Someone on Twitter is saying that the username for the fridges was “admin” and that the password was the current date… Prime security in effect here, clearly /s
Well, this means the password is very often changed, so it is secure /s
Why the fuck does a refrigerator need to be on a network?
Controls have to be put somewhere, and networked interfaces mean fewer physical controls that may be difficult to access, tampered with or fail. Having a standard control protocol means interfaces can be changed and improved without modifying the hardware. They’re not a bad thing.
However, having networked controls exposed on anything other than private, air-gapped, wired-only LANs seems rather foolish, to me.
Speculation to your question, for monitoring and control.
For monitoring, log temperatures and send error message if it gets too high. Data could be used if any legal question come up about food spoilage.
For control, I’m guessing there’s times you want to shut it off or enable/disable defrost. Easier to do that at a computer than have controls that are either a pain inthe ass to get to, or too easy for some moron to mess with.
That being said, it should be on a local network and have no access to the internet. However a chain store would probably want the data sent to HQ, so the computer would need to be on the network.
Attacking a countries food supply and food reserves really seems like a act of war.
The term “hackers” really downplays the severity of these kinds of cyber attacks IMO. It makes it kind of sound like a teenager in a basement somewhere, as opposed to some foreign state cyber warfare group or something along those lines.
Also it’s madness that systems like these are connected directly to the internet without read-only permissions implemented. Controls should only be accessible locally on some kind of airgap or local seperate VLAN.
The disconnect between how systems “should” be and how they actually are is disappointingly enormous.
Retailers are surprisingly enough just like consumers and want things to “just work” without caring about security.
And so they get Internet-connected fridges, and it’s all fine, until the very moment it isn’t.
I hope this is a learning experience and they beef-up their systems.
I hope this is a learning experience and they beef-up their systems
I hope this is a learning experience and they realize that commercial refrigerators don’t need to have internet access.
And it’s not just retailers. I’ve seen this just about everywhere, especially in toxic workplaces.
Please stop with the acts of war or terrorism BS. The article also mentions “in-store pricing powered by electronic shelf labels” so lets not ignore this is about multi-billion companies trying to suck every penny out of our pocket. If these companies design and manufacture and buy stupid hardware that is susceptible to such hacking, they really deserve it. I mean they really do.
Second, this is a good thing. Systems will be hardened now. You think there would be any other fucking way they would upgrade their security unless something like this happens? Beatings will continue until security improves. This is why even chaotic hackers that cause damage and inconvenience are ultimately a positive force on our IT infrastructure. Think of it as an ecosystem and evolutionary pressure. Free marketplace of security models.
Agreed. It’s also a massive jump to call a grocery chain’s fridges a countries ‘food reserves’
Also it’s madness that systems like these are connected directly to the internet without read-only permissions implemented.
Water systems in the US are, too. And they have been hacked.
The main plot of Ghost in the Shell 3. sigh
Given the simplicity of this attack and complete disregard for security by the vendor, it is likely to just be a teenager in a basement somewhere
I’m sure the admins managing this infra did implement strict permissions… Separate vlans are safe until you find a vulnerability in the switch OS, or find a way to access the admins account.
This is exactly what happened to the US Army about a month ago.
Why the fuck are all of your fridges controllable from the Internet? We didn’t have to build such a stupid, stupid society.
Because this way the bill of materials, design work, and labor cost are all higher; and that way the company can earn more money!
Capitalism is so far detached from what capitalists pretend it’s like. Wealth distribution is so uneven in the U.S. that there’s extremely little incentive to lower costs, even if the business is worse off because of it.
I think Samsung had some sort of failed update that killed their refrigerators as well, makes you wonder.
See, this is the kind of hack (if that’s what it was) I can get behind. This is a military target of a nation that is currently at war. Fuck up their food supply all day every day.
But what is described in OP is just shitty.
Because shops don’t want to run hardware on site, so they outsource the hosting of management and monitoring to the cheapest contractor. Unsurprisingly they don’t spend on security.
Idiot design and engineering for the sake of cheep managers. Same reason they are taking all the air gaps out of critical infrastructure. Instead of having Internet connected monitoring separate from the controls like a normal person, they hook controllers to the Internet too, so they don’t have to pay a technician to come in.
For added stupidity, the department at my job which has monitors and controls online just caused a number of techs who only do monitor and control to retire by making them return to work in office.
But you can whittle down your labor costs to a single untrained guy monitoring by notifications in the closet they converted to the IT room.
Somebody learns the term “single point of failure” now…
I wonder how much money was saved by having someone manage the freezer section, or how much money was earned by not having an empty fridge.
The management quarterly meeting PowerPoint presentation says x3 more yachts for us.
Being “smart” and connected to the internet is about to devalue a lot of manufactured goods that have no business being either one of the those things.
One can only hope
The executives that allowed the system to be built this way belong in prison for the value of the destroyed food. An engineer almost certainly told them this system needed better design and security and was told no by some cheap ass trying to preserve their executive bonus.
Nothing will ever change until these monsters have personal consequences.
Morgan Freeman Narrating: It was in that moment, they realized the IoT was a very, very dangerous idea.
Remote monitoring 👍
Remote control 👎
David Attenborough butting in: “That’s when they should have realized it, but did not. A fatal mistake.”
Just wait until some cars get hacked to accelerate as fast as possible because we just had to have telemetry in them for surveillance and profit.
Search YouTube for “Michael Hastings Accident”.
I was going to say, done and done.
Hackers using AI can absolutely hack into a Tesla and make it do anything they want. I’m surprised they haven’t to the point where it’s major news.
