There is so much needless connection to the internet nowadays; this is the end result of a decade of shoving IoT into everything.

Beyond some corporate manager seeing a dashboard that will cause them to say "oh neat" in a meeting once, there is zero reason to put a refrigerator's cooling system online. Or frankly any network for that matter. Is there really such a massive productivity increase from being able to remotely change the temperature when a human has to physically visit the machine to restock every day anyway?

▲

Delphiza 10 hours ago | parent | next [-]

There are a bunch of good reasons to connect a commercial refrigeration unit to the Internet (via IoT). Notification when failover to the secondary cooling system happens, notification of when ambient temperature is too high, optimisation of energy consumption (especially after hours).

Doing it insecurely by, for example, having a device with a web server on the fridge is problematic. Not being able to deploy firmware updates. Having too much of the control loop exposed (as opposed to monitoring only), can lead to issues.

Service-oriented industries with costly assets will look to Internet connectivity for competitiveness and efficiency. It needs to be done better.

▲

renyicircle 10 hours ago | parent | next [-]

I didn't expect to spend so much time today thinking about fridges. I have so many questions. If it's all so connected and monitored and notifies of issues, couldn't it notify anyone that the settings are weird, like continuous 50 degree Celsius defrosting? How much access did the hackers have, apart from temperature controls? Could nobody intervene quickly before the damage was done? Was there a way to "unplug" the fridges or they would just keep frying, so they had to get people across all the stores doing manual resets?

	▲	bluGill 10 hours ago \| parent \| next [-]
		It can do all that IF YOU THINK OF IT and then write the program to do it. If you think of it - which is unlikely because it never happened before (or perhaps it did before but electronics are reliable and so you think it won't ever again). These are commercial units. There is no plug. There is a circuit breaker in the back room, but general rules is only an electrician is allowed to touch them: if they are off there is always a good reason (until now) and so random staffers touching the panel to turn a breaker on is likely to kill somebody.
	▲	Delphiza 10 hours ago \| parent \| prev [-]
		Look for "Danfoss AK-SM 720 user manual" and scroll through the pdf. You'll find that these are quite complex control systems and their data may not be integrated into an operational or security control centre. So if they are not configured for, or resourced (in terms of operators), to handle anomalies, how do they notice and respond? Without knowing anything about the attack it may be that the controllers were not connected directly to the public Internet, but an on-site VPN that became compromised some other way. Or with a compromised laptop of a technician that connected. So while you are thinking about fridges today, think about how you would secure and operate control systems across tens of thousands of stores. Would that be easier without Internet connectivity? How do you get qualified and experienced technicians into each (air gapped) store? Another complexity is that many of these systems are part of facilities management systems (HVAC, lighting, security, fire control) and managed or owned by a completely different organisation that is not going to share their data.

▲

6 hours ago | parent | prev [-]

[deleted]

▲

Lyngbakr 10 hours ago | parent | prev | next [-]

I always feel like such a buzzkill and Luddite when talking about IoT. My sister-in-law excitedly told me how her air fryer can be controlled remotely via an app. I think she also expected me — a techie — to be excited, but all I could see was unnecessary risk and usage data being slurped up by a corporation. I'm sure there are lots of good applications of IoT; however, I don't think this is one of them.

	▲	bokohut 7 hours ago \| parent [-]
		And your SIL would just be as likely excited too about a MOEN wifi connected voice controlled kitchen faucet. Ain't it cool! She will not be as excited however when the water bill comes and cannot pin point where the additional water they claim to have not used has gone. Then we move on to even more serious potential life changing appliances that are wifi connected of which your SIL would certainly just be as excited about. Wifi connected hot water tanks of which some here know how they work and what this remote ability allows. Ain't it cool! She will not be as excited however when the medical bills come nor every single passing day when she sees the visible scars she must carry for the remainder of her living days for being 'cool' - ironic huh? Reality hits hard as most humans are reactive and those that have been in this game for many decades grossly understand the dark side of insecurely connecting devices that have life changing implications. Medical devices companies have already shadowed their software mistakes yet such information only stays in the shadows for so long. "What you cannot see matters most!" and many tech illiterates are currently learning this in most unfortunate ways. Some of that learning will scar both mentally and physically for life. Ain't it cool! Many people here reading this are a lot smarter than I and such can therefore extrapolate and add to what is unfolding in the world. It shows little sign of stopping as more and more devices are connected daily under the guise of 'easy'. Thus the underlying absolute reason to "Stay Healthy!"

▲

pjmlp 10 hours ago | parent | prev | next [-]

Added to it that those devices are powered by firmware written in C and C++, with various levels of quality control if any, and no field updates.

▲

quickthrowman 10 hours ago | parent | prev [-]

> there is zero reason to put a refrigerator's cooling system online.

There are plenty of good reasons to do that. It’s not a consumer refrigerator, it’s a collection of evaporators and condensers and sensors that are controlled by an automation system. Remote monitoring can alert operators to problems so they can be fixed before the food spoils.

Authentication is hard.

	▲	dns_snek 9 hours ago \| parent [-]
		> Authentication is hard. Authentication is easy, getting people (esp. leadership) to give a shit is hard. Control loop is obviously local and performed by dedicated controller hardware. If you only need remote monitoring then don't expose any management functionality. If you want remote management, then define an envelope of allowable system parameters that can be controlled remotely. Allowing defrost to be initiated remotely has obvious risks and known solutions - add a hardware interlock, like a physical button or a key switch. Even if you ignore all other precautions and allow all parameters to be controlled without limitations, strong authentication is still easy to implement, if anyone cares enough to do it.