Why is that even internet enabled?

If you want to defrost it presumably someone already needs to be physically present to unload the fridge?

Kevin_Flynn 12 hours ago | parent | next [-]

My guess, its a service contractor type situation, like getting a smart meter. You can opt out, you just wont have power.

They had a contract with a fridge company, and the service agreement required remote monitoring such that, the service company would be able to detect and troubleshoot remotely, and schedule calls.

The problem with situations like these is that your network security falls to the lowest common denominator, which in this case, is a group of HVAC technicians.

The conversation was something like this:

HVAC company: "Oh yeah, our software does this, and that, and we monitor everything, and thats why our contract is less, we dont waste time and we use sophisticated technology. And of course its 100% secure because expert boffins wrote it."

Grocer w/ 2% margins: "Sounds great."

To be clear, I'm not throwing shade on HVAC technicians. I'm only saying, they aren't network security specialists, thats all.

▲

wongarsu 11 hours ago | parent | next [-]

Somebody wrote the software that is the interface between the fridge and the internet. And while it would be nice if HVAC technicians would remember to only make this software accessible via VPN, it is in fact possible to write software that is reachable from the internet while still being secure

Given that we agree that HVAC technicians can't be relied on for network security, this is 100% on the fridge company for having insecure software. If it's a bad password or an unchanged default password that's still on the fridge company for not enforcing something better

▲

Kevin_Flynn 11 hours ago | parent | next [-]

Of course its "possible" for it to be secure, but the people involved are not experts.

The grocer likely has the least expertise. The HVAC company has more, but as evidenced by the article, not enough.

Now obviously, these companies have internal "information systems experts" but again, how does the banana guy interview a CIO ? Grocery store CIO might have gotten the job because he made the banana guy comfortable by talking about sports.

Each party was confident in a successful outcome, until the 15 year old kid across the globe pulled the rug.

The processes that created this situation were inadequate, because glad handing and name dropping cost less than formal systems validation.

Of course, the other way to view all of this is ... they just completed formal systems validation, found 1 bug, and paid whatever the food spoilage cost was for it, because no matter how much preperation one does on a project, at some point the power switch gets flipped, and its wait and see.

In a group project, noone is ever sure if Poindexter over there in the corner is quiet because he's quiet, or is quiet because he knows the code is crap and his boss ordered him to ship it anyway.

We're likely dealing with at least 4 companies here, if not more:

contracted programmers <-> fridge equipment maker <-> HVAC sales/service group <-> grocer

3 of the 4 companies could have all said to themselves "Project ships on Monday, no matter what" because who carries the risks for any flaws ? The grocer(s).

▲

dns_snek 10 hours ago | parent [-]

> Of course its "possible" for it to be secure, but the people involved are not experts.

They're selling network-accessible equipment so it's their duty to make it secure within some well-defined envelope. How's that any different from any other part of engineering and product development?

> "Project ships on Monday, no matter what" because who carries the risks for any flaws

Soon that will be the OEMs, per the EU Cyber Resilience Act [1]:

> Directive (EU) 2024/2853 [on liability for defective products] of the European Parliament and of the Council (16) is complementary to this Regulation. That Directive sets out liability rules for defective products so that injured persons can claim compensation when a damage has been caused by defective products. It establishes the principle that the manufacturer of a product is liable for damages caused by a lack of safety in their product irrespective of fault (strict liability). Where such a lack of safety consists in a lack of security updates after the placing on the market of the product, and this causes damage, the liability of the manufacturer could be triggered. Obligations for manufacturers that concern the provision of such security updates should be laid down in this Regulation.

[1] https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng

	▲	Kevin_Flynn 9 hours ago \| parent [-]
		Given the potential service contract nature of this particular situation, where the grocers signed a service agreement with HVAC companies, one would think the contract included clauses addressing this very situation, where a significant loss of inventory occurs. After all, the service being paid for is refrigeration. With floor planning, the loss itself could be spread across multiple companies, under multiple insurance policies. With that said, this particular hack could easily be a systems / networking "configuration error" and not any particular piece of softwares fault ( as in a bug, or hardcoded backdoor password. )

▲

Delphiza 11 hours ago | parent | prev [-]

IoT platforms provided all the required functionality. Device provisioning (it is not easy to do identity on 'things'). MQTT for service-assisted communication where devices don't need to accept incoming connections. Over-the-air software updates. Over-the-air kernel security updates.

