So I worked for a company who's product was sensor networks for this exact situation, and the European company who bought us had a cloud-only solution they wanted to replace our on-premise product with. Thankfully most hospitals and research institutions in the states are smart enough to reject cloud-based solutions for this exact reason. In theory you could penetrate our systems but it would have to be a very direct, specific attack to be able to do it. My colleague in Germany has been an SWE contractor since 1978 and is genuinely the best engineer I've ever worked with. No matter how off the wall my ideas were he'd already considered it and eliminated it as an option.
Yes, especially after this has now been happening again and again. First case can be excused as usual bad practices and lazyness. But it should have been a wake up call causing anyone else operating commercial freezers (or even other equipment) to review if/how they are connected to the Internet. Anyone getting hit now is maliciously incompetent.
Its probably a state actor like the Russians who are having wave after wave of foreign built and powered drones hit their infrastructure. Which in their minds where they're not the aggressors somehow makes it a legitimate target, I guess.
Not only freezers, but a lot of other appliances have become IoT-integrated to simplify inspection procedures. Instead of the health department looking at each freezer/smoke detector/gas detector/emergency floodlight individually, you can just present them with a report from your building's safety system. Older systems were mostly some industrial bus and are off-grid by default, but new ones are usually smarter, and as a result, IP-connected.
You probably need admin/write concepts in order to change users, rotate keys, allow/disallow IP ranges, network setup, etc....
Still totally agree that there should be guardrails around the core functionality but it's easy to imagine that the thermostat would be something one would expect to be able to control once you implement all this remote functionality.
They could, but the person who's actually making the decision on which vendor to go with will most likely choose the ones that allow for remote management because they think it'll allow them to cut staffing
In the end the market will optimise for that guy's opinion, not the optimal solution
This is easily fixed with data diodes. I can see future industrial appliances and other critical IoT devices with embedded units. You use the read/write port for initial configuration then the diode for permanent monitoring, making it physical impossible to send data to the equipment.
And if you need to alter the initial settings, you do what? Also, your solution is negating one of the biggest benefits of remote control: less errors from tech on the ground.
If I have to enable a privileged operation (like enable container support), I have to change a device-mode flag. To confirm it, I have to either physically push the Reset button on the device or pull the power from it physically within a set window of time.
Push the setting to the freezer but require a physical button press/power control action from someone locally to confirm the new setting change.
Have a big pop-up message on the HMI that says "TEMP CHANGE REQUEST: CURRENTLY 0C, REQUESTED 66C - OK?" so someone can yelp and go This doesn't look right! and call in the experts for help.
Is it perfect? No. Could it be feasible for some applications? Yes.
I imagine that, unfortunately, a lot are, but others might lack things like MFA at their trust boundaries
IT security is a pretty complex topic and a lot of businesses don't have the knowledge in-house to access the security of their own infrastructure
If you have no-one to actually patch your devices and architect your infrastructure, you'll probably end up with just asking the "geeky" student assistant to get it sorted. They'll throw it on the office WiFi, set the same user+password on all the devices and call it a day
In my experience, the vast majority of orgs have essentially no IT security
The advent of AI and its ability to find vulnerabilities so quickly is getting out of hand. Yesterday it was supermarket fridges now its fridges that store blood, they should never have been connected to the internet in the first place especially in these times with AI, but all of Europe needs to invest more into their cyber security systems they are anachronistic at this point.
It is hard to wrap your head around a freezer reaching EOL due to no longer providing firmware updates though. I can absolutely understand why you'd have a hard time convincing a manager that you need to spend money to replace a "perfectly good" freezer just because the vendor no longer provides firmware security updates.
I agree that it's a manager failure in part, but I also think it's a failure on part of the industry to not demand longer term support for this type of product, and also on part of regulators for not realizing the vulnerability of the situation (though the EU Cyber Resilience Act seems an acceptable first stab at remedying this).
So, the people in charge are either inept or just sleeping on the job especially for things that are so important to people's lives. cause it seems like everyday something else is getting hacked or exploited because of its vulnerabilities.
can someone please explain how they can heat the blood I understand they can stop the freezing but you cannot set the temperature of a refrigerator to a point where it literally heats the stuff inside since a refrigerator do not have the mean to warm objects inside it can only remove the heat.
