Attacking a countries food supply and food reserves really seems like a act of war.
The term “hackers” really downplays the severity of these kinds of cyber attacks IMO. It makes it kind of sound like a teenager in a basement somewhere, as opposed to some foreign state cyber warfare group or something along those lines.
Also it’s madness that systems like these are connected directly to the internet without read-only permissions implemented. Controls should only be accessible locally on some kind of airgap or local seperate VLAN.
Please stop with the acts of war or terrorism BS. The article also mentions “in-store pricing powered by electronic shelf labels” so lets not ignore this is about multi-billion companies trying to suck every penny out of our pocket. If these companies design and manufacture and buy stupid hardware that is susceptible to such hacking, they really deserve it. I mean they really do.
Second, this is a good thing. Systems will be hardened now. You think there would be any other fucking way they would upgrade their security unless something like this happens? Beatings will continue until security improves. This is why even chaotic hackers that cause damage and inconvenience are ultimately a positive force on our IT infrastructure. Think of it as an ecosystem and evolutionary pressure. Free marketplace of security models.
An apparently untargeted attack on food supply is an attack on society before it has anything to do with that specific company, in my eyes.
Well, it is true. It is an attack on a society with internet connected refrigeration units with bad security. But fuck that society in particular.
Agreed. It’s also a massive jump to call a grocery chain’s fridges a countries ‘food reserves’
Not a leap at all, it’s the food in the county as much as the next morsel.
Also it’s madness that systems like these are connected directly to the internet without read-only permissions implemented.
Water systems in the US are, too. And they have been hacked.
The main plot of Ghost in the Shell 3. sigh
Given the simplicity of this attack and complete disregard for security by the vendor, it is likely to just be a teenager in a basement somewhere
Why the fuck does a refrigerator need to be on a network?
Controls have to be put somewhere, and networked interfaces mean fewer physical controls that may be difficult to access, tampered with or fail. Having a standard control protocol means interfaces can be changed and improved without modifying the hardware. They’re not a bad thing.
However, having networked controls exposed on anything other than private, air-gapped, wired-only LANs seems rather foolish, to me.
Speculation to your question, for monitoring and control.
For monitoring, log temperatures and send error message if it gets too high. Data could be used if any legal question come up about food spoilage.
For control, I’m guessing there’s times you want to shut it off or enable/disable defrost. Easier to do that at a computer than have controls that are either a pain inthe ass to get to, or too easy for some moron to mess with.
That being said, it should be on a local network and have no access to the internet. However a chain store would probably want the data sent to HQ, so the computer would need to be on the network.
Somebody learns the term “single point of failure” now…
I wonder how much money was saved by having someone manage the freezer section, or how much money was earned by not having an empty fridge.
The management quarterly meeting PowerPoint presentation says x3 more yachts for us.
Someone on Twitter is saying that the username for the fridges was “admin” and that the password was the current date… Prime security in effect here, clearly /s
Well, this means the password is very often changed, so it is secure /s
Idiot design and engineering for the sake of cheep managers. Same reason they are taking all the air gaps out of critical infrastructure. Instead of having Internet connected monitoring separate from the controls like a normal person, they hook controllers to the Internet too, so they don’t have to pay a technician to come in.
For added stupidity, the department at my job which has monitors and controls online just caused a number of techs who only do monitor and control to retire by making them return to work in office.
But you can whittle down your labor costs to a single untrained guy monitoring by notifications in the closet they converted to the IT room.
Morgan Freeman Narrating: It was in that moment, they realized the IoT was a very, very dangerous idea.
Remote monitoring 👍
Remote control 👎
David Attenborough butting in: “That’s when they should have realized it, but did not. A fatal mistake.”
Just wait until some cars get hacked to accelerate as fast as possible because we just had to have telemetry in them for surveillance and profit.
Search YouTube for “Michael Hastings Accident”.
Hackers using AI can absolutely hack into a Tesla and make it do anything they want. I’m surprised they haven’t to the point where it’s major news.
Maybe they learned they need to air gap critical infrastructure, and leave the management to on-site humans who are paid well enough not to hold their inventory for ransom.
“Learn” hahahahaha
Did having centralized control and monitoring of coolers save a fake number of man-hours on a spreadsheet instead of paying a store employee already on the clock to check temperatures occasionally?
They’re going to keep doing it because the spreadsheet says the risk is worth saving those fictional man-hour costs.
I worked in an American grocery store for a while, and the employees, even the managers, did not take cooler temperatures seriously. They were eager to shrug off, make excuses for, anomalies. Because they were too busy, and a freezer meltdown (which happened as the result of malfunctions more than once) was a ton of work, a huge disruption.
Far from saving money, I’m sure an automatic monitoring and control system that raised an alarm at headquarters would have cost that store more money. But it also would have resulted in better monitoring. It would have done a better job than the people who were avoiding that job were doing.
Much later, I worked at an engineering sub-contractor for a hospital equipment manufacturer. One of my projects included adding automatic temperature monitoring and logging to some pretty simple OR appliances. Humans were supposed to be checking the temperatures of these things on a regular basis, but I got the notion that we weren’t trying to save staffing costs so much as we were trying to make sure the mandated monitoring actually happened. Who really has time to check the temperature of the blood cabinet every hour? When things get busy, that’s the kind of thing that gets skipped first. If anyone was even taking it seriously in the first place.
They will calculate that they spend less on recovering from these cyberattacks than they would on paying staff fairly, and carry on.
It decisions with skilled professionals not budget skimming project managers.
