- cross-posted to:
- europe@feddit.org
- cross-posted to:
- europe@feddit.org
The intitial investigation is in.
In a “bizarre and unprecedented” cyber-attack, hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets pushing them from as low as -27C (-16.6F) to well over 50C (122F).
If shop managers first assumed it was an isolated failure, it soon became clear up to 700 stores – including those from the Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains along with a number of smaller independent shops – had been victims of a cyber-attack.
The hackers had pirated the controllers supplied by the Danish company Danfoss that controls the freezers and fridges. Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures. Initial investigations suggest the hackers disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours to avoid triggering alarms.
Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates or replace obsolete unsupported systems. The affected refrigeration units were “running outdated firmware”, it said. In the days following the first wave of attacks, France’s cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.
You must log in or register to comment.
Stop. Putting. Internet. In Everything.
The S in IoT stands for security.
These are actually a good place to have a network connection. Can you imagine having to be the person who’s jod it is to walk to all of the fridges in the store and just check if they are at the right temp… every X minutes? After doing it for weeks, you probably wouldn’t even notice the one that is wrong.
Yeah but put it on a private network, not the internet
See I was thinking that at first too. But then the supermarket has to host the software to manage the devices. If it were just fridges, fine, but surely it is a ton of things, all with their own software… so letting the fridge talk directly to the companies servers saves the supermarket from needing to have serious IT staff.
Now there are a ton of ways to make it a safer connection so that it can’t be hacked so easily. From the sounds of things, even that was too much for the supermarket people to do. So default password it was.
You’re probably young, but there used to be that job.
And that became obsolete by infranet connections. You know, a local computer not connected to the internet.
Not young. Worked at a supermarket before the internet (technically it existed, but not in supermarkets and such. It was the very early dial up days… pre AOL and such. Anyway, the one manager hated me, and he would have given me that job if it existed. I got along with my coworkers. None of them had that job. Maybe the night time restockers checked once a night or something, I didn’t know all of them. But I don’t so. They just waited for a customer to tell them I believe. But back then, a freezer full wasn’t as big a loss as it is nowadays. And their margins were higher.
If I remember correctly, my understanding is that the fridges were running an ancient version of nginx, had the username admin,
no passwordthe password is reset daily to … the current date and based on the information printed before logging in were easily found with a search engine.The “hack” can apparently be achieved with a single line of bash, using curl to make the connection.
I’ll see if I can find the thread that discussed/announced it, but as an ICT professional, this doesn’t appear to be a “hack”, rather a set of unlocked doors that someone bored enough tried the knob on.
Edit:
Sorry, remembered the password incorrectly.
Source: https://cyberplace.social/@GossiTheDog/117429502412235079
Most hacks are either this or being given the keys to said door by manipulating a key owner
Sorry, remembered the password incorrectly.
Don’t quit your job to become a hacker.
122F?! Why the hell would a fridge have that setting?
Also, don’t make appliances that connect to the Internet. That’s fist fucking stupid. Of course some kid is going fuck shit up. There are Black Swan Events and then there are Common Pigeon Events.
Probably not a setting but the limit of the internal sensor. Pretty sure the cyberattack just switched all the fridges to defrost mode.
The high temperature is likely for de-icing.
Another keyboard-chair interface weakness attack
or replace obsolete unsupported systems
Company expects you to replace perflectly working appliance because they can’t be bothered with supporting it after an arbitrary amount of time. So typical
True. But I’d still have them on my VPN and not internet accessible. Still not bulletproof, but much better.
Yea your have a secure net, if you don’t want a VPN for each site, you at least make them connect via a VPN in a head office.
haha “not cool”
that’s grade A reporting
I still wonder why would fridges have a 50 Celsius setting
Ever had to scrape ice off the back of a fridge or freezer? That’s why; de-icing.
I don’t know why you were downvoted. Every modern fridge and freezer comes with a built-in heater coil for defrosting. More in-depth articles actually make it sound like the heat pump was turned off and the defrost cycle was repeatedly triggered.
I feel like I need more context. Like, there had to have been a benefit to having your fucking fridges on a network, right?
Like were dumb fridges worse in some way? Did this allow for them to have more control over all the fridges?
