A good article which covers a lot of aspects, including what happened technically, which software flaws were exploited, that the problem affected refrigerators which did not have updated firmware. It also mentions the EU cyber resiliency act, which has the specific goal to avoid such events.

Making industrial systems secure will be many years of work, since many are decades old and software and protocols were not designed with security in mind. This also affects consumer "smart home" systems and things like "smart TVs", which are often not designed to have needed updates.

Worth mentioning that the effects of systematic attacks could be far worse - they can take out electricity, energy, and water infrastructure, payment systems, and bring things like chemical plants into an catastrophically unsafe state. The thriller "Blackout - Tomorrow will be too late" by Marc Elsberg describes such a (fictional) scenario with hacks targeting smart meters and industrial control systems for power plants, and it is in parts more realistic than one would wish. IIRC there have been such hacks targeting the oil company Saudi Aramco.

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 1 day ago (2 children)

Help me with that: I'm self hosting lots of stuff and half the point of it is, that I can use it from anywhere. With reasonable encryption and mTLS where possible, that seems pretty straight forward and manageable.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 20 hours ago*

    ... where possible, ...

    So these fridges where possibly one of those exceptions and look where that ended up. :-(

    mTLS is an excellent choice since it stops an attacker at a much lower level, but its not the only one if your service wont allow it. Tried and true VPNs like wireguard , IPSEC or openVPN should be put in front of any WebGUI, HTTP(S)-API, telnet or other high risk services if you cant do mTLS.

  • source
  • parent
  • [–] 4 points 1 day ago

    If you know what you are doing, there is nothing wrong with it. But the first question you should ask yourself before talking about methods is "Do I need to use this functionality remotely?" If the answer is yes, then know your shit and keep your software up to date. In this case the company misanswered the question and they kept their software insecure.

  • source
  • parent