France's supermarket fridges were vulnerable online for months

US bases were also attacked remotely this year too, but yet this attack was still "unprecedented" to the upper management of these grocer chains. Smells like incompetence to me personally.

It's indeed Stockholm syndrome. It's (Ghidra decompiled) AArch32 firmware, but they define the datatype themselves with that name.

Reading the claroty article mentioning nginx, I think it's more likely that their decompiler is just setup to use windows semantics since that's probably a majority of what they analyze.

Iirc LPCTSTR is just an alias for const char* , lp being an anachromism of "long pointer" held over from the days when needing to do a distinction for "flat" 32bit pointers since there already was "near" and "far" pointers during the x86 16bit era.

This doesn’t require any fancy analysis. You can literally read the password off it — the last bit is an oddly decompiled string comparison.

The fact that Russia has access to LLMs that could decompile and explain this firmware ( and possibly even translate the explanation to Russian! ) is just another proof that this was definitely part of the hybrid war and Europe needs to spend a few more tens of billions on weapons and possibly impose restrictions on open weight LLMs.

I mean, given the context, I'm just as inclined to think this was thought of as a form of obfuscation

Most likely this is decompiled and not the way it was originally written.

The programmer probably wrote memcmp(pass, buf, 5) which compilers will often fold into an inlined loop, or a few comparisons if they know the 3rd arg.

The weird thing is it didn't emit a 32-bit load+compare for the first 4 bytes, this could probably be done with 2 comparsions. Idk. Maybe weird CPU with stricter alignment rules.

AI enabled hackers are going to break everything that’s connected to the internet forcing it to move in to the modern era.

Maybe AI will be able to give us a better FTP server in these industries

I am reminded of this every time I fly Southwest Airlines

Electricity companies should be 100% air-gapped from any internet connection, whether or not they have outdated software.

There is a very significant difference between _monitoring_ the equipment and _controlling_ the equipment. I get it why monitoring the equipment remotely provides a number of significant advantages, I'm in data analytics. I do not see how putting control systems online gains enough advantages to outweigh the risks. Fridges in a grocery stores is probably a weak example, but similar incidents with power systems, hospital/healthcare devices, and the like can actually endanger human lives.

There was far more serious incident very recently where hackers gained control or attempted to gain control of a propulsion system of an oil tanker. Resulting in a military operation to take it back. People need to start treating these risks more seriously.

Edit: Here's the link to the article:

https://news.ycombinator.com/item?id=49954466

It's not just about having tech inclined staff, but just the whole staffing strategy in general. Most grocery stores et. al. try to staff as cheaply as possible and try to have their workers do as much as possible during their shift. This means that there's no extra time available that they're not shelving products, or sitting at the register.

Rather than have extra staff at the store to do stuff like monitor fridge performance, it's better to have them report stuff centrally and have someone or some tool monitoring thousands of fridges across the entire chain. This way you can send out repair teams and plan maintenance more efficiently.

I'd be more worried about the site with one fridge cutting corners than the one with 50,000.

It's the complexity of the world which should drive you towards keeping this stuff offline.

Hell, I used to manage some VoIP switches which would hard-lock if you hit them with `nmap -A`. More people need to learn this lesson.

yes, but why do they need to be exposed to the internet?

I don't think the company which installed the fridges would be tech savvy enough for that nor the supermarkets

Not only that its a stupid game.

How can the market support so many sources all selling customer data ?

The price has to crash because of the inbalance of data vs customers.

Source they were selling this fridge data in real-time? Can you post a link where I can buy it?

What customer data is this even giving me? How do I get someone's personal information based on the temperature of the drinks fridge in Store #138 in Nantes?

Remote monitoring by itself is not a problem, but remote control is and has no benefits. You can't change the temperature of or defrost a freezer without removing everything from it, and if you can remove everything from it someone is already there the change the settings. And it takes extra work to enable remote controlling of a refrigerator system over just providing temperature readings.

And it still isn't going to save electricity. The only thing it can do is warn of a failure and tell you that you got like 20 minutes to start moving food before it has to be trashed for exceeding safe food handling temperatures.

Monitoring doesn't have to leave a way to enter the system automatically.

Alerts can be sent, and HVAC operators could have a process where they open a support ticket to get temporary access during scheduled windows by store managers.

I remember setting this up years ago for an hospital. Some third party suppliers could obtain RDP access to some VDI who could only accept a limited number of ips but they had to open a ticket and give a reason to get access. It wasn't a 365/24/7. Monitoring could still be sent any time.

> workers are not equipped to fix an HVAC system.

But they are perfectly capable of checking the temperature. After all the fridges and freezers are restocked multiple times a day so even if one failed it wouldn't have time to get warm before someone should notice.

Ad there are other ways of monitoring such as having an audible or visual alarm.

Somehow grocery stores existed long before we started even thinking about connecting everything to the Internet.

