I’ve seen some breathless reporting in the media about the situation in France saying it’s the biggest cyber attack ever and the result of a swarm of Agentic AI bots.
Reality: no. It’s a complete lack of security controls and negligent product development by the vendor.
Hmm true.. To be fair my understanding is that in a legal sense in most places, that would still be "hacking".
Someone leaves a stickynote with their user+password public, you log in with that, it still constitutes "unauthorised computer system access" or something along those lines.
So while it isn't like a zero day, or someone sneaking their way into the system, abusing the default creds to wreak havoc is still a "cyberattack" in my books.
I mean, sure, in the same sense that if a bank manager leaves a sack of money on the pavement outside, closes up, and goes home the resultant theft is a "bank heist" ;)
Edit: the reason I'm harping about it is that language matters, and I suspect that those involved are trying to portray it as something less stupid on their part than a sack on money left on the pavement.
If you forget to lock your door, and someone enters your house and takes something you own, that's not a crime?
Note that I am purposefully leaving out whether you'd get an insurance claim approved. That's subtly different.
Edit if you find a valuable item on the street, the expecation here in Sweden is that you leave it with the police, who then make a best effort to locate the owner. (my late mother in law did that with a load of cash she found, she was awarded it after it was unclaimed for 6 months (also got a big tax claim for it though))
Yes it's still a crime, and should be. Just that framing it as a "cyberattack" exaggerates the difficulty of the intrusion, and glosses over the negligence that made it possible.
It would be more honest for the headline to read something like "French supermarket shutdown linked to negligent security"
But it's in many people's interests to portray this as more advanced than it really is. "Wily hackers (probably Russian!) attacking critical infrastructure with their leet skillz" is a better sell than "lazy hardware vendor doesn't understand basic security".
According to German news the fridges have 3G cards and and aren't managed by the supermarket chain IT department but by the contractor responsible for the fridges.
Thanks, that sounds horrible. One would think that a supermarket is responsible for the entirety of its in-store space and stock, from the moment it is unloaded all the way to the cash register.
I should check back in a few years, maybe the big brand stores are going to start renting out space to independent operators (dairy section served by X) in the same way that malls do. Then, I fully expect per-shelf bids to happen. A reverse Subway, if you will.
To the best of my knowledge, effectively per-shelf-bids are a thing today in some places, and have been for decades. As well as the shelves being won in a bid being routinely arranged by the suppliers not the supermarket. (Even though that goes through the single checkout).
It’s quite common for rented machines (of any kind) to come with monitoring as part of the service contract. I remember a story about an IBM mainframe from the ‘80s (possibly earlier) where a technician showed up to replace a failed CPU and that was the first the operators knew about the failure. It had a dedicated phone line to dial into IBM’s support centre and it sent the failure notification as soon as the CPU died, then switched to a redundant spare.
For fridges, most supermarkets don’t want to have someone on staff who can do the routine and non-routine maintenance because they go for months without needing any intervention and that’s someone on the payroll doing nothing most of the time. So they’ll outsource it and have someone on call with a service contract from the outsourced vendor who can come and fix them if they break. From then on, it’s an incremental step to have them sending telemetry to the service people. Some faults may be possible to remotely diagnose (so you can send someone who has whatever replacement parts are necessary), some may be possible to remotely fix or mitigate. There may also be signs of imminent failure where you can do things like switch the compressor to a cycle that takes the temperature a bit outside of the optimal range (but still within the safety range) and places less stress on the system while you send a technician out to fix it.
All of that is valuable and useful. As long as your security isn’t a complete embarrassment. And, in the case of these, it was. The admin password changed every day: to the current date.
Anything of significant size, I think. At my last job we had a relatively small walk-in fridge, and that definitely periodically pumped hot water through the heat exchanger inside the fridge itself to de-ice the vanes. It made quite a distinct sharp cracking sound.
Oh, I've seen these pop up a lot in open VNC servers in the carousel of open ones. Who knew those VNC Resolver etc. accounts would let you predict the next cyberattacks?
If there is now an actual adversary where people capable of basic computer use (uhm, Shodan) and people willing to carry out the attacks are the same people, we are watching a slow-motion trainwreck, and this is just the beginning…
My favorite part is the manufacturer, trying to disclaim responsibility for not having a security update, through planned obsolescence:
Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".
It would be a shame if someone were to hack your fridge just because of our bad software. If you want the fix, our gang will need to sell you a brand new fridge.
duncan_bayne | 19 hours ago
"Cyberattack" is a bit of a stretch to describe what was most likely just someone using the default username and password.
https://cyberplace.social/@GossiTheDog/117429502412235079
eduard | 13 hours ago
Some further takes from Kevin Beaumont:
1
2
zk | 18 hours ago
Hmm true.. To be fair my understanding is that in a legal sense in most places, that would still be "hacking".
Someone leaves a stickynote with their user+password public, you log in with that, it still constitutes "unauthorised computer system access" or something along those lines.