Basically understand that fridges and freezers work by making a surface, heat exchanger or some type of pipe cold. Being cold leads to moisture in ambient air condensing on that. And being usually below freezing to icing on it. Ice is not very good heat conductor. So you want occasionally get rid of it. Easiest way to achieve this is heating it. Simple resistive heaters are cheap and maluable for this.
Now if you can control these heaters you can pump up the temperature to quite high. And I imagine with certain uses cases actually emptying the whole thing heating it up to melt ice and then bringing temp back down is not that unreasonable process. Also allows keeping the temperature in very close range. For home appliances bit more temperature variation is acceptable.
Maybe it could be combined with thermostats? E.g. one for "if it ever gets hotter than N degrees, disconnect all heating elements and trigger some alarm", another one for "if it's warmer than X for longer than Y minutes, do the same". That could also be to the network, too, it just would never read from it, or from anything electronically. Just bimetals closing or opening circuits, basically. How expensive would that even be? (If you planned for it from day 1 of the design I mean, not retrofitting things)
The first time we found a provable case of malicious hacking, whether by individuals or nation-states, the result should have been the termination of that entity. Nothing says "stay out of my network" like a bloody head on a fencepost.
Yes, but not in the same way The Onion (or its French counter part Le Gorafi) are satirical.
Le Canard enchainé makes fun of people and institutions, but never makes stuff up, and are arguably more rigorous than most mainstream media outlet. They have a long history of exposing real scandals, albeit with a tongue-in-cheek manner.
Nope. It's a serious newspaper reporting on serious news. Usually with a vitriolic tone and wordplay, but it's absolutely not a satirical newspaper like the onion (the french equivalent would be le gorafi).
Maybe they do but if you make allegations like this why not support them with evidence? That would put to rest any possible suggestion by folk who see ulterior motives in everything, that maybe you object to the Telegraph in general. No reason to suppose you do but that's how it is.
The way I understand it, and someone please correct me if I’m wrong. Whoever hacked the devices send a command to increase temp to 110, but it never reached that number, instead it just reached the max. But the news story still reports it as if the blood literally started to boil to 110c
Check out /r/NotMyJob/. You can lose faith in employees, and humanity in general, one video at a time. All it takes is few people who DGAF and security issues won't ever be detected, to say nothing about addressing them.
we are a few attacks like this from a country interpreting it as a declaration of war. I have no doubts a developed country counter-intelligence cell can find which country is responsible for such a large scale attack. I wish they target countries like China instead of spineless france.
The EU will release a statement where they claim to be very concerned. Then maybe write an additional 1200 page regulation on industrial refrigeration that will fix the problem by making impossible to legally refrigerate anything. The usual.
Closer to the source than an English newspaper:
* https://lecanardenchaine.fr/police-justice/55332-les-hackers...
Fridges shouldn't be on the internet, doubly so when it's one storing vital medical supplies.
So I worked for a company who's product was sensor networks for this exact situation, and the European company who bought us had a cloud-only solution they wanted to replace our on-premise product with. Thankfully most hospitals and research institutions in the states are smart enough to reject cloud-based solutions for this exact reason. In theory you could penetrate our systems but it would have to be a very direct, specific attack to be able to do it. My colleague in Germany has been an SWE contractor since 1978 and is genuinely the best engineer I've ever worked with. No matter how off the wall my ideas were he'd already considered it and eliminated it as an option.
Or if you really really want to, make sure it’s just a read/view only architecture?
Yes
The heat/cold switch should be a physical switch.
Honestly, where's the excitement of having to cross velociraptor infested territory to reset the breakers if you can just remote in.
Yes, especially after this has now been happening again and again. First case can be excused as usual bad practices and lazyness. But it should have been a wake up call causing anyone else operating commercial freezers (or even other equipment) to review if/how they are connected to the Internet. Anyone getting hit now is maliciously incompetent.
Centralized monitoring of thousands of refrigerators makes sense but it should be read only.
Hard to imagine something more unethical than that.
Yeah. Whoever is responsible for this is sufficiently evil to warrant termination.
Its probably a state actor like the Russians who are having wave after wave of foreign built and powered drones hit their infrastructure. Which in their minds where they're not the aggressors somehow makes it a legitimate target, I guess.
There will be blood tonight!
-- Inigo Montoya, "The Princess Bride"
Not only freezers, but a lot of other appliances have become IoT-integrated to simplify inspection procedures. Instead of the health department looking at each freezer/smoke detector/gas detector/emergency floodlight individually, you can just present them with a report from your building's safety system. Older systems were mostly some industrial bus and are off-grid by default, but new ones are usually smarter, and as a result, IP-connected.
