Another point towards "stop making everything a smart thing connected to the internet".
Actually this is a BIG point in that argument. Food is one of the most strategic targets in warfare, because people literally need it to survive. I don't care if the option to manage the temperatures remotely is convenient, there are times where convience is not worth the risk.
The fact that the affected fridges "were older models whose security software could not be updated to ward off a risk they had identified" shouldn't be a problem that can exist in the first place. Am I interpreting that sentence right, to mean that those fridges are old enough they're no longer supported to receive security updates? How long does it take for a fridge to lose support for security updates? That genuinely feels like planned obsolescence, and a recipe for disaster given many businesses notoriously refuse to replace still-functioning hardware.
I read that as they're old machines that don't have an update mechanism. Like they shipped with remote management features but not a means to provide internet based updates, because that wasn't as much of a thing years ago.
The situation is probably less consumer IoT device and more "this industrial equipment can plug in to a router, and a computer on the network is supposed to talk to them." Then someone just gains a point of ingress into that network and can send messages to the connected fridges.
One would assume that a large enough chain has ongoing maintenance contracts for their equipment, for parts and software. If they're just rolling with old, discontinued stuff and buying parts to keep things going, it long since ceased to be the manufacturer's responsibility. Long term support ain't free.
Either way it's nothing new. Servers have had remote management ports on them for years (e.g. Dell's iDRAC system) and are notoriously vulnerable to being hacked.
Any company that takes cybersecurity seriously knows that these kinds of management systems should be split away from any internet facing connectivity using VLANs and jump servers and VPNs (though I'd lean more towards CannibalisticApple's argument not to use it at all).
That said, the blame isn't one sided. It's also a failure of the manufacturer to not forsee this issue and plan accordingly.
Neither are car companies until it costs them billions in damages, and I'm willing to bet quite a few of them changed their tune pretty quickly afterwards. Maybe this will be the wake-up call for their sector.
The vulnerability (likely) executed in this attack was publicly disclosed in August, and relies on the fridges leaving their admin interface publicly exposed, and an endpoint with an override password generated based on the date.
Every day I'm shocked by the complacency, laziness, or idiocy of people when it comes to IT security. Like, I've come to expect it by now, but still. So many attacks could be described as being like if you hung the keys to your house in the middle of downtown with a sign displaying your address and the hours your house will be empty.
The firm added in s statement that it had "long advised" businesses to keep supported systems up to date.
"Reliable refrigeration is critical to our customers' operations, and we remain committed to supporting our customers and helping them maintain secure and reliable systems they are used to."
Well a good thought, it does not work when this was the previous paragraph in the article:
Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.
So they argue that to prevent the hacking to keep systems up to date, but then do not provide a way to keep the systems secure from vulnerabilities that they recognize. Honestly feels a company not worth working with if after an attack they say to keep stuff updated to prevent attacks while they find vulnerabilities but do not provide an update to secure the vulnerability
Hundreds of French supermarkets have been hit by a cyber attack that caused their fridges and freezers to heat up, spoiling fresh and frozen food estimated to be worth millions of euros.
Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected.
This article reminded me of a substack a friend send me a month ago, about a (alleged!) similar cyber attacks on US military installations. AFAIK they are not related in any way other than "fridge hacked".
I just can't see any reason you'd need to adjust the temperature?
They have 2 jobs, keep it at a specific temperature and change the temperature to another specific temperature for a set period of time before going back to the lower temperature. I can understand monitoring temperatures or ice levels in case it needs repair or maybe even changing the defrost schedule, but not remote changes to temperature. That should be built into the fridge, hard coded!
Presumably they also minimize power consumption by adjusting compressor parameters based on store traffic, local power grid conditions, time of day, etc. We're long past the "smart grid" becoming a thing. It's pretty normal for appliances in many regions to prioritize operation during off-peak hours or react to an overloaded grid...and industrial refrigeration is considerably more energy intense than home appliances.
I've even opened and closed a door on a cooler before and had it lock and display an indication that it was too close to the temperature ceiling and needed to cool. That one wasn't in a store, though. It was a glorified vending machine where you take the item out of one of the coolers (or a non-cold shelf) and scan it on the self-checkout thing.
The hack triggered the defrost function, according to an article I read this morning. I imagine that might normally be done without food in the fridge.
Fair enough. Why you'd need to do that remotely boggles the mind. I do understand the grid use-case, but you'd hope you can only adjust within safe ranges remotely
CannibalisticApple | a day ago
Another point towards "stop making everything a smart thing connected to the internet".
Actually this is a BIG point in that argument. Food is one of the most strategic targets in warfare, because people literally need it to survive. I don't care if the option to manage the temperatures remotely is convenient, there are times where convience is not worth the risk.
