- cross-posted to:
- [email protected]
- [email protected]
- cross-posted to:
- [email protected]
- [email protected]
You must log in or register to comment.
Someone on Twitter is saying that the username for the fridges was “admin” and that the password was the current date… Prime security in effect here, clearly /s
Well, this means the password is very often changed, so it is secure /s
It’s smart fridges all over again.
They use Samsung fridges, interesting 🤔😂
Maybe they learned they need to air gap critical infrastructure, and leave the management to on-site humans who are paid well enough not to hold their inventory for ransom.
“Learn” hahahahaha
Did having centralized control and monitoring of coolers save a fake number of man-hours on a spreadsheet instead of paying a store employee already on the clock to check temperatures occasionally?
They’re going to keep doing it because the spreadsheet says the risk is worth saving those fictional man-hour costs.
I worked in an American grocery store for a while, and the employees, even the managers, did not take cooler temperatures seriously. They were eager to shrug off, make excuses for, anomalies. Because they were too busy, and a freezer meltdown (which happened as the result of malfunctions more than once) was a ton of work, a huge disruption.
Far from saving money, I’m sure an automatic monitoring and control system that raised an alarm at headquarters would have cost that store more money. But it also would have resulted in better monitoring. It would have done a better job than the people who were avoiding that job were doing.
Much later, I worked at an engineering sub-contractor for a hospital equipment manufacturer. One of my projects included adding automatic temperature monitoring and logging to some pretty simple OR appliances. Humans were supposed to be checking the temperatures of these things on a regular basis, but I got the notion that we weren’t trying to save staffing costs so much as we were trying to make sure the mandated monitoring actually happened. Who really has time to check the temperature of the blood cabinet every hour? When things get busy, that’s the kind of thing that gets skipped first. If anyone was even taking it seriously in the first place.
It decisions with skilled professionals not budget skimming project managers.
They will calculate that they spend less on recovering from these cyberattacks than they would on paying staff fairly, and carry on.
I think it’s a funny warning by a good guy. The message is “get your shit together now before an all-out war”.
There’s nothing funny about wasting this much food
Funny as long as you don’t have to buy food in the affected area
Morgan Freeman Narrating: It was in that moment, they realized the IoT was a very, very dangerous idea.
Remote monitoring 👍
Remote control 👎
David Attenborough butting in: “That’s when they should have realized it, but did not. A fatal mistake.”
The executives that allowed the system to be built this way belong in prison for the value of the destroyed food. An engineer armload certainly told them this system needed better design and security and was told no by some cheap ass trying to preserve their executive bonus.
Nothing will ever change until these monsters have personal consequences.
We’re making sentient refrigerators that can’t keep food frozen.
Having fridges connected to the internet and getting them Hijacked is stupidity, not a cyberattack.
This is exactly what happened to the US Army about a month ago.
Why the fuck are all of your fridges controllable from the Internet? We didn’t have to build such a stupid, stupid society.
Because shops don’t want to run hardware on site, so they outsource the hosting of management and monitoring to the cheapest contractor. Unsurprisingly they don’t spend on security.
Because this way the bill of materials, design work, and labor cost are all higher; and that way the company can earn more money!
Capitalism is so far detached from what capitalists pretend it’s like. Wealth distribution is so uneven in the U.S. that there’s extremely little incentive to lower costs, even if the business is worse off because of it.
See, this is the kind of hack (if that’s what it was) I can get behind. This is a military target of a nation that is currently at war. Fuck up their food supply all day every day.
But what is described in OP is just shitty.
Being “smart” and connected to the internet is about to devalue a lot of manufactured goods that have no business being either one of the those things.
One can only hope
Idiot design and engineering for the sake of cheep managers. Same reason they are taking all the air gaps out of critical infrastructure. Instead of having Internet connected monitoring separate from the controls like a normal person, they hook controllers to the Internet too, so they don’t have to pay a technician to come in.
For added stupidity, the department at my job which has monitors and controls online just caused a number of techs who only do monitor and control to retire by making them return to work in office.
But you can whittle down your labor costs to a single untrained guy monitoring by notifications in the closet they converted to the IT room.
That was a rather cold move.
What’s missing from this report is more detail on how exactly this attack went down. Did the attackers compromise supermarket networks and manipulate the fridges through lateral movement within the network; or were the fridges accessible from the open internet? If the latter is the case (and there’s a non-zero likelihood they were): why the fuck?
I assume because of the monitoring cloud-based IoT thing from Danfoss fridges were so comfortable to use. Ok, you don’t need it so often, but hey it’s a cool IoT feature.
They really put a “let everything rot” button in there?
It might not rot, they set it to 50°C, so some things might get sous vide 😅
Yes, they did. Keep the defrost button pressed.
Guess…
why the fuck
Because, despite us being in the Information Age, and computers surrounding us everywhere, only a very small portion of the population consider that learning how they work may be useful.
I’m sure if more people learned about how computers work, AI wouldn’t be a thing because they’d realize that computing-based tasks can already be automated without LLMs.
Tell that to my developer colleagues who are busy defining “skills” for the AI to do the mundane things our tools could already do. It may waste huge amounts of electricity, water and money, make us dependent on American megacorporations, cause their skills to atrophy, and be a gamble every time, but at least they don’t have to read the manual.
I had a picture of the device since I was curious, but I spotted at Walmart, and some other stores, a Cellular/Wifi/BT gateway that was branded by some company providing facilities services. As far as I can tell, the device was intended to provide secure connectivity to some service provider. I found a similar device in the freezer section of another store.
I imagine that there is remote control/remote monitoring of all the freezers or other on-premise machinery (which, is a perfectly sound thing to do), but if the central provider doesn’t take security seriously, and stay on top of their systems operations, can easily be the target for any kind of attacks.
More practically, I suspect that everyone involved has insurance whose cost is much less than ongoing proactive security + maintenance of their systems, which is why these incidents don’t seem to instantly put these companies out of business.
Stuff like eWon routers are everywhere, they’re basically openvpn (thank you open source devs, of course we won’t contribute shit or share any of the money you made us) devices that connect to a bunch of central servers and allow you to tunnel to them. Compromise such a system and you’re spoiled for choice on what to hit.
Alright then, No more IoT refrigerators in my home.
Wasn’t Delhaize just hit by ransomware? Must’ve been 2025 or 2024. That’s very embarrassing to go through this shit and not learn anything from it.
