, every company I've worked at we hired pen testers and swapped between companies over time, but I generally only work with companies where they own/use the product themselves.

You'd need to have supermarket in wild be okay with pen testing it for some of these issues, but agreed that the company didn't do due diligence here. It's probably because fridge manufacturer with IT bolted on later.

It is good on the company though to quickly react to them and get a patch out.

The whole point of the expensive controllers was to connect to the Internet for monitoring. IMO it was a security failure, not a design oversight.

Tbh, would consider it a design oversight regarding firmware updates. For these kinds of devices, should have maintenance port that can handle copying current settings and reapplying after update that does not rely on Wi-Fi as it's too unstable, should be a quick / easy thing to patch without having to remove all the food / take out of operation.

The loss of stored food was expensive, but the unavailability of those fridges until they are upgraded may be even more costly.

Doubtful, it's probably more that supermarkets did a risk Calc and thought it fine to take the risk. The disclosure would have happened quite a bit after manufacturer created a patch and asked clients to update, must have been at least two months before hacked, that should be enough time to do like 5 fridges a day in a fleet of 200.

 

[Corelli]

And the Palestine Rioters trying to take over..

Napoleon knew how to take care of rioteers.

 

[Gordon_R]

It should be both, every company I've worked at we hired pen testers and swapped between companies over time, but I generally only work with companies where they own/use the product themselves.

You'd need to have supermarket in wild be okay with pen testing it for some of these issues, but agreed that the company didn't do due diligence here. It's probably because fridge manufacturer with IT bolted on later.

It is good on the company though to quickly react to them and get a patch out.

Tbh, would consider it a design oversight regarding firmware updates. For these kinds of devices, should have maintenance port that can handle copying current settings and reapplying after update that does not rely on Wi-Fi as it's too unstable, should be a quick / easy thing to patch without having to remove all the food / take out of operation.

Doubtful, it's probably more that supermarkets did a risk Calc and thought it fine to take the risk. The disclosure would have happened quite a bit after manufacturer created a patch and asked clients to update, must have been at least two months before hacked, that should be enough time to do like 5 fridges a day in a fleet of 200.

Sounds a bit like modern cars. Too many bolt on features that provide convenience/efficiency/etc, but potentially break the system and require expensive recalls to thousands of units in the wild. Systems often stay in use far longer than the original designer could possibly have visualised, with unforeseen consequences.

 

[Thorium]

South Africa is also vulnerable.


But I am sure that our Cyber Hub is on it.