The fact that the affected fridges "were older models whose security software could not be updated to ward off a risk they had identified" shouldn't be a problem that can exist in the first place. Am I interpreting that sentence right, to mean that those fridges are old enough they're no longer supported to receive security updates? How long does it take for a fridge to lose support for security updates? That genuinely feels like planned obsolescence, and a recipe for disaster given many businesses notoriously refuse to replace still-functioning hardware.
redwall_hp | a day ago
I read that as they're old machines that don't have an update mechanism. Like they shipped with remote management features but not a means to provide internet based updates, because that wasn't as much of a thing years ago.
The situation is probably less consumer IoT device and more "this industrial equipment can plug in to a router, and a computer on the network is supposed to talk to them." Then someone just gains a point of ingress into that network and can send messages to the connected fridges.
One would assume that a large enough chain has ongoing maintenance contracts for their equipment, for parts and software. If they're just rolling with old, discontinued stuff and buying parts to keep things going, it long since ceased to be the manufacturer's responsibility. Long term support ain't free.
infpossibilityspace | 16 hours ago
Either way it's nothing new. Servers have had remote management ports on them for years (e.g. Dell's iDRAC system) and are notoriously vulnerable to being hacked.
Any company that takes cybersecurity seriously knows that these kinds of management systems should be split away from any internet facing connectivity using VLANs and jump servers and VPNs (though I'd lean more towards CannibalisticApple's argument not to use it at all).
That said, the blame isn't one sided. It's also a failure of the manufacturer to not forsee this issue and plan accordingly.
Hunterquill | 10 hours ago
I’m gonna take a guess and say grocery chains aren’t too big on cybersecurity.
infpossibilityspace | 8 hours ago
Neither are car companies until it costs them billions in damages, and I'm willing to bet quite a few of them changed their tune pretty quickly afterwards. Maybe this will be the wake-up call for their sector.
https://en.wikipedia.org/wiki/Jaguar_Land_Rover_cyberattack
Zorind | 20 hours ago
The vulnerability (likely) executed in this attack was publicly disclosed in August, and relies on the fridges leaving their admin interface publicly exposed, and an endpoint with an override password generated based on the date.
https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
updawg | 17 hours ago
Every day I'm shocked by the complacency, laziness, or idiocy of people when it comes to IT security. Like, I've come to expect it by now, but still. So many attacks could be described as being like if you hung the keys to your house in the middle of downtown with a sign displaying your address and the hours your house will be empty.
IsildursBane | 22 hours ago
Well a good thought, it does not work when this was the previous paragraph in the article:
So they argue that to prevent the hacking to keep systems up to date, but then do not provide a way to keep the systems secure from vulnerabilities that they recognize. Honestly feels a company not worth working with if after an attack they say to keep stuff updated to prevent attacks while they find vulnerabilities but do not provide an update to secure the vulnerability
[OP] riQQ | a day ago
Omnicrola | a day ago
This article reminded me of a substack a friend send me a month ago, about a (alleged!) similar cyber attacks on US military installations. AFAIK they are not related in any way other than "fridge hacked".
https://signalandsilence.substack.com/p/i-think-someone-hacked-the-commissary
updawg | 17 hours ago
My immediate thought is that they probably are related.
SteeeveTheSteve | a day ago
I just can't see any reason you'd need to adjust the temperature?
They have 2 jobs, keep it at a specific temperature and change the temperature to another specific temperature for a set period of time before going back to the lower temperature. I can understand monitoring temperatures or ice levels in case it needs repair or maybe even changing the defrost schedule, but not remote changes to temperature. That should be built into the fridge, hard coded!
redwall_hp | 23 hours ago
Presumably they also minimize power consumption by adjusting compressor parameters based on store traffic, local power grid conditions, time of day, etc. We're long past the "smart grid" becoming a thing. It's pretty normal for appliances in many regions to prioritize operation during off-peak hours or react to an overloaded grid...and industrial refrigeration is considerably more energy intense than home appliances.
I've even opened and closed a door on a cooler before and had it lock and display an indication that it was too close to the temperature ceiling and needed to cool. That one wasn't in a store, though. It was a glorified vending machine where you take the item out of one of the coolers (or a non-cold shelf) and scan it on the self-checkout thing.
lostwax | 17 hours ago
The hack triggered the defrost function, according to an article I read this morning. I imagine that might normally be done without food in the fridge.
adutchman | 15 hours ago
Fair enough. Why you'd need to do that remotely boggles the mind. I do understand the grid use-case, but you'd hope you can only adjust within safe ranges remotely
preposterous | a day ago
I wonder if the 1600s market in Paris didn’t burn because one such freezer went haywire in there :(
[OP] riQQ | 17 hours ago
For context:
https://www.lemonde.fr/en/france/article/2026/10/12/famous-paris-market-completely-destroyed-in-overnight-fire_6758497_7.html