French supermarket chains say cyberattack forced refrigerator shutdown
17 points by aldantanneo
17 points by aldantanneo
This popped up and reminded me strangely of a story post a month ago here:
https://lobste.rs/s/ygjo0g/i_think_military_commissary_freezers
And, lo and behold, the very same controller supplier is mentioned in both the earlier US article and the one covering this by french newspaper Le Monde: the danish company Danfoss. I could not find sources mentioning the supplier in English.
This piece from bleepingcomputer mentions the supplier and links to a CVE afflicting the controller software from last year.
Linked AFP piece now also names Danfoss.
Oh, I've seen these pop up a lot in open VNC servers in the carousel of open ones. Who knew those VNC Resolver etc. accounts would let you predict the next cyberattacks?
If there is now an actual adversary where people capable of basic computer use (uhm, Shodan) and people willing to carry out the attacks are the same people, we are watching a slow-motion trainwreck, and this is just the beginning…
I'm still wondering why stuff like this has to be connected to the Internet. What's the benefit?
I assume they are on a local network for monitoring purposes, but the PC used to set schedules and read the monitoring information got hacked.
According to German news the fridges have 3G cards and and aren't managed by the supermarket chain IT department but by the contractor responsible for the fridges.
Thanks, that sounds horrible. One would think that a supermarket is responsible for the entirety of its in-store space and stock, from the moment it is unloaded all the way to the cash register.
I should check back in a few years, maybe the big brand stores are going to start renting out space to independent operators (dairy section served by X) in the same way that malls do. Then, I fully expect per-shelf bids to happen. A reverse Subway, if you will.
To the best of my knowledge, effectively per-shelf-bids are a thing today in some places, and have been for decades. As well as the shelves being won in a bid being routinely arranged by the suppliers not the supermarket. (Even though that goes through the single checkout).
Relatedly, does anyone know why a forced defrost function would be useful? (even if it is I fail to see why you’d need to be able to do it remotely)
Presumably some industrial fridges are too large for non-forced defrost to be practical?