A good article which covers a lot of aspects, including what happened technically, which software flaws were exploited, that the problem affected refrigerators which did not have updated firmware. It also mentions the EU cyber resiliency act, which has the specific goal to avoid such events.

Making industrial systems secure will be many years of work, since many are decades old and software and protocols were not designed with security in mind. This also affects consumer "smart home" systems and things like "smart TVs", which are often not designed to have needed updates.

Worth mentioning that the effects of systematic attacks could be far worse - they can take out electricity, energy, and water infrastructure, payment systems, and bring things like chemical plants into an catastrophically unsafe state. The thriller "Blackout - Tomorrow will be too late" by Marc Elsberg describes such a (fictional) scenario with hacks targeting smart meters and industrial control systems for power plants, and it is in parts more realistic than one would wish. IIRC there have been such hacks targeting the oil company Saudi Aramco.

you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 1 day ago (3 children)

Why on earth would one need to remotely change the temperature in a supermarket fridge anyway? In the 8 hours the store is closed, there is no reason one would need this, and their underpaid employees could just be sent if for some off the wall reason they needed to.

It's not the stores fault necessarily that they have internet fridges, because those are probably the only ones on market. Industry is forcing us into total surveillance.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 0 points 19 hours ago*

    These are not your average home fridges with a "smart screen". It's possibly a million euro industrial systems that are keeping thousands of euros worth of product safe (multiplied by the number of stores).

    It needs monitoring, alerting and the possibility to be updated, preferably by a trained professional.

    Can this be done simply and securely? 100% and its not even that hard... they fucked up.

  • source
  • parent
  • [–] 7 points 1 day ago (1 child)

    I wanted to argue "for monitoring reasons so that someone notices when the temperatures are rising and something might be defect". But then again you could just have a local sensor that reports to a server without the need for a remote connection TO the fridge...

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 22 hours ago

    @elvith @bedwyr the fridge itself has a lot of sensors and being able to read and aggregate the data they produce may lead to intervene before something breaks. But having them publicly available on the Internet is a very, very, very stupid thing.

  • source
  • parent