The nice lady who sold me my home left a fancy washer and dryer set and it can connect to my internet but my fucking question remains why lol. Fridge is normal thankfully.
Because it is really nice knowing when the wash is done from across the house.
Okay Mr. Moneybags, with a house so big you can’t just hear the ding from the other end.
(I’m just kidding; even in my small house it’s possible to miss it when the laundry closet door is closed.)
Because Samsung likes knowing when the wash is done from across the world.
If the company has ever made a TV or Cell Phone I’ll never buy their appliance.
Fuck Samsung.
Timer on my phone also does that!
not if your washing machine is anything above basic, in which case the time estimate at start is not reliable because it changes depending on conditions
It doesn’t change that drastically in my experience, generally with full loads and a small selection of programs we regularly use. The dryer OTOH can often be done much sooner and the displayed time is more of an upper limit.
A simple timer still gets the job done when we’re chaining laundry, don’t need to maximize uptime by the minute. My devices are fine offline.
This guy gets it.
BTW I don’t have a smart washing machine but I do have home automation through Home Assistant and I’ve added an automation that tells me when the washing machine has finished, how long it took and how much energy it used. It’s very useful to me, also because it sets a periodic reminder to unload the washing machine. Just by using a zigbee smart outlet.
Same. Seriously.
Except my plug is Matter over Thread.
I used to have the same for the dishwasher, but then I got one that opens its door automatically at the end of the cycle, so human intervention was less necessary. And I’ve got a timer that shuts off power to my “smart” tv after 30 minutes of inactivity because fuck letting it use 25W continuously.
To add to it, I like to know water and electricity usage stats from my dishwasher, it’s semi interesting. But generally I use the buttons on the thing.
Washing machine is easier to use via the app because it’s stupid in on device controls
So you are telling me it is enshittified to the point it’s unusable without the app that collects and sells all you data?
Yup, very happy with my purchase…
/s (in case it’s not obvious 😔)
Oh boy do I feel hate right now
Same with my dishwasher; buttons on it will work it but you need the app for more advanced features.
Well tbh give me a machine I can punch in the time it runs the water temp and the rpm and I am mostly fine. I mean there are some curves that could be nice in very specific use cases but eh
I’d like to know water and electricity usage too, but frankly, I’d rather have a separate smart flow meter and current sensor.
Oh, we know, because the thing shrieks until we open it. I can hear my neighbor’s washing machine beeping, they’re so loud here.
2010s - We made everything smart, networked, and IOT!
2015-2025 - We need you to put your personal details into everything, everywhere, all the time!
2026-??? - We invented a machine that can hack everything on earth and steal all data for nefarious purposes.
Having fridges connected to the internet and getting them Hijacked is stupidity, not a cyberattack.
I can understand a lightweight IoT network to monitor temperatures and get alarms automatically. But why on earth would it allow controlling the fridge remotely?
Perhaps that’s how the fridge company keeps you paying for the service. Allowing you to set temps, time defrost is all operational. You can do power saving and make sure that defrosts only happen during the store’s downtime. You could also isolate a screwed up unit, have the store unstock it and shut it down until maintenance can come out to repair it.
You need that if you want to let managers remotely control settings via mobile apps.
Next time, the manufacturer will learn to use a local-only protocol like Matter.
It’s fucking stupid, you don’t use the manufacturer’s systems for that, or you’ll need one system for the fridges, one for the ovens, one for the lighting… You’re supposed to connect them all to YOUR control system, over isolated VLAN/LANs and then secure your system only.
Probably for some remote control BS. My wife was really keen on being able to set up þe slow cooker and turn it on remotely while she was at work. I don’t understand þe appeal, but I’ve stopped trying to guess at why stuff appeals to people.
Also, when I bought our last dishwasher it came wiþ some features I only got because þe model got good reviews and I couldn’t get a version wiþout þem. One of þe ones I þought would be useless was an interior light þat illuminates it when þe door is opened. A year in, it was my favorite feature, and next dishwasher I buy is going to have it too. But when I was shopping, I could have cared less. Turns out, I’m really bad at predicting what features I’m going to like.
oh thank god. My brain has finally started automatically turning the symbol into ‘th’. That took forever.
Nope, not for me. Still hurting my eyeballs and brain.
I just skip the rest of the post as soon as I hit one.
Anyone ever worked with management and chatted about security on this stuff, they never wanna know. They never want to pay, its a line item of risk that is just a problem to budget or deadlines…that’s a tier three wish list item that we can deal with later. Surprise it never happens.
Being a manager is an invisible job. When everything goes smooth then ‘that’s just how it’s supposed to go’. When things break or get hacked the manager looks like they aren’t doing enough. Meanwhile manager responsibilities cover an unreasonable amount of work and stack up fast.
Managers can be in a good place work wise and then get 1 phone call that ruins their schedule for the week. When it rains it pours because then employees call out, some employees can’t get along so you have to deal with their high school drama, then someone needs a report, then there was an inventory supply or a computer/accoubt isnt working etc etc etc. At some point the manager has to say ‘this isn’t my company and I’m not going to put in a bunch of unpaid overtime (your salary and only get paid 40 hours a week. Anything over is you working for free instead of enjoying your personal life) to fix this’.
Just like the people they manage, managers aren’t very incentivized to sign up for their own big projects that don’t require their immediate attention. Managers might get a bonus for a job well done at the end of the year but is it really a bonus if they worked a bunch of unpaid overtime all year? Feels more like a partial refund to pay some of that time back.
That was a rather cold move.
Hacks and attacks like this will explode with AI.