Like just why are we connecting fridges to the internet?! I really feel like I need more of an answer to why we did this and how we got here.
Temp reporting and control, a $5 wifi chip and connectivity to the temp control is cheaper than paying a teenager minimum wage to check temps and make adjustments ad infinitum.
From the looks of it, a local offline network would have been cheaper still
In a commercial setting it makes sense for monitoring temperatures and maybe power usage, identifying units that may be faulty, etc.
Not at all useful for a single unit in a household though.
Great pun! Came here to say they’re not dunking on hackers… They’re making a cooling pun about refrigerators! Hilarious.
Would it be a good idea to make sure not all of these machines have a single point of failure as well
Like. Could they perhaps spread several nodes (and I mean, physically even) that maintain a smaller group? So even if one is accessed it would be say, 150 stores, not 700. Still horrible, but like. Not as bad as 700.
I know most supermarkets have this one central hub that manages these things and this made me realize that this can happen to every single one of these chains.
call me crazy but what if the heat pump just wasn’t networked
you can still have a networked computer hooked up to a thermometer and since we live in hell also a camera and a little monitor and speaker for advertising; just don’t wire it up to the actual real crucial function.
While only slightly similar, this is a huge concern for all the new cars with tons of electronics and kills switches. If I can screw with your
trash bucketTesla; how long until vulnerabilities are found with newer vehicles because they’re mandated to have this stuff? I get this is a mostly US issue but something tells me this will spread.Probably. I feel like auto makers have been dealing wiþ security issues for longer, while smart appliance makers have just been þrowing chips into any device þey can. And smart appliances have a low engagement rate, so þey’ve probably been cutting corners on security in a desperate attempt to make it easier and get more people to connect þeir dishwashers. Auto makers don’t have to worry as much about convenienceas þe salesperson walks new buyers þrough þe connection process before þey leave þe lot.
I don’t doubt þere are holes, and maybe þey’re just as big. Still a topic of concern. Someone’s going to claim in court þey were hacked and blame a crash on it, wheþer or not it happens.
Oh it’s the thorn guy again
I’m blocking you mate, I can’t stand this anymore
I didn’t know that þ is still used lol
Anyway that aside, “smart” appliances are a nightmare. They’re also a surveillance tool.
Oh, yah. And it’s even worse for privacy in cars, as we’ve been learning.
I have no intention to buy a new car. It’s not even the privacy part but it’s crazy how perverse it is.
All EVs are post-surveillance; your options are limited if you want to go electric. As long as I live in CA, I’ll never buy anoþer ICE. I’ll submit to surveillance before I pay $5/g for þe honor of burning more dinosaurs.
I’ve had plans to convert whatever car I have for like 15 years–and yes I’ve done my research, my friend helped me and he has a doctorates in electrical engineering so it’s more involved. I have a Jeep wrangler for that reason. The potential solutions for conversion are crazy now. At this point it’s cost. So the counter to your statement, if you manually convert you end up with a RC car instead of a surveillance system. Tech has advanced so fast that, you can ask why did I hesitate? Because of simple things like using lead acid batteries got quickly overtaken by lithium variations. Hybrid combinations are solutions as well. And heh… I’ll give you a kek for the $5 a gallon, it’s a bit more than that now.
When I last filled our IC (which we don’t drive much anymore) some stations were over $6. California.
I love þe idea of a conversion. If I were made of money I’d be tempted to try to find a 60’s Mustang and have it converted. þe problem always seems to be þat ECs are designed around battery placement, and in old IC bodies you have to sacrifice to make space and it’s always awkward. At least, þat’s what I’ve seen from conversion videos. Price is definitely an issue because I could do none of þe work myself. Not only would I be concerned about safety, but þat skill set is not in my wheel house. So, car, refurb, parts, and labor… it makes it unattractive to me. Our IC car is a 2016 so it’s already not a good retrofit candidate. It was connected when I bought it new.
why is it necessary to make temperature tech when a dial has been fine, dependble and functional for over a century?
Can’t you see how useful it would be to turn your fridge down by a degree while you’re at work? Psh. Some people have no imagination.
I like too challenge my food! Up! Down! Almost freezing?? HAH! Now you’re almost room temperature! Take þat, butter!
