Fridges in French supermarkets hit by cyber attack

Johnatan56 said:
This was flagged back in August, this has a break-down of the exploit:
claroty.com

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers

Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them in a new firmware version. Successful...
claroty.com claroty.com

Still a bit crazy that this was directly on the internet as well, this should at least have been on an internal one. Doesn't matter that the device can't be patched, should have been taken off of the internet, this is going to be interesting to see if insurance pays out.

Just to add: hard coded in terms of the mathematical formula for the password was hard coded "code-of-the-day", in the article I linked (system serial + current day => same algorithm => master password, and serial number was easy to get).

The issue is that the older models it was a firmware patch, so had to be done manually for each one, and flashing the firmware lost all profiles/settings, so recalibrate etc., all of it, not being able to use any of the fridges anymore.

Still unsure why other guards weren't put in place so they can't connect to the internet etc. if known.
Click to expand...

I got a chance to read the full article. These 'white hat' hackers are extremely thorough at indentifying all of the vulnerabilities in a system. It's a pity this only happens after they are deployed at scale in a live environment.

The whole point of the expensive controllers was to connect to the Internet for monitoring. IMO it was a security failure, not a design oversight.

The loss of stored food was expensive, but the unavailability of those fridges until they are upgraded may be even more costly.
 
forcing some to warm to 50C (120F) overnight.
Click to expand...

How does a refrigerator, suddenly CREATE heat?? It is designed to chill, not warm. There's no heating element in a fridge.

They just turned them off and the ambient heat, cause the damage.
 
Oh by the way:

Albert Hein, the largest supermarket chain here, also suddenly had IT issues yesterday. Their online presence and app is non-functioning. Other payment issues as well and online purchases and orders are not working.

Part of the same attack perhaps?

Screenshot_2026-10-13-08-47-21-16_154216f242561b88c07e749ee250074e.jpg
 
TheMightyQuin said:
How does a refrigerator, suddenly CREATE heat?? It is designed to chill, not warm. There's no heating element in a fridge.

They just turned them off and the ambient heat, cause the damage.
Click to expand...

Y'all need some education in commercial refrigeration:
1. Refrigeration includes fridges and freezers.
2. Freezers that are open to humid air develop frost on the cooling coils.
3. The frost has to be melted 2-4 times per day, otherwise it blocks the system.
4. Melting of frost is done with a timer (30 mins every 6 hours), and electric heating coils.
5. The thermostat can be set to override the timer, or prolong the cycle if necessary.

Usually this happens at night, so that customers are unaware of the process. Years ago in was in our local supermarket, and all the freezers stopped. I mentioned this to the manager, and he said it's normal, which it was.
 
Gordon_R said:
I got a chance to read the full article. These 'white hat' hackers are extremely thorough at indentifying all of the vulnerabilities in a system. It's a pity this only happens after they are deployed at scale in a live environment.
Click to expand...
It should be both, every company I've worked at we hired pen testers and swapped between companies over time, but I generally only work with companies where they own/use the product themselves.

You'd need to have supermarket in wild be okay with pen testing it for some of these issues, but agreed that the company didn't do due diligence here. It's probably because fridge manufacturer with IT bolted on later.

It is good on the company though to quickly react to them and get a patch out.
Gordon_R said:
The whole point of the expensive controllers was to connect to the Internet for monitoring. IMO it was a security failure, not a design oversight.
Click to expand...
Tbh, would consider it a design oversight regarding firmware updates. For these kinds of devices, should have maintenance port that can handle copying current settings and reapplying after update that does not rely on Wi-Fi as it's too unstable, should be a quick / easy thing to patch without having to remove all the food / take out of operation.
Gordon_R said:
The loss of stored food was expensive, but the unavailability of those fridges until they are upgraded may be even more costly.
Click to expand...
Doubtful, it's probably more that supermarkets did a risk Calc and thought it fine to take the risk. The disclosure would have happened quite a bit after manufacturer created a patch and asked clients to update, must have been at least two months before hacked, that should be enough time to do like 5 fridges a day in a fleet of 200.
 
And the Palestine Rioters trying to take over..

Napoleon knew how to take care of rioteers.

1791876832273.png
 
Johnatan56 said:
It should be both, every company I've worked at we hired pen testers and swapped between companies over time, but I generally only work with companies where they own/use the product themselves.

You'd need to have supermarket in wild be okay with pen testing it for some of these issues, but agreed that the company didn't do due diligence here. It's probably because fridge manufacturer with IT bolted on later.

It is good on the company though to quickly react to them and get a patch out.

Tbh, would consider it a design oversight regarding firmware updates. For these kinds of devices, should have maintenance port that can handle copying current settings and reapplying after update that does not rely on Wi-Fi as it's too unstable, should be a quick / easy thing to patch without having to remove all the food / take out of operation.

Doubtful, it's probably more that supermarkets did a risk Calc and thought it fine to take the risk. The disclosure would have happened quite a bit after manufacturer created a patch and asked clients to update, must have been at least two months before hacked, that should be enough time to do like 5 fridges a day in a fleet of 200.
Click to expand...

Sounds a bit like modern cars. Too many bolt on features that provide convenience/efficiency/etc, but potentially break the system and require expensive recalls to thousands of units in the wild. Systems often stay in use far longer than the original designer could possibly have visualised, with unforeseen consequences.
 
South Africa is also vulnerable.
1791970286246.png

But I am sure that our Cyber Hub is on it.
1791970329237.png
 
More freezers hacked in several countries:
www.bbc.com

Shop freezers in seven European countries hit by cyber-attack

The temperature of freezers in several shops across Europe reportedly rose to as high as 50C.
www.bbc.com www.bbc.com
Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, while a smaller number of shops were hit in Sweden, Ireland, the Netherlands, Estonia and Finland.

Sabcobel, a Belgian company that manufactures some of the affected refrigerators, said the units' evaporators were switched to defrost mode, causing them to warm up, in what is believed to be the same method used in last month's incident that hit hundreds of French supermarkets.
Click to expand...

It's not an easy fix:
Stephan Moelans, the CEO of Sabcobel, which operates Delhaize's systems, on Monday told the Belga news agency that the incident was a cyber-attack and that the company had been "working all night and morning to disconnect the affected units from the network".

He said since the French attack in early October, the company had been working to "protect our customers fridges against this vulnerability" but that the units needed physical modifications, not just software updates.
Click to expand...
 
Gordon_R said:
Y'all need some education in commercial refrigeration:
1. Refrigeration includes fridges and freezers.
2. Freezers that are open to humid air develop frost on the cooling coils.
3. The frost has to be melted 2-4 times per day, otherwise it blocks the system.
4. Melting of frost is done with a timer (30 mins every 6 hours), and electric heating coils.
5. The thermostat can be set to override the timer, or prolong the cycle if necessary.

Usually this happens at night, so that customers are unaware of the process. Years ago in was in our local supermarket, and all the freezers stopped. I mentioned this to the manager, and he said it's normal, which it was.
Click to expand...
HVACR Videos on YouTube taught me a lot yes.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X