2010s - We made everything smart, networked, and IOT!
2015-2025 - We need you to put your personal details into everything, everywhere, all the time!
2026-??? - We invented a machine that can hack everything on earth and steal all data for nefarious purposes.
What’s missing from this report is more detail on how exactly this attack went down. Did the attackers compromise supermarket networks and manipulate the fridges through lateral movement within the network; or were the fridges accessible from the open internet? If the latter is the case (and there’s a non-zero likelihood they were): why the fuck?
why the fuck
Because, despite us being in the Information Age, and computers surrounding us everywhere, only a very small portion of the population consider that learning how they work may be useful.
I’m sure if more people learned about how computers work, AI wouldn’t be a thing because they’d realize that computing-based tasks can already be automated without LLMs.
Tell that to my developer colleagues who are busy defining “skills” for the AI to do the mundane things our tools could already do. It may waste huge amounts of electricity, water and money, make us dependent on American megacorporations, cause their skills to atrophy, and be a gamble every time, but at least they don’t have to read the manual.
I assume because of the monitoring cloud-based IoT thing from Danfoss fridges were so comfortable to use. Ok, you don’t need it so often, but hey it’s a cool IoT feature.
They really put a “let everything rot” button in there?
Yes, they did. Keep the defrost button pressed.
It might not rot, they set it to 50°C, so some things might get sous vide 😅
I had a picture of the device since I was curious, but I spotted at Walmart, and some other stores, a Cellular/Wifi/BT gateway that was branded by some company providing facilities services. As far as I can tell, the device was intended to provide secure connectivity to some service provider. I found a similar device in the freezer section of another store.
I imagine that there is remote control/remote monitoring of all the freezers or other on-premise machinery (which, is a perfectly sound thing to do), but if the central provider doesn’t take security seriously, and stay on top of their systems operations, can easily be the target for any kind of attacks.
More practically, I suspect that everyone involved has insurance whose cost is much less than ongoing proactive security + maintenance of their systems, which is why these incidents don’t seem to instantly put these companies out of business.
Stuff like eWon routers are everywhere, they’re basically openvpn (thank you open source devs, of course we won’t contribute shit or share any of the money you made us) devices that connect to a bunch of central servers and allow you to tunnel to them. Compromise such a system and you’re spoiled for choice on what to hit.
Guess…
Having fridges connected to the internet and getting them Hijacked is stupidity, not a cyberattack.
Maybe they learned they need to air gap critical infrastructure, and leave the management to on-site humans who are paid well enough not to hold their inventory for ransom.
“Learn” hahahahaha
Did having centralized control and monitoring of coolers save a fake number of man-hours on a spreadsheet instead of paying a store employee already on the clock to check temperatures occasionally?
They’re going to keep doing it because the spreadsheet says the risk is worth saving those fictional man-hour costs.
They will calculate that they spend less on recovering from these cyberattacks than they would on paying staff fairly, and carry on.
It decisions with skilled professionals not budget skimming project managers.
The nice lady who sold me my home left a fancy washer and dryer set and it can connect to my internet but my fucking question remains why lol. Fridge is normal thankfully.
Because it is really nice knowing when the wash is done from across the house.
Okay Mr. Moneybags, with a house so big you can’t just hear the ding from the other end.
(I’m just kidding; even in my small house it’s possible to miss it when the laundry closet door is closed.)
Because Samsung likes knowing when the wash is done from across the world.
If the company has ever made a TV or Cell Phone I’ll never buy their appliance.
Fuck Samsung.
Timer on my phone also does that!
not if your washing machine is anything above basic, in which case the time estimate at start is not reliable because it changes depending on conditions
It doesn’t change that drastically in my experience, generally with full loads and a small selection of programs we regularly use. The dryer OTOH can often be done much sooner and the displayed time is more of an upper limit.
A simple timer still gets the job done when we’re chaining laundry, don’t need to maximize uptime by the minute. My devices are fine offline.
This guy gets it.
BTW I don’t have a smart washing machine but I do have home automation through Home Assistant and I’ve added an automation that tells me when the washing machine has finished, how long it took and how much energy it used. It’s very useful to me, also because it sets a periodic reminder to unload the washing machine. Just by using a zigbee smart outlet.
Same. Seriously.
Except my plug is Matter over Thread.
I used to have the same for the dishwasher, but then I got one that opens its door automatically at the end of the cycle, so human intervention was less necessary. And I’ve got a timer that shuts off power to my “smart” tv after 30 minutes of inactivity because fuck letting it use 25W continuously.
Oh, we know, because the thing shrieks until we open it. I can hear my neighbor’s washing machine beeping, they’re so loud here.
To add to it, I like to know water and electricity usage stats from my dishwasher, it’s semi interesting. But generally I use the buttons on the thing.
Washing machine is easier to use via the app because it’s stupid in on device controls
So you are telling me it is enshittified to the point it’s unusable without the app that collects and sells all you data?
Same with my dishwasher; buttons on it will work it but you need the app for more advanced features.
Well tbh give me a machine I can punch in the time it runs the water temp and the rpm and I am mostly fine. I mean there are some curves that could be nice in very specific use cases but eh
Yup, very happy with my purchase…
/s (in case it’s not obvious 😔)
Oh boy do I feel hate right now
The reason they want to get people comfortable using the app is so they can move all control to an app to save money, which will be a worse UX. I’m so sick of using my phone or some ipad screen to do everything. Most appliances just need a few buttons.
I’d like to know water and electricity usage too, but frankly, I’d rather have a separate smart flow meter and current sensor.