Fucking evil
Context: “France’s Health Ministry said staff detected the abnormal temperatures in time and that the incident caused no operational consequences.”
So while this was a serious incident, controls did actually work. The comments here read as if no one is aware of that.
Comment first. Open link maybe. Actually read the article hardly ever.
What a douche move mr.hacker
Yeah I wonder if all the little psychos here will celebrate this like they have been celebrating the obscene waste of food resulting from similar hacks on grocery stores.
This was very likely no mr.hacker but Russian hybrud warfare. Causing deaths is the goal.
So, who’s the idiot we have to thank for exposing a system to the internet that manages life saving medical supplies.
I mean, Jesus %+^%! Christ, the managers responsible should be tried and jailed for this gross incompetence.
This makes my blood boil.
Get out.
Only a cold blooded monster would do this
Coldblood horses are pretty cool to be honest. Chunky friendly beasts.
Chill down dude…
Don’t connect your freezers to the internet, or at least make it read only. At this point, any company that hasn’t taken appropriate measures after it’s happened a few times in a month should be held liable.
I know several Danish municipalities centrally control radiator thermostats in their buildings. Schools are gonna have a wild ride this winter
No, don’t even connect it. There will be bugs and you won’t be able to fix them.
But it’s important to connect them to the Internet, so that they can receive security updates…! 😅
If you design them so that the temp control is not in software you should be fine.
Don’t even buy a freezer that has a remote control. Especially not for freezing life critical supplies.
Read only remote access is useful for life critical supplies. You want to know, as soon as possible if your blood has gone out of safe storage temperatures, and for how long. It would let you save the supplies by moving them to a new freezer.
The problem is remote temperature control. That bit should be air gapped, unless you have a very good reason to need to adjust it remotely.
I’m not against remote monitoring. But remote controls are just fucking stupid in a freezer. Pretty much any temperature change needs someone on site anyway in order to move the freezer’s contents someplace else beforehand. Keeping temperature constant can be accomplished via a simple thermostat. If you really need some sort of cycle that changes temperature over time, the controller doing that can be purely off line as well. Anything that allows remote control endangersvthe contents of your freezer.
I mostly agree. I can think of a few niche uses for it. However, they are very uncommon. E.g. bringing a freezer of blood up from “deep storage” temperatures to “ready to use in a hurry”.
I can also think of a few more where a “boost mode” could be useful e.g. a supermarket that knows there is a heat wave. Over-chilling the freezers would let them cope better with the temperature spike later in the day.
Critically, these should still be within safe hard limits. The fact that hackers could effectively switch them off in mass is the huge issue.
Seems logical, but there’s a valid reason why these fridges are connected, at least for reading data (not so much for controlling).
European law dictates that things that can spoil due to heat must be stored at the right temperature. And therefore you must register the temperatures of each refrigerator at each moment to have a valid proof of compliance.
A simple supermarkt already has 50 or so appliances. And supermarkets are usually chains with hundreds of stores. So you can imagine the need of having to monitor temperatures centrally. I can imagine that for medical use, the rules are even stricter.
Put the temp sensor on a separate system from the controls
100% this. I work in pharma, that’s how we do it. You would use a separate system for monitoring - the plus side being is that monitoring would likely use a thermocouple which should give you better accuracy. Having an independent system also means that you can move the temperature monitoring device to wherever the “hot spot” in your freezer is based on the mapping that you should be doing.
This. Why the hell would you need to change the setting remotely?
Temperature policy changes? So you don’t have to send a tech to each location.
Then you get what we have here. Shouldnt there be an employee at each location with a button pushing finger?
How would it adjust the temp to fix it than?
You walk over to it and make the change?
How often do these freezers need changing of temperature? My guess would be at most a handful of times a year.
Amd if the controls aren’t remotely connected you don’t have to worry about this type of issue.
So you pay to have someone stand around staring at a temp gauge all day? Yeah…. Sure buddy.
And a delivery of new food, temp changes. Someone leaves a door open too long, run a chill cycle. That’s why the is stuff is automated. It’s so random. The temp and fan settings are changed probably a dozen times an hour. If it’s not, spoilage will happen.
