I wonder if this is going to cause an increase in local networks for these kinds of things. If you have it on network not connected to the internet you solve like 99% of security issues.
They were connected by SCADA and managed locally by technicians. It was never meant to be exposed to the tsunami of the internet.
As always, Capitalism is the issue. The problem is that grocery stores don’t want to pay their employees enough to give them the job of routine temperature-checking. Nobody wants to do that tedious, boring shit for only $18/hr. So they outsource it to an outside company, that way they can pay one guy to monitor thousands of fridges across several stores, rather than give hundreds of employees a raise.
stupid thing is they will likely not work if disconnected from the internet.
Why the hell does a fridge need internet access in the first place anyway?
Like I’m watching youtube videos on my freezer or some shit.Usually for monitoring or control. I can see monitoring temps for example. Commercial refrigeration is no joke.
yeah but monitoring and controlling are two different things: you can have a monotoring system and e-mail / alarms going off in case of issues, and attackers can’t do shit but looking at temperature.
But when would you ever need to change the temperature remotely is my question.
They may run the temps lower during business hours to compensate for doors constantly being opened. That’s just one example. Remote control is fine, unsecured access is not not.
WE WANT JUSTICE NOT REVENGE!!! Justice
What “feds”? Those cases happened in Europe.
Ah, you see, it’s a meme. It may not be 100% accurate.
I can see reasons for why you would like to access them remotely. The bigger question in my mind is why are they connected to the internet so shittily?
When we place devices in customer networks we have the device open a VPN tunnel back to our concentrator node, and route our management traffic through it.
Then the customer firewall blocks anything
incomingas usual, and all we need is the rules to allowoutgoingVPN client traffic andestablishedrules for the responses from the server.I can see value in monitoring them remotely. I’m not sure I see much value in being able to change the temperature setting remotely. If you need to change the setting, there’s probably already something wrong…
Even odder… They didn’t change the temperature setting, they forced the defrosters to run at 100% power.
Who ever thought it was necessary to have the defroster remotely controllable? Who thought it was a good idea to have it run without any sort of limits?
There’s no good reason for temp control itself to be attached to the internet. The people who work on-site can handle that. There are always people on-site who stock the fridges and cleaning, etc., and the managers for those workers. These things aren’t sitting alone in a building with no human oversight for miles around. Monitoring and logging can be centralized while air-gapping the actual control of the temp.
I have no doubt that’s exactly what they’re working on right now.
yeah god forbid we pay someone to keep an eye on shit. to tweak settings and make sure all our food doesn’t melt.
The profit cults have a different demand from logic and reality. They do not condone to its existence.
The people who work on-site can handle that
That’s… not necessarily true. It’s entirely possible that nobody wants to touch the freezer’s temperature controls because “I might mess something up” or “I don’t know how to do that”. It’s not unusual for a smallish grocery store to have a single employee with a functioning brain and that person isn’t always at work. Hell, sometimes there’s two and one’s on vacation in another country and the other one has a day off and can’t be reached by phone. And I’m not saying this to single out grocery store workers as dumb or anything like that, the same holds for pretty much every profession: Most people just switch off their brains at work, they do the exact tasks they’re supposed to do every day, and if they need to do something new, that’s an impossibility without serious hand-holding. Seen it in grocery store employees as well as software engineers and doctors.
But it’s true that the remote control itself doesn’t have to be available online, only monitoring does, you can always just send a technician to push the button and change the temperature. But then wouldn’t it be nice if you didn’t have to send out a technician in the first place?
It’s not unusual for a smallish grocery store to have a single employee with a functioning brain and that person isn’t always at work.
this is why you build up competence and reward it with higher wages. every job being a dead end wage slave drone slot is one of the biggest problems in this country.
Worst comes to worst: print a few pages of instructions, laminate them and now you can get it done on-site
Anyone who lives in a house with a thermostat can get this done. I believe in us. Also, as mentioned by OP, we had decades of refrigeration with no option but to control it on site, and it seemed to work fine.
I asked this question before and I will ask again… What advantages do internet connected fridges have over non-internet connected? Automatically ordering groceries? That is bullshit. I will order what I want when I want it. And I have always gone to the supermarket to so that except a few times during quarantine.
Adjusting the temp based on what is in there? Firstly what is in my fridge is no one’s business. I do not want my eating habits (or what I buy and forget to eat) to be known by some fridge company.
I cannot think of a reason to have a smart fridge. But I want to know what the reasoning is? More importantly, why it even needs a net connection.
This is about commercial fridges for supermarkets etc., which also don’t need to be connected to the internet, but the way they’re sold is that they’ll collect data for analytics and save on labour by being centrally managed so I get why business idiots go for it
My case: smarthome integration. It can change the settings if we go on vacation or have a party. It can alert us if our kids leave the door open (has happened twice in a year). It can tell us the temperature inside (and trigger an alert if abnormal). That’s basically it.
Not everything is screens and cameras…
Is it really that hard to open a door and turn a knob before you leave?
Nope.