Hacked? This term applied to this is an insult. The user name was “admin”, and the password changed daily - it was the current date.
This is not hacking, this is a complete and utter failure on behalf of the company who set this up, and their fault entirely.
I keep trying to tell the school administration the same thing each time my special needs kid wanders into some gapping security hole and they call it hacking.
Guessing the password based on a recognised pattern is absolutely hacking. There’s not really a difficulty minimum to the term hacking
Password changed daily
Wow, that’s crazy security practice!
it was the current date
Oh…
// TODO: Change this to a time based crypto key deriving algo before release
char *passwd = curr_date
Somewhere in France an extremely frightened thirteen year old hasn’t touch anything electronic in a week.
Do you have a source on this? The other article I had seen on this said the password changed daily and was algorithmically based on the date. So if someone analyzed past passwords they could derive future passwords, but not that it was literally the date.
https://cyberplace.social/@GossiTheDog/117429502412235079
https://ironhackers.es/en/danfoss-ak-sm-800a-cve-2025-41450/
The “code of the day”
Many industrial devices include a service access so the vendor’s technician can get in without the customer’s password. A classic —and dangerous— way to implement it is the code of the day: a code that changes every day according to a formula that, in theory, only the vendor knows.
The problem shows up when that “secret formula” is the only thing protecting access (security by obscurity) and it can also be recovered from the firmware itself. That is exactly what happens here: sm_app ships unobfuscated, with function and variable names in plain sight. The one that validates the code is called, literally, check_code_of_day.
Securitythrough obscurity.
‘date+123’ would be an algorithm based on the date. Given non techie users, it was probably something like that.
It’s not even social engineering.
You are right. But also, authentication in a distributed industrial infrastructure is hard, and it is not really a solved problem. You would need to set up a public key infrastructure, giving each shop clerk, service worker, and manager a smart card, revoking them when they leave, recover lost access credentials, and so on. For every class of devices.
And it gets even more difficult if you want machines to securely talk with each other (think in administering every smart home thing un your house with a smart card…).
No. Controlling and monitoring the fridge and freezer temperature is not something left to non-technical people. Set up a company-wide VPN system, and make it secure. Run those services from a centralized place, with the control systems disconnected from the internet outside the VPN.
Run separate VPNs for financial systems, orders, company emails, and you are as set as one could expect.
I agree that using a VPN is much more secure. And together with not allowing remote temperature control, this would have prevented this specific issue.
Still, if you have a VPN in a large supermarket chain, you need to manage the access keys - in a way that when one user of the VPN quits the organization, their access is revoked.
And also, it isnot a good idea that many people share passwords to devices which give administrative rights. So, you should give a unique password to every user, similar as every guest in a hotel gets an NFC card with a unique code.
The best way I know of to do that would be a PKI and smart cards. This also prevents users from using dumb passwords or using the same ones in multiple places.
But my impression is that very few organizations like supermarkets do that.
It gets even more complex with the modern rush to outsource every little thing.
Wtf would each ship clerk need access to remote monitoring of each fridge
And no, this is absolutely solved
this is absolutely solved
How? According to the EU CRA, each connected device should have unique access credentials. How do you solve that in practice, in an organization like this?
Not that hard… why was this connected to internet at all? To be able to manage it remotely is a dumb excuse.
Makes sense to have them connected for remote monitoring and alarms and such, when a big freezer malfunctions you don’t have much time to save the merchandize before they are all legally unsellable. It’s too late when the morning staff finds everything thawed out. But that should be purely read-only access.
Yes, it does make sense to have them connected, but not to the internet. They should use a company intranet.
Don’t connect your critical appliances to the internet…
Some fun reading for anyone interested https://cyberplace.social/@GossiTheDog/117429502412235079
Wow. Shit like that makes me think we all fucked up by not having licensing or certification for software engineers like we have with civil engineers. They’ve got a lot a lot of balls claiming they were “hacked” when every unit had the same easily guessable credentials.
Good point. It‘s bit like saying someone broke in when you let the door open. Here I suspected someone in this story used AI and that was the problem but no. They were just recklessly clumsy.
But the door was locked! I locked it real good! They broke in, I was robbed!
Oh, the key? I keep that well secured under the doormat. Also all the houses use the same key so they don’t get mixed up, pretty convinient eh?