The 'fridge company' and other product manufacturers decided to skip all that and run everything on a raspberry pi with apache, or an ESP32 soldered onto the control board, and call it finished. There are millions of these devices out there.

▲

Kevin_Flynn 11 hours ago | parent [-]

I just read the article again. It mentions "Danfoss" HVAC controls.

I happen to have a Danfoss HVAC controller here, and its controllable via Modbus. Its an older model, but its my understanding that larger HVAC systems commonly use Modbus.

Modbus systems are multi-drop serial, and the hack likely came in from the server side of one of the companies involved, and the HVAC controllers were all sent defrost commands. Thats my guess anyway.

I have a pump thats Modbus controllable as well, made by a company called Grundfos.

Gonna make a water battery.

Shift my cooling load into off-peak rate hours.

Stickin it to the power man. :D

Seriously, you guys would love these pumps.

https://product-selection.grundfos.com/us/products/magna-nor...

It has wifi. Neighbor kids are gonna defrost me. :(

▲

lrasinen 7 hours ago | parent | next [-]

Modbus is the equivalent of VGA connector in displays and projectors. It does have a TCP/IP version as well, but it has no security whatsoever. Or any features besides reading/writing a 16-bit value (or a single bit, charmingly referred to as "coil")

	▲	Kevin_Flynn 7 hours ago \| parent [-]
		Absolutely. I'm in the beginning stages of giving my home HVAC system an upgrade and using Modbus throughout with various adapter boards.

▲

Delphiza 11 hours ago | parent | prev [-]

Yes, that is likely. Although Danfoss seems to have their own controllers, I think that you are right, that the attack was not an 'Internet connected fridge', but an HVAC or FMS (Facilities Management System) that was connected to the fridges.

▲

Delphiza 8 hours ago | parent [-]

My mistake. It is stupider than that. Facepalm.

https://www.claroty.com/team82/research/freeze-the-controlle...

	▲	Kevin_Flynn 7 hours ago \| parent [-]
		Resubmit that article as its own headline. Good find.

▲

Tangurena2 10 hours ago | parent | prev | next [-]

In the 2013 Target attack, the attackers used the HVAC contractors' credentials to gain access to Target's systems. The point of sale credit card terminals (what customers swiped cards and enter PINs) had no real security so the attackers were able to make those get "updates" from their own servers and download malware enabling them to get the magnetic stripe information as well as PIN (for debit cards). That year, I (like about 150,000,000 other people) got a brand new credit card with a new credit card number.

https://krebsonsecurity.com/2015/09/inside-target-corp-days-...

Newer PCI standards require much more secure customer-facing terminals and much more secure back-end systems so that much of this attack could not happen again.

https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec...

▲

m000 11 hours ago | parent | prev [-]

> Grocer w/ 2% margins

You have clearly never stepped foot inside an Albert Heijn store.

	▲	Kevin_Flynn 11 hours ago \| parent [-]
		> You have clearly never stepped foot inside an Albert Heijn store. I have not. I travel in the ALDI circle. 2.1% net profit is what AI says the US grocery industry averages, so individual product margins would be higher.

▲

polytely 12 hours ago | parent | prev | next [-]

Yeah I feel like cheap enough AI will make having internet connected appliances such a huge liability that most devices will have to go back to as dumb as possible

▲

0123456789ABCDE 12 hours ago | parent | prev | next [-]

someone, or something, needs to monitor the fridges remotely, which means networked thing with all the cute little details of the IOT tacked to it

edit: these are unlikely to be directly connected to the internet, but rather part of an internal network that got popped, likely a while a go too

▲

quickthrowman 11 hours ago | parent | prev [-]

Have you ever been to a grocery store?

These aren’t consumer refrigerators, it’s a collection of large cold rooms and cases with a bunch of refrigerant tubing and multiple condensers, evaporators, and sensors. It’s a bit more complex than a single home refrigerator.