Opening 40 doors and turning 50 knobs, yes.
I think you might have too many fridges.
I also have ovens, and stoves, a freezers, and garages, and a, and heating, and warm water, and garbage, and garden irrigation, and…
I would advise against trying to cook from your home oven while on vacation. Also, regulating the temperature of your garbage seems a bit wasteful.
The oven has to be off, the garbage taken out and locked.
Hard no, but tinkering is fun. And being able to check from a distance without having to turn the car around or getting a friend to swing by your house for piece of mind is nice.
As long as you don’t use the default password on your multimillion dollar installation because you’re too cheap to pay for enough IT support, you’re probably fine.
Until you find out the vibe coded controller left a backdoor admin/admin login. Hard coded, of course.
I didn’t think I needed to say it, but the fridge is not reachable from the internet…
TBF: They call home when a unit needs maintenance; they can turn the temperatures up a little when the store is closed early or opens late. There’s likely some ecological upside.
That said, a complete ruin of all the frozen goods probably wipes out years of cost-saving and eco-savings.
The temp in a freezer should never need adjustment. In fact, once the installer sets it, it should never be touched again. The only thing that should have anything like internet access is an alarm with a thermometer so you know when it’s not working.
once the installer sets it, it should never be touched again
True before the invention of variable-speed compressors, predictive defrost, and grid spot pricing
There are a LOT of savings to be had in automation on newer hardware.
If it’s systematic, the whole thing can stay on a local controller. The question is about Ilternet connection, no one asked to get rid of automation.
If it requires frequent changing due to factors outside of the store, I would also wonder what they’re doing with these.
Grid spot pricing, Corporate hours management. Complaints from a store about the need to defrost a specific unit.
All the stores hit a “cloud” server the manufacturer manages, letting a single corporate location call the shots on consumption. I also find it likely they can call up individual VFD’s and run diagnostics.
Yes, since the dawn of refrigeration, we’ve gotten along fine without it, but I wouldn’t say it’s useless to have bidirectional communication because some idiot installers in cooperation with the idiot supermarket IT let the controller have a public IP or because the vendor didn’t think to lock remote manual defrost to a sane time limit.
Why not let the client manage the cloud server?
So sure, call home and report, don’t provide a control mechanism that’s connected to the internet.
That’s my thought. If it was for reading only then it makes sense to have charting on them and make sure they’re working, but editing should have been a local only thing.
The critical part is probably not limiting the defrost cycle time. Since most of the posts talk about it being the defrost cycle that was abused, one would have thought that the vendors would have patched that immediately
That’s part of the reason I made this meme, it’s not even permanently disable internet features, but don’t you want to at least disable internet features temporarily while people are actively attacking them until you do get your security up to par? The fact it happened twice shows they just thought it’d be a one-off
don’t worry, i’m SURE they’ll fix it this time
The internet connection is directly tied to their pursuit of endless profit driven by the shareholders. We need stakeholder primacy. It is the only way to actually align businesses with the workers, consumers, and those environmentally impacted by the leveraging of capital.
Sorry, a kid in China tried to ssh into amazon.com, no shopping today!
After the ‘4’ incident my calibration for guessing if something like this is a joke is completely broken.
My point is that hackers usually try to get into productive servers. You cannot just shut them down for every hacker attack, or you would never be online. You need to keep the business running while at the same time defending from attacks, so while the top scenario has a bunch of technobabble, it is more realistic.
Unplug those freezers :)
/s
you set that root account to ‘no’ in the config, right?
… RIGHT??
Just how do you expect to move the plot along!?!?
Because they were designed with cloud first mentality, they are fetching the temperature 100 times per second to the server. In case of connection issues, they stop working.
Does this seen stupid? Yes. Did I make it up? Also yes. Is the true for a lot of consumer electronics? Yes.
Yep, you know some solar panels stop working if the power management system can’t call home (the corp).
Who could have thought that during a power outage, you may lose the connection??
They are connected so they can be controlled and serviced from a central location. These aren’t consumer fridges. These businesses basically hire a servicing company and even lease the fridges from those companies. It’s more cost efficient then having a guy in each store that basically does nothing all day to fix the occasional problem. And waiting for a repairman to physically come in so they can just reboot or just change some parameters is also not ideal. The problem isn’t that they are connected the problem is that people don’t take internet security seriously. Like recently some Danish government server got hacked and data from citizens got stolen because a government worker didn’t change the default password of his account.
and now they’re figuring out the other side of that cost equation, that there’s a large amount of risk by exposing it. I agree on the monitoring side, that makes sense, but the fact that they had more than “read” permissions enabled at all shows that they didn’t do security well, and this is the cost of doing that. If they didn’t want to do security the right way, then maybe they should go back to how it was done in the 70s with a guy sitting in there watching them.
What!? And pay a person a wage!? No, better to spend billions of dollars putting it all in the cloud.
This. Also the ‘but why do freezers go up to 70° celsius huh? That’s so dumb! They’re freezers!’
To thaw them out. Like that’s it.