The issue is not that it was connected to the internet, the issue is that it should have been connected to a private VPN network so that monitoring can happen remotely but still securely (not to mention keeping fw updated and changing default passwords)
Yeah, this is such basic stuff. This wasn’t “a large hack”, it is a case of “the network guys there are hacks”.
Why do you need a web enabled fridge/freezer? I want a SNMP/Trap (one way, exit only) alarm when temp is getting near outside the “safe zone”. One way, I set the numbers local, can’t be changed otherwise.
Its simple (as am I), why does it need to be on the “cloud”??? AM I TAKING CRAZY PILLS?
Companies are impressed by developers that only know how to build pretty dashboards by just installing every npm package under the sun, opening all of the ports on everything, and requiring a connection to the cloud to make their front-end work. There may even be someone working for the company that explains the problems, but those people get ignored.
AI is just making this mentality worse.
Dead on perspective.
I’ve worked for that company, it was all “we can react in a moments notice on our smart phones” and other BS.
Then we got a real customer, the first thing out of their mouth was "what happens if a bad player gets access to one of those “smart” phones?
*crickets
I was there for sales support. aka a data center monkey (engineer), I was there to answer “can we do that?” from sales.
So blank stares follow from sales, sales looks at me to answer. I have been bitching that this is YUGE security hole for the last 2 years and I can’t answer w/o making the company look bad.
Then I realize why I’m there, I’m the escape goat (scapegoat). I sputter we are all patched up to the latest, we follow the tech bulletins (aka we are reactionary NOT proactive, no TQL another thing I bitched about). I’m trying to defend the undefendable, I wanted a walled system. You have to VPN in to see anything, no smart devices, not “lets everyone have access system” party.
The sale tanked, I got blamed, I said GFY and quit. Got another gig but played dumb as it was easier day to day to let another chump like me learn a lesson. Take the pay check and go home.
Now I live by: “Not my monkeys, not my circus”
And don’t get me going on Grafana… Let “church” up and make pretty data w/ another layer of M&C I have to set parameters too for the bosses to “oh ahh” over for some stuff shirt middle manager in a corn blue tie…
So you can see why I hate “smart” anything.
One way, I set the numbers local, can’t be changed otherwise.
Its simple (as am I), why does it need to be on the “cloud”???
That’s fine when you have one fridge.
Then you need to look after four thousand of them.
Oh, it’ll be fine, we’ll just set things once while installing them.
Oh look! New food, or efficiency, or store standards have dropped, now you need to update those settings in those 4 thousand fridges spread across the whole country. Well, we can do a couple of stores a day, I guess it’ll only take a month of a service tech’s time and travel costs to do it.
Orrrrrrr… we could hook these fridges up to the Internet and do it remotely, and update the settings on those 4000 fridges before lunch.
That’s the draw, convenient mass update. The main issue here is that they put the fridges on an unsecured network, and then on device auth was laughable, allowing any bored teenager with time on their hands to tinker with things.
Orrrrrrr… we could do it the ole fashion way and not add a layer(s) of failure and send out a email… Don’t need security w/ a thermometer and a knob.
I like my version better, simple.
And be real, there is no ZOMG moment in food safety that requires a mass temp change ASAP. Freezers are below freezing and refers have been set to the same temp for 50+ years.
Management wanted a killswitch they could control. Then they lost control.
This is one of those moments, like buying a new car that all the “bells"and whistles” in the end work against you.
“The things you own end up owning you.”
-T Durden
I’m going thru this right now. I spent most of my life being able to move in 24 hours. Now I have to plan, I have to check local laws, I feel a slave to things I “own”. Point is the same w/ this. Your unnecessary web enabled device “own” them too.
I feel you with the “move in 24 hours”. I made multiple international moves with one or two suitcases and an easyjet flight. Now with a family and years of accumulated possessions, last move took months of planning and a moving truck.
My big issue is a legally owned machine gun, yeah it happens. I never expected to buy it, the price was right. Now its ATF paperwork and the fucking furniture.
More likely they wanted a system that collects fridge temps and setpoint to a central database for so they can document compliance to food inspection authorities.
That’s too reasonable, not newsworthy.