What remote control mechanisms do detectors needs? Can't they just be broadcast only devices?
You probably need admin/write concepts in order to change users, rotate keys, allow/disallow IP ranges, network setup, etc....
Still totally agree that there should be guardrails around the core functionality but it's easy to imagine that the thermostat would be something one would expect to be able to control once you implement all this remote functionality.
They could, but the person who's actually making the decision on which vendor to go with will most likely choose the ones that allow for remote management because they think it'll allow them to cut staffing
In the end the market will optimise for that guy's opinion, not the optimal solution
This is easily fixed with data diodes. I can see future industrial appliances and other critical IoT devices with embedded units. You use the read/write port for initial configuration then the diode for permanent monitoring, making it physical impossible to send data to the equipment.
And if you need to alter the initial settings, you do what? Also, your solution is negating one of the biggest benefits of remote control: less errors from tech on the ground.
A human makes the change locally. For example the manager in a grocery store.
Grocery chains are removing control from stores to HQ in all kinds of ways to cut cost, this is a symptom of that.
Something akin to Mikrotik's "device mode".
https://help.mikrotik.com/docs/spaces/ROS/pages/93749258/Dev...
If I have to enable a privileged operation (like enable container support), I have to change a device-mode flag. To confirm it, I have to either physically push the Reset button on the device or pull the power from it physically within a set window of time.
Push the setting to the freezer but require a physical button press/power control action from someone locally to confirm the new setting change.
Have a big pop-up message on the HMI that says "TEMP CHANGE REQUEST: CURRENTLY 0C, REQUESTED 66C - OK?" so someone can yelp and go This doesn't look right! and call in the experts for help.
Is it perfect? No. Could it be feasible for some applications? Yes.
Are these IoT devices actually directly on the internet, in the sense of exposing a port on a public IP address (perhaps behind NAT)?
Because you'd think it would work to just have them on a VPN, and then they aren't responsive to any non-authenticated internet traffic?
I imagine that, unfortunately, a lot are, but others might lack things like MFA at their trust boundaries
IT security is a pretty complex topic and a lot of businesses don't have the knowledge in-house to access the security of their own infrastructure
If you have no-one to actually patch your devices and architect your infrastructure, you'll probably end up with just asking the "geeky" student assistant to get it sorted. They'll throw it on the office WiFi, set the same user+password on all the devices and call it a day
In my experience, the vast majority of orgs have essentially no IT security
The advent of AI and its ability to find vulnerabilities so quickly is getting out of hand. Yesterday it was supermarket fridges now its fridges that store blood, they should never have been connected to the internet in the first place especially in these times with AI, but all of Europe needs to invest more into their cyber security systems they are anachronistic at this point.
> The advent of AI and its ability to find vulnerabilities so quickly
No AI needed. The supermarket controllers had software with guessable passwords and outdated nginx, both of which had patches out for a year.
Some hardware had reached end-of-live, and were never replaced.
All were connected directly on the internet instead of secure APNs or VPNs.
This is long-standing, basic management failure, and the fines should reflect that.
It is hard to wrap your head around a freezer reaching EOL due to no longer providing firmware updates though. I can absolutely understand why you'd have a hard time convincing a manager that you need to spend money to replace a "perfectly good" freezer just because the vendor no longer provides firmware security updates.
I agree that it's a manager failure in part, but I also think it's a failure on part of the industry to not demand longer term support for this type of product, and also on part of regulators for not realizing the vulnerability of the situation (though the EU Cyber Resilience Act seems an acceptable first stab at remedying this).
So, the people in charge are either inept or just sleeping on the job especially for things that are so important to people's lives. cause it seems like everyday something else is getting hacked or exploited because of its vulnerabilities.
Stop attaching everything to the internet...
can someone please explain how they can heat the blood I understand they can stop the freezing but you cannot set the temperature of a refrigerator to a point where it literally heats the stuff inside since a refrigerator do not have the mean to warm objects inside it can only remove the heat.
It's the defrost cycle.
Modern "frost-free" freezers have resistive heaters inside them.
Basically understand that fridges and freezers work by making a surface, heat exchanger or some type of pipe cold. Being cold leads to moisture in ambient air condensing on that. And being usually below freezing to icing on it. Ice is not very good heat conductor. So you want occasionally get rid of it. Easiest way to achieve this is heating it. Simple resistive heaters are cheap and maluable for this.
