The intitial investigation is in.
In a “bizarre and unprecedented” cyber-attack, hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets pushing them from as low as -27C (-16.6F) to well over 50C (122F).
If shop managers first assumed it was an isolated failure, it soon became clear up to 700 stores – including those from the Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains along with a number of smaller independent shops – had been victims of a cyber-attack.
The hackers had pirated the controllers supplied by the Danish company Danfoss that controls the freezers and fridges. Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures. Initial investigations suggest the hackers disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours to avoid triggering alarms.
Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates or replace obsolete unsupported systems. The affected refrigeration units were “running outdated firmware”, it said. In the days following the first wave of attacks, France’s cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.
Would it be a good idea to make sure not all of these machines have a single point of failure as well
Like. Could they perhaps spread several nodes (and I mean, physically even) that maintain a smaller group? So even if one is accessed it would be say, 150 stores, not 700. Still horrible, but like. Not as bad as 700.
I know most supermarkets have this one central hub that manages these things and this made me realize that this can happen to every single one of these chains.
or replace obsolete unsupported systems
Company expects you to replace perflectly working appliance because they can’t be bothered with supporting it after an arbitrary amount of time. So typical
True. But I’d still have them on my VPN and not internet accessible. Still not bulletproof, but much better.
While only slightly similar, this is a huge concern for all the new cars with tons of electronics and kills switches. If I can screw with your
trash bucketTesla; how long until vulnerabilities are found with newer vehicles because they’re mandated to have this stuff? I get this is a mostly US issue but something tells me this will spread.Hacked? This term applied to this is an insult. The user name was “admin”, and the password changed daily - it was the current date.
This is not hacking, this is a complete and utter failure on behalf of the company who set this up, and their fault entirely.
Password changed daily
Wow, that’s crazy security practice!
it was the current date
Oh…
// TODO: Change this to a time based crypto key deriving algo before release
char *passwd = curr_date
Do you have a source on this? The other article I had seen on this said the password changed daily and was algorithmically based on the date. So if someone analyzed past passwords they could derive future passwords, but not that it was literally the date.
https://cyberplace.social/@GossiTheDog/117429502412235079
https://ironhackers.es/en/danfoss-ak-sm-800a-cve-2025-41450/
The “code of the day”
Many industrial devices include a service access so the vendor’s technician can get in without the customer’s password. A classic —and dangerous— way to implement it is the code of the day: a code that changes every day according to a formula that, in theory, only the vendor knows.
The problem shows up when that “secret formula” is the only thing protecting access (security by obscurity) and it can also be recovered from the firmware itself. That is exactly what happens here: sm_app ships unobfuscated, with function and variable names in plain sight. The one that validates the code is called, literally, check_code_of_day.
‘date+123’ would be an algorithm based on the date. Given non techie users, it was probably something like that.
It’s not even social engineering.
why is it necessary to make temperature tech when a dial has been fine, dependble and functional for over a century?
Don’t connect your critical appliances to the internet…
Some fun reading for anyone interested https://cyberplace.social/@GossiTheDog/117429502412235079
Wow. Shit like that makes me think we all fucked up by not having licensing or certification for software engineers like we have with civil engineers. They’ve got a lot a lot of balls claiming they were “hacked” when every unit had the same easily guessable credentials.
Good point. It‘s bit like saying someone broke in when you let the door open. Here I suspected someone in this story used AI and that was the problem but no. They were just recklessly clumsy.
But the door was locked! I locked it real good! They broke in, I was robbed!
Oh, the key? I keep that well secured under the doormat. Also all the houses use the same key so they don’t get mixed up, pretty convinient eh?
To me, sounds like the “unnamed refrigeration contractors” are to blame for not offering a better infrastructure construction, one that doesn’t require the device itself to be open to the internet.
Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures.
Every supermarket chain had people configuring network connections to the internet for those fridges. Every chain fucked this up themselves.
Why do you need a web enabled fridge/freezer? I want a SNMP/Trap (one way, exit only) alarm when temp is getting near outside the “safe zone”. One way, I set the numbers local, can’t be changed otherwise.
Its simple (as am I), why does it need to be on the “cloud”??? AM I TAKING CRAZY PILLS?
One way, I set the numbers local, can’t be changed otherwise.
Its simple (as am I), why does it need to be on the “cloud”???
That’s fine when you have one fridge.
Then you need to look after four thousand of them.
Oh, it’ll be fine, we’ll just set things once while installing them.
Oh look! New food, or efficiency, or store standards have dropped, now you need to update those settings in those 4 thousand fridges spread across the whole country. Well, we can do a couple of stores a day, I guess it’ll only take a month of a service tech’s time and travel costs to do it.
Orrrrrrr… we could hook these fridges up to the Internet and do it remotely, and update the settings on those 4000 fridges before lunch.
That’s the draw, convenient mass update. The main issue here is that they put the fridges on an unsecured network, and then on device auth was laughable, allowing any bored teenager with time on their hands to tinker with things.
Orrrrrrr… we could do it the ole fashion way and not add a layer(s) of failure and send out a email… Don’t need security w/ a thermometer and a knob.
I like my version better, simple.
And be real, there is no ZOMG moment in food safety that requires a mass temp change ASAP. Freezers are below freezing and refers have been set to the same temp for 50+ years.
Companies are impressed by developers that only know how to build pretty dashboards by just installing every npm package under the sun, opening all of the ports on everything, and requiring a connection to the cloud to make their front-end work. There may even be someone working for the company that explains the problems, but those people get ignored.
AI is just making this mentality worse.
Dead on perspective.
I’ve worked for that company, it was all “we can react in a moments notice on our smart phones” and other BS.
Then we got a real customer, the first thing out of their mouth was "what happens if a bad player gets access to one of those “smart” phones?
*crickets
I was there for sales support. aka a data center monkey (engineer), I was there to answer “can we do that?” from sales.
So blank stares follow from sales, sales looks at me to answer. I have been bitching that this is YUGE security hole for the last 2 years and I can’t answer w/o making the company look bad.
Then I realize why I’m there, I’m the escape goat (scapegoat). I sputter we are all patched up to the latest, we follow the tech bulletins (aka we are reactionary NOT proactive, no TQL another thing I bitched about). I’m trying to defend the undefendable, I wanted a walled system. You have to VPN in to see anything, no smart devices, not “lets everyone have access system” party.
The sale tanked, I got blamed, I said GFY and quit. Got another gig but played dumb as it was easier day to day to let another chump like me learn a lesson. Take the pay check and go home.
Now I live by: “Not my monkeys, not my circus”
And don’t get me going on Grafana… Let “church” up and make pretty data w/ another layer of M&C I have to set parameters too for the bosses to “oh ahh” over for some stuff shirt middle manager in a corn blue tie…
So you can see why I hate “smart” anything.
Management wanted a killswitch they could control. Then they lost control.
This is one of those moments, like buying a new car that all the “bells"and whistles” in the end work against you.
“The things you own end up owning you.”
-T Durden
I’m going thru this right now. I spent most of my life being able to move in 24 hours. Now I have to plan, I have to check local laws, I feel a slave to things I “own”. Point is the same w/ this. Your unnecessary web enabled device “own” them too.
More likely they wanted a system that collects fridge temps and setpoint to a central database for so they can document compliance to food inspection authorities.
That’s too reasonable, not newsworthy.
Hacked? This term applied to this is an insult. The user name was “admin”, and the password changed daily - it was the current date.
This is not hacking, this is a complete and utter failure on behalf of the company who set this up, and their fault entirely.
Russia
deleted by creator
