you are viewing a single comment's thread
view the rest of the comments
[–] 10 points 8 hours ago (12 children)
  • [–] 5 points 6 hours ago*

    Because people are f***ing idiots.

    Getting a remotely accessible freezer sounds dumb, but you can save money because now you don't need to pay someone to check and document the temperature for compliance reasons anymore.

    Not securing that device at all sounds really stupid, but it saves you money to not pay someone to actually set the devices up properly. Bonus points: anyone even midly competent would have told you that remote control instead of just read access for temperature logging is incredible stupid. And then you would need to spend money on better devices after already having paid someone for competent advice. Better save that money.

    Speaking of mildly competent people you don't want to pay... They would also have told you beforehand that a limited time-frame in which you still get security patches for your devices is a stupid idea, too. But hey... buying the product with only 10 years or so guaranteed support saves you –again– money today.

    And let's be honest. After your device reached EOL you are not actually replacing it anyway. You didn't care about basic security before, so what's the problem now with unpatched devices not getting any support anymore? After all they still cool things without costing any additional money...

    Wow... look at all the savings. That will totally get you a bonus. One you will definitely not need to pay back after everything went to shit because you are an idiot.

  • source
  • parent
  • [–] 10 points 8 hours ago*

    Because someone was stupid enough to think that having a remotely controllable defrost/disinfect feature on a medical grade freezer was a good idea.

    Then someone was stupid enough to think that buying such equipment was a good idea.

    Then someone was stupid enough to think that connecting those freezers to a network was a good idea.

    Levels after levels of criminally stupid decisions.

  • source
  • parent
  • [–] 7 points 8 hours ago (8 children)

    Modern warfare. Russia is probably behind it. They recently did the same to supermarket freezers in Sweden

  • source
  • parent
  • hideshow 8 child comments
  • [–] 7 points 8 hours ago (3 children)

    Russian hackers or even Russia as a country could be behind it, but also, as security on these devices is apparently an afterthought at best, it could be Lars from Stockholm or Marie from some small french village.

    But it doesn't really matter. The real question is that who the fuck connected these things to the public internet in the first place. Also one should ask why these were still on the internet even if every news outlet covered the previous attacks and why management didn't bother to get off their arse and at least ask from some IT person if their fundamentally unsecure things are still connected.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 1 hour ago (1 child)

    I think putting all the blame on the lax security isn't okay. There are shitty people doing shitty things, and they should be punished for it. And the people who are implementing lax security should also be punished.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 13 minutes ago

    Oh, yeah, obviously. Causing financial or other harm just for the kicks of it should absolutely be punished. But specially in this case where there's medical stuff around the real question isn't really who 'hacked' in with a default password or something trivial but how the management can be so incompetent that they let this happen. All kinds of security breaches happen every day, but rarely on this scale and especially not after the known 'exploit' has been all around the news for days.

    Compare this to the chaos everyone had just a while ago with PHP. Everyone patched systems, kept their services down until fixes were available and so on. This should've caused similar effect, but apparently people in charge were just 'meh' and left the doors unlocked anyways.

  • source
  • parent
  • [–] 7 points 8 hours ago

    The real question is that who the fuck connected these things to the public internet in the first place.

    Honestly, I didn't care when a few supermarkets got hit by their own stupidity. That our blood conserves are handled with the same care as fucking frozen shrimps is just horrifying.

  • source
  • parent
  • [–] 4 points 7 hours ago*

    Atrributing this kind of damage on systems that are plainly evident on shodan with a well known secret to state sponsored malicious actors is giving them way too much credit. This could be a 10 year old with a shell script and VPN.

    When it comes out that all these networks are deeply compromised as a result of easy lateral movement from the freezer to the domain controller, then I’ll agree it’s possibly state sponsored.

  • source
  • parent