The advent of AI and its ability to find vulnerabilities so quickly is getting out of hand. Yesterday it was supermarket fridges now its fridges that store blood, they should never have been connected to the internet in the first place especially in these times with AI, but all of Europe needs to invest more into their cyber security systems they are anachronistic at this point.

▲

holsta 6 hours ago | parent [-]

> The advent of AI and its ability to find vulnerabilities so quickly

No AI needed. The supermarket controllers had software with guessable passwords and outdated nginx, both of which had patches out for a year.

Some hardware had reached end-of-live, and were never replaced.

All were connected directly on the internet instead of secure APNs or VPNs.

This is long-standing, basic management failure, and the fines should reflect that.

▲

drrotmos 5 hours ago | parent | next [-]

It is hard to wrap your head around a freezer reaching EOL due to no longer providing firmware updates though. I can absolutely understand why you'd have a hard time convincing a manager that you need to spend money to replace a "perfectly good" freezer just because the vendor no longer provides firmware security updates.

I agree that it's a manager failure in part, but I also think it's a failure on part of the industry to not demand longer term support for this type of product, and also on part of regulators for not realizing the vulnerability of the situation (though the EU Cyber Resilience Act seems an acceptable first stab at remedying this).

▲

Tryvrsakjo10 6 hours ago | parent | prev [-]

So, the people in charge are either inept or just sleeping on the job especially for things that are so important to people's lives. cause it seems like everyday something else is getting hacked or exploited because of its vulnerabilities.

▲

sznio 4 hours ago | parent [-]

in case of my friends, I see a lot of them dropping out of the workforce because of these inept people stuck in managerial positions. my college roommate has a masters in data science and now works as a construction worker. I am also thinking about something similar. i'm absolutely frustrated with idiots above me conducting meetings and wasting hundreds of workhours to deny changes like "don't use default passwords" because they are "unnecessary risk".

	▲	Tryvrsakjo10 2 hours ago \| parent [-]
		It sounds like they are both inept and indifferent about the running of the business, default passwords are not really that huge of a risk. Not updating systems after a long time is one and keeping the fridges connected to the internet while not spending enough on cyber security is a big risk.