But that automation is so simple, it doesn’t need to connect to an external system. You set the target temperature once and the system regulates the cooling. No person needed, neither remote or in front of the thing.
And temperature sensors are cheap. Just have one for the regulation, and a separate one for remote monitoring.
The whole point was keeping the temperature sensor readable remotely so that you didn’t have to pay someone to stand around all day.
Absolute worst case, add a second temp sensor for the automated chill cycles. Pretty sure temperature sensors aren’t that expensive.
air gapping is a pretty standard practice in pharma IT systems. Its probably not super feasible for a supermarket chain but their problems are not as severe. A fridge with sensors but no remote controls would be plenty sufficient for the purpose of ‘prove we kept steak cool until we sold it’.
Also don’t make freezers that can be set for 110 degrees.
IIRC they are locking them into a defrost cycle that would normally heat up the coils for a minute or two, just long enough to melt the frost.
That still seems like a design flaw. A simple thermostat would cut the heater off past the right defrost temperature and would have prevented this.
But it probably added a couple Euros to the price so they didn’t do it
It happens because there is a need for a lot of things like this to have a reliable full chain of Providence for frozen food etc. it’s not enough to just accept “looks frozen to me” at the time you receive something from your supplier, you need to have access and logs and legal documentation to ensure the temperature has stayed frozen the entire time, else you might be giving thousands of people food poisoning
For that, all you need is temperature sensors. No remote control necessary.
Fair point but does controlling the actual temperature need to come into play in these cases? I guess it wasn’t an issue before so it was just a feature to add easily and all that.
Sure, but you already likely have at least somewhat secured network around for all the other stuff you do and a computer to store those logs, no need to go trough the public internet for that data. Unless that’s some cloud based service too, in which case leaving the devices open like that is even more reckless than having Joe the delivery guy plugging the cables in after hauling that fridge up to 3rd floor.
How the FUCK do you get above boiling temps in a freezer with no additional hardware?
It is the selected temperature to maintain as much as it can. It can only freeze therefore it will just stop working and the temperature will rise to room temperature. If the room would be on fire it would possibly turn on the freezer before it would burn to maintain this healthy 100°C.
People should learn to not put things on the open Internet and how a thermostat works. When you have AC and you will set your thermostat to 17°C it is dumb if you really just want 21°C. It will not cool air any faster and it will overshoot if it can and if it is not able to reach 21°C it will not reach it if you set 17°C either.
Wow. Thats actually fucking evil
Using remotely controllable freezers for storing life saving supplies is indeed evil. Nobody can be so dumb, that must be malice.
Nobody can be so dumb
Have you not met average humans?
It gets worse once you realize that in most cases you heard of in the last weeks there was no actual hack to speak of involved (although a lot of them were unpatched EOL devices, too), but just accessing them with the default password.
So having remotely controllable freezers in the first place isn’t even the beginning of the stupidity involved. They are also often completely unsecured and nobody cares.
Default password kind of indicates that they have not changed the password of the device they put on the internet. Whats actually going on is that someone reverse engineered the firmware, and figured out that the manufaturer has added an extra hidden password that can be calculated from todays date.
What we really need to do is legislate this into our banking apps.
- politicians the world over
I was speaking more broadly about “most cases you heard of in the last weeks”… Yes, in some case it might have been actual hacks involved because basic security was adequate, which also included noticing the issue in time to prevent actual consequences in this specific case.
You’d think people would have more care for critical stuff like blood supply.
Have they considered turning the Wi-Fi off?
Hey! I got a new radiator for my car! These come with ethernet port! See, the way it works is you install the app…yada yada yada…the IP protocol is secure and encrypted and not training AI in the engine thermal design of automobiles for my specific region and then you just crank the engine and the whole thing works!
Why
Modern warfare. Russia is probably behind it. They recently did the same to supermarket freezers in Sweden
wasnt it france a few weeks ago.
I think the question is rather: why the fuck would you connect these things to the internet?
