This doesn’t require any fancy analysis. You can literally read the password off it — the last bit is an oddly decompiled string comparison.

The fact that Russia has access to LLMs that could decompile and explain this firmware ( and possibly even translate the explanation to Russian! ) is just another proof that this was definitely part of the hybrid war and Europe needs to spend a few more tens of billions on weapons and possibly impose restrictions on open weight LLMs.

It's not just about having tech inclined staff, but just the whole staffing strategy in general. Most grocery stores et. al. try to staff as cheaply as possible and try to have their workers do as much as possible during their shift. This means that there's no extra time available that they're not shelving products, or sitting at the register.

Rather than have extra staff at the store to do stuff like monitor fridge performance, it's better to have them report stuff centrally and have someone or some tool monitoring thousands of fridges across the entire chain. This way you can send out repair teams and plan maintenance more efficiently.

Electricity companies should be 100% air-gapped from any internet connection, whether or not they have outdated software.

Maybe AI will be able to give us a better FTP server in these industries

AI enabled hackers are going to break everything that’s connected to the internet forcing it to move in to the modern era.

I am reminded of this every time I fly Southwest Airlines

As someone who has worked with small and medium sized businesses, reasonable is extremely variable. I'm dealing with a small business right now that can't upgrade their perfectly good computers because of TPM issues. On one hand, I kind of get the reasoning behind it, but how can you hold a business of 10 people accountable for not knowing how to buy a computer that will be reasonably future proof? Every business needs IT on hand? I think that's asking too much. On the otherhand, you should know the tools you need to run your business. There's no fine line.

This will never fly. Some devices can be used for tens of years and they may face vulnerabilities that the hardware cannot support any kind of software fix for them. Imagine the world moves to TLS2 or whatever something new will be called and the hardware you have is too slow for it.

On the other hand, saying an industrial device should receive security updates for 10-15 years instead 5 or whatever happens this days it will be a major step forward. This will incentivise vendors to use better hardware with room to grow, not just the cheapest components possible.

Or, make componente modular so that you can upgrade just the control unit instead of the whole fridge or whatever.

Monitoring doesn't have to leave a way to enter the system automatically.

Alerts can be sent, and HVAC operators could have a process where they open a support ticket to get temporary access during scheduled windows by store managers.

I remember setting this up years ago for an hospital. Some third party suppliers could obtain RDP access to some VDI who could only accept a limited number of ips but they had to open a ticket and give a reason to get access. It wasn't a 365/24/7. Monitoring could still be sent any time.

Remote monitoring by itself is not a problem, but remote control is and has no benefits. You can't change the temperature of or defrost a freezer without removing everything from it, and if you can remove everything from it someone is already there the change the settings. And it takes extra work to enable remote controlling of a refrigerator system over just providing temperature readings.

And it still isn't going to save electricity. The only thing it can do is warn of a failure and tell you that you got like 20 minutes to start moving food before it has to be trashed for exceeding safe food handling temperatures.

> workers are not equipped to fix an HVAC system.

But they are perfectly capable of checking the temperature. After all the fridges and freezers are restocked multiple times a day so even if one failed it wouldn't have time to get warm before someone should notice.

Ad there are other ways of monitoring such as having an audible or visual alarm.

I wish I could upvote this comment more

good points and all the more reason to monitor in reliable, safe manner?

It's a fridge. In a grocery store. You just get an employee to adjust the thermostat dial. How would the hackers demand payment if all you need to do is turn the dial back to "frozen"???

Edit: Yes i know the commercial fridges do not have "dials" and it's more involved. Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.

You seem to set great store in your buns; take care, they may go bad

The refrigeration business does not really overlap with infosec or IT in general.

Makes no difference. A super market should be able to air gap all their smart devices and include a non internet connected computer.