Hackers have forced the temperature of many French supermarket fridges up to 50C overnight, in an “unprecedented” cyber-attack affecting several hundred stores across the country, with fires and food losses reported.
The Paris prosecutor’s office said on Monday the large-scale attack was “affecting connected refrigerators in several major food retailers across France”. Reported damage included “food losses and fires”, it added.
The prime minister, Sébastien Lecornu, instructed France’s national cybersecurity agency ANSSI to investigate, a person in his office said.
France “was coordinating with its European counterparts, as other countries may also be affected”, while also investigating whether any other French firms were at risk, they said.
Username was admin, password automatically changed to the current date. Not so much a hack as bad cybersecurity. They were warned not expose the management interface to the internet. Vendor did a bad job, left the key under the mat.
Stunt totally backfires when it turns all the milk into cheese.
Why are refrigerators Internet connected?
Probably so it can store the MAC addresses of every device near it and send them home so the manufacturer can sell that info to data brokers for fingerprinting purposes tbh
Remote monitoring for equipment health. A data logger for maintenance is reasonable.
Why they would have anything other than local control over temperature is the questionable part.
Well, the temperature control and the remote monitored variables probably aren’t air-gapped. So if you gain access to the remote monitoring, you’re already in the system, from where you can attack the rest of the system. Ofcourse you could design the system so that there’s no link between the monitored stuff and the rest, but then you’d need extra components so there’s a financial driver not to do this if you build this kind of equipment.
Edit: this is all assuming that the system isn’t by design remote controllable, and my guess would be that it probably is. It allows equipment builders/suppliers to help their customers with “remote troubleshooting”.
The article said the defrost cycle was trigged which is what heated the fidges to 50C (I was a bit confused at first as to how they could make them heat up past room temp).
I can imagine use cases for remotely controlling the settings in all the fridges across your hundreds of stores, but I suspect there might be a bit more hesitancy to buy the remotely controlled fridges now.
What I want to know is what kind of refrigerator can even achieve 50c?
They often have pretty powerful heaters for defrosting, even your household fridge has a heating coil tucked inside somewhere: Ice takes a lot of energy to melt quickly, and refrigerators are very well insulated so once they’re heating up there’s nowhere else for the heat to go. Refrigeration (using phase change) is paradoxically much more energy efficient than electric resistance heat (which is what is usually used for defrosters, because of cost minimization) so it’s not uncommon for the defrost heater to be significantly more powerful than the whole refrigeration side, because the defrost heater is only intended for very occasional use to literally de-frost the coils before turning off again. In this case, it sounds like the de-frost heater was used repeatedly or indefinitely and the cooling shut off.
We need more smart devices…