I wish I could upvote this comment more

good points and all the more reason to monitor in reliable, safe manner?

No one is saying anything against automation or monitoring per se. It's rather the idea to connect them to the Internet, that's highly questionable. They could be closed circuit streaming data into the back office of the grocery store and one look at a monitor would be enough to tell all is well. It doesn't have to be on the wide open Internet. And if somehow someone feels it must be visible online, then they can put a camera there to view the screen that shows the monitoring.

None of it requires connecting the very fridges to the Internet.

Well _obviously_ there were enough people willing to go into the trouble of doing that. Because someone(s) actually did.

I'm just saying it wasn't a high value target like a bank. Which is what they counted on.

It's a fridge. In a grocery store. You just get an employee to adjust the thermostat dial. How would the hackers demand payment if all you need to do is turn the dial back to "frozen"???

Edit: Yes i know the commercial fridges do not have "dials" and it's more involved. Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.

You can replace the PLC. It's not like a modern PLC couldn't be made to control a 1990s fridge. The question is "Who will pay for the upgrade". DanFoss sure as hell won't. The stores won't, because they've already paid for the fridge.

Honestly I feel like this should fall under a support contract. The pricing structure could be similar to that of Microsoft. Support is fairly cheap, X number of years included in the purchase price, once the product reaches EOL the price goes up dramatically each year.

There's a massive problem in how we think about these products collectively. They are inherently insecure, they will be attacked and preventing it is expensive. You could build a safer alternative, but you'd be priced out of the market instantly by less safe, but more convenient alternatives.

In that case you maybe shouldn't put them online protected by nothing but 30 year old security.

Why can't you support it that long?

"The PLC is fixed hardware, you can't simply patch that."

Oh yes you can patch it - that's how I got the 20 year old laminator working where I work. If the hardware is still good you can absolutely change firmware if you have the PLC control software (like RockWell ControlFlash) or know how to manipulate the ladder logic directly.

As someone who has worked with small and medium sized businesses, reasonable is extremely variable. I'm dealing with a small business right now that can't upgrade their perfectly good computers because of TPM issues. On one hand, I kind of get the reasoning behind it, but how can you hold a business of 10 people accountable for not knowing how to buy a computer that will be reasonably future proof? Every business needs IT on hand? I think that's asking too much. On the otherhand, you should know the tools you need to run your business. There's no fine line.

Insurance does actually tend to put cybersecurity requirements on to businesses they insure, the problem is that it's pretty hard to write cybersecurity requirements that actually result in secure IT systems as opposed to just a bunch of compliance work.

This will never fly. Some devices can be used for tens of years and they may face vulnerabilities that the hardware cannot support any kind of software fix for them. Imagine the world moves to TLS2 or whatever something new will be called and the hardware you have is too slow for it.

On the other hand, saying an industrial device should receive security updates for 10-15 years instead 5 or whatever happens this days it will be a major step forward. This will incentivise vendors to use better hardware with room to grow, not just the cheapest components possible.

Or, make componente modular so that you can upgrade just the control unit instead of the whole fridge or whatever.

There's something very wrong with the electrical grid if they need to stagger startups over all the shops combined. Staggering startup within a single shop can be done with a LAN.

Makes no difference. A super market should be able to air gap all their smart devices and include a non internet connected computer.

>Reduce power usage during peak electricity rates

This is the only one that requires remote write access, and only when "peak electricity rates" means a dynamic pricing system. But it doesn't actually need full Internet access. Instead, prices can be streamed via data diode to a local processor which calculates correct temperatures based on this information. This calculation should set reasonable limits on allowed temperature, so even if somebody sends false pricing information it's just going to waste some electricity and not destroy all the food.

>Optimize defrost cycles and compressor operation to save electricity

Assuming this means something different from "Reduce power usage during peak electricity rates", I don't see how it needs Internet access at all.

All the other points are monitoring tasks that can be done with read-only access via a separate data diode.

Remote diagnostics is the only one of these functions that can fairly be said to require an internet connection. There are many remote connectivity solutions for low bandwidth, low latency needs like these that pose nowhere near as much of a risk as an internet connection.

Even the remote diagnostics is of questionable value at best. You can do remote diagnostics just as well with a faxed printout of system information and having store staff do manual resets at needed. Remote diagnostics isn't going to solve anything that requires more than a reboot, like replacing a compressor coil, anyway, so you're going to need service staff driving to stores for these with or without the remote diagnostics.

The refrigeration business does not really overlap with infosec or IT in general.

You seem to set great store in your buns; take care, they may go bad

I read both. They seem related to me. They are both about supermarket fridges getting hacked over the internet.

I like similar articles' discussions to be linked together. I didn't see a link, so I added one. I don't see why I am getting all the angry downvotes.

Intermediate value theorem

Why is this flagged? HN sure loves to hide leftist violence. Very typical of the media landscape.