There we go. Why is this possible at all, in any sense
Russian hackers or even Russia as a country could be behind it, but also, as security on these devices is apparently an afterthought at best, it could be Lars from Stockholm or Marie from some small french village.
But it doesn’t really matter. The real question is that who the fuck connected these things to the public internet in the first place. Also one should ask why these were still on the internet even if every news outlet covered the previous attacks and why management didn’t bother to get off their arse and at least ask from some IT person if their fundamentally unsecure things are still connected.
The recent attack in Sweden, was small supermarket stores - Which doesn’t have the resources/knowledge to fix their issue. Given ICA is a franchise model, the main IP holder should however extend this knowledge to all of their franchise takers imo
Of course they do. They need networking for payment processing, orders, finance tracking, surveillance camers and all the other stuff and they hired someone to set up those as well. Sure, they don’t have dedicated IT person in house, but they don’t have plumber or electrician either.
I think putting all the blame on the lax security isn’t okay. There are shitty people doing shitty things, and they should be punished for it. And the people who are implementing lax security should also be punished.
Oh, yeah, obviously. Causing financial or other harm just for the kicks of it should absolutely be punished. But specially in this case where there’s medical stuff around the real question isn’t really who ‘hacked’ in with a default password or something trivial but how the management can be so incompetent that they let this happen. All kinds of security breaches happen every day, but rarely on this scale and especially not after the known ‘exploit’ has been all around the news for days.
Compare this to the chaos everyone had just a while ago with PHP. Everyone patched systems, kept their services down until fixes were available and so on. This should’ve caused similar effect, but apparently people in charge were just ‘meh’ and left the doors unlocked anyways.
The real question is that who the fuck connected these things to the public internet in the first place.
Honestly, I didn’t care when a few supermarkets got hit by their own stupidity. That our blood conserves are handled with the same care as fucking frozen shrimps is just horrifying.
Atrributing this kind of damage on systems that are plainly evident on shodan with a well known secret to state sponsored malicious actors is giving them way too much credit. This could be a 10 year old with a shell script and VPN.
When it comes out that all these networks are deeply compromised as a result of easy lateral movement from the freezer to the domain controller, then I’ll agree it’s possibly state sponsored.
Putin’s Razor: Never attribute to self-own that which could easily be blamed on Russia.
Next it’ll be fridges falling out of windows by accident.
Ok. Maybe all that is true, but also this is not a thing that should be possible and blaming other people for your utter lack of care or planning is not really something you get to do.
Because people are f***ing idiots.
Getting a remotely accessible freezer sounds dumb, but you can save money because now you don’t need to pay someone to check and document the temperature for compliance reasons anymore.
Not securing that device at all sounds really stupid, but it saves you money to not pay someone to actually set the devices up properly. Bonus points: anyone even midly competent would have told you that remote control instead of just read access for temperature logging is incredible stupid. And then you would need to spend money on better devices after already having paid someone for competent advice. Better save that money.
Speaking of mildly competent people you don’t want to pay… They would also have told you beforehand that a limited time-frame in which you still get security patches for your devices is a stupid idea, too. But hey… buying the product with only 10 years or so guaranteed support saves you –again– money today.
And let’s be honest. After your device reached EOL you are not actually replacing it anyway. You didn’t care about basic security before, so what’s the problem now with unpatched devices not getting any support anymore? After all they still cool things without costing any additional money…
Wow… look at all the savings. That will totally get you a bonus. One you will definitely not need to pay back after everything went to shit because you are an idiot.
Because someone was stupid enough to think that having a remotely controllable defrost/disinfect feature on a medical grade freezer was a good idea.
Then someone was stupid enough to think that buying such equipment was a good idea.
Then someone was stupid enough to think that connecting those freezers to a network was a good idea.
Levels after levels of criminally stupid decisions.
The average person is completely oblivious when it comes to computer security
Let me guess: The freezer was using Danfoss hardware with a default password?
Every type o’ negative Nancy will be positive that connecting your fridge to the net is a negative
Who ever came back to check and see must have gotten a fever of a hundred and three!