So while it isn't like a zero day, or someone sneaking their way into the system, abusing the default creds to wreak havoc is still a "cyberattack" in my books.
duncan_bayne | 16 hours ago
I mean, sure, in the same sense that if a bank manager leaves a sack of money on the pavement outside, closes up, and goes home the resultant theft is a "bank heist" ;)
Edit: the reason I'm harping about it is that language matters, and I suspect that those involved are trying to portray it as something less stupid on their part than a sack on money left on the pavement.
gerikson | 15 hours ago
If you forget to lock your door, and someone enters your house and takes something you own, that's not a crime?
Note that I am purposefully leaving out whether you'd get an insurance claim approved. That's subtly different.
Edit if you find a valuable item on the street, the expecation here in Sweden is that you leave it with the police, who then make a best effort to locate the owner. (my late mother in law did that with a load of cash she found, she was awarded it after it was unclaimed for 6 months (also got a big tax claim for it though))
duncan_bayne | 14 hours ago
Yes it's still a crime, and should be. Just that framing it as a "cyberattack" exaggerates the difficulty of the intrusion, and glosses over the negligence that made it possible.
It would be more honest for the headline to read something like "French supermarket shutdown linked to negligent security"
gerikson | 14 hours ago
That I can agree on.
But it's in many people's interests to portray this as more advanced than it really is. "Wily hackers (probably Russian!) attacking critical infrastructure with their leet skillz" is a better sell than "lazy hardware vendor doesn't understand basic security".
rkaw92 | a day ago
I'm still wondering why stuff like this has to be connected to the Internet. What's the benefit?
manfred | a day ago
I assume they are on a local network for monitoring purposes, but the PC used to set schedules and read the monitoring information got hacked.
pyfisch | a day ago
According to German news the fridges have 3G cards and and aren't managed by the supermarket chain IT department but by the contractor responsible for the fridges.
rkaw92 | a day ago
Thanks, that sounds horrible. One would think that a supermarket is responsible for the entirety of its in-store space and stock, from the moment it is unloaded all the way to the cash register.
I should check back in a few years, maybe the big brand stores are going to start renting out space to independent operators (dairy section served by X) in the same way that malls do. Then, I fully expect per-shelf bids to happen. A reverse Subway, if you will.
k749gtnc9l3w | a day ago
To the best of my knowledge, effectively per-shelf-bids are a thing today in some places, and have been for decades. As well as the shelves being won in a bid being routinely arranged by the suppliers not the supermarket. (Even though that goes through the single checkout).
david_chisnall | 12 hours ago
It’s quite common for rented machines (of any kind) to come with monitoring as part of the service contract. I remember a story about an IBM mainframe from the ‘80s (possibly earlier) where a technician showed up to replace a failed CPU and that was the first the operators knew about the failure. It had a dedicated phone line to dial into IBM’s support centre and it sent the failure notification as soon as the CPU died, then switched to a redundant spare.
For fridges, most supermarkets don’t want to have someone on staff who can do the routine and non-routine maintenance because they go for months without needing any intervention and that’s someone on the payroll doing nothing most of the time. So they’ll outsource it and have someone on call with a service contract from the outsourced vendor who can come and fix them if they break. From then on, it’s an incremental step to have them sending telemetry to the service people. Some faults may be possible to remotely diagnose (so you can send someone who has whatever replacement parts are necessary), some may be possible to remotely fix or mitigate. There may also be signs of imminent failure where you can do things like switch the compressor to a cycle that takes the temperature a bit outside of the optimal range (but still within the safety range) and places less stress on the system while you send a technician out to fix it.
All of that is valuable and useful. As long as your security isn’t a complete embarrassment. And, in the case of these, it was. The admin password changed every day: to the current date.
darleaf | a day ago
Relatedly, does anyone know why a forced defrost function would be useful? (even if it is I fail to see why you’d need to be able to do it remotely)
k749gtnc9l3w | a day ago
Presumably some industrial fridges are too large for non-forced defrost to be practical?
srtcd424 | 14 hours ago
Anything of significant size, I think. At my last job we had a relatively small walk-in fridge, and that definitely periodically pumped hot water through the heat exchanger inside the fridge itself to de-ice the vanes. It made quite a distinct sharp cracking sound.
hoistbypetard | a day ago
This piece from bleepingcomputer mentions the supplier and links to a CVE afflicting the controller software from last year.
k749gtnc9l3w | a day ago
Linked AFP piece now also names Danfoss.
calvin | a day ago
Oh, I've seen these pop up a lot in open VNC servers in the carousel of open ones. Who knew those VNC Resolver etc. accounts would let you predict the next cyberattacks?
k749gtnc9l3w | a day ago
If there is now an actual adversary where people capable of basic computer use (uhm, Shodan) and people willing to carry out the attacks are the same people, we are watching a slow-motion trainwreck, and this is just the beginning…
robey | 3 hours ago
My favorite part is the manufacturer, trying to disclaim responsibility for not having a security update, through planned obsolescence:
It would be a shame if someone were to hack your fridge just because of our bad software. If you want the fix, our gang will need to sell you a brand new fridge.