Now if you can control these heaters you can pump up the temperature to quite high. And I imagine with certain uses cases actually emptying the whole thing heating it up to melt ice and then bringing temp back down is not that unreasonable process. Also allows keeping the temperature in very close range. For home appliances bit more temperature variation is acceptable.
Maybe it could be combined with thermostats? E.g. one for "if it ever gets hotter than N degrees, disconnect all heating elements and trigger some alarm", another one for "if it's warmer than X for longer than Y minutes, do the same". That could also be to the network, too, it just would never read from it, or from anything electronically. Just bimetals closing or opening circuits, basically. How expensive would that even be? (If you planned for it from day 1 of the design I mean, not retrofitting things)
Seems like it's more of a walk in freezer situation and it can be controlled in either direction.
We need to have a French Revolution for hackers that do this. One clobbering, and they will think twice.
Agree. There should be a worldwide effort against them by all governments everywhere.
How low must one go to do such a thing as attacking a blood bank? Of course, some of these low people are also low life governments.
Only if you can find them. And only if they are in a country where you can get them.
We're 30-35-ish years too late.
The first time we found a provable case of malicious hacking, whether by individuals or nation-states, the result should have been the termination of that entity. Nothing says "stay out of my network" like a bloody head on a fencepost.
Le Canard Enchaîné is a satirical paper!
Yes, but not in the same way The Onion (or its French counter part Le Gorafi) are satirical.
Le Canard enchainé makes fun of people and institutions, but never makes stuff up, and are arguably more rigorous than most mainstream media outlet. They have a long history of exposing real scandals, albeit with a tongue-in-cheek manner.
Like Private Eye in the U.K., which is satirical, but also has a long history of reporting serious news.
Nope. It's a serious newspaper reporting on serious news. Usually with a vitriolic tone and wordplay, but it's absolutely not a satirical newspaper like the onion (the french equivalent would be le gorafi).
Same news other serious outlet:
[1]: https://www.franceinfo.fr/internet/securite-sur-internet/cyb...
Sounds similar to the UK's Private Eye.
yes but The Telegraph too runs invented stories
Maybe they do but if you make allegations like this why not support them with evidence? That would put to rest any possible suggestion by folk who see ulterior motives in everything, that maybe you object to the Telegraph in general. No reason to suppose you do but that's how it is.
I don't understand the 110. The blood was.. boiling??
The way I understand it, and someone please correct me if I’m wrong. Whoever hacked the devices send a command to increase temp to 110, but it never reached that number, instead it just reached the max. But the news story still reports it as if the blood literally started to boil to 110c
I see a new market in little VPN devices.
There is plenty of options already on the market. From specifically for remote use to simple features on routers.
Still, spending any money on basic security seems to be way too much these days.
They had almost 3 weeks of warning since those attacks started. No excuses if they are not secured by now.
They have had over 60 days.
https://signalandsilence.substack.com/p/i-think-someone-hack...
This is out there!
It is either malicious incompetence or a red flag. No other explanation for me is satisfactory.
Check out /r/NotMyJob/. You can lose faith in employees, and humanity in general, one video at a time. All it takes is few people who DGAF and security issues won't ever be detected, to say nothing about addressing them.
we are a few attacks like this from a country interpreting it as a declaration of war. I have no doubts a developed country counter-intelligence cell can find which country is responsible for such a large scale attack. I wish they target countries like China instead of spineless france.
So if the attack comes from groups hosted in <checks notes> Israel, Russia or some SEA proxy of China, what does France do? Nuke the country?
Spineless or beholden? That is the question.
>I wish they target countries like China instead of spineless france.
Because Chinese Life is less worth than "spineless" French? What is that disgusting worldview of yours? You know what a blood-bank is, right?
I read it as meaning China is more likely to track down and prosecute the attackers. I use the term prosecute loosely.
They mean that China will respond in kind, rather than France, who may just wring their hands.
This is not looking good especially with so much red tape in Europe don’t know how they will deal with this…
The EU will release a statement where they claim to be very concerned. Then maybe write an additional 1200 page regulation on industrial refrigeration that will fix the problem by making impossible to legally refrigerate anything. The usual.
The article states there was no impact on stored products, because the attack was detected early.
I'm not sure why you're talking about red tape, is that really related to the article?
Standard reaction for anything Euro related.
I'd say it's half of one, since it doesn't mention nuclear power.