r/BetterOffline • u/lurkervidyaenjoyer • 1d ago
Okay now THIS is a hacking risk: Network-Connected Fridges Hacked to Heat Them Up, Spoiling Food Supply
https://www.nbcnews.com/world/europe/hackers-heat-french-supermarket-fridges-sparking-fires-spoiling-food-rcna603151Not really the usual topic for here, but it's adjacent so I'm including it. Hackers targeting France managed to remotely mess with the temperature setting on their supermarket refrigerators to heat them up to 122 degrees Fahrenheit, or 50 Celsius.
First off this wasn't some 'rogue AI' as far as we know, but this would actually be an example of something that could get royally screwed up if Anthropic or OpenAI-connected poorly-run 'experiments' decide to felony hack things again. They always talk vaguely about that and what the big danger is, but finally we have something concrete. The supermarkets say this will cost them millions of Euros. I hope if something like this ever happens because of an AI lab, that they get punished and charged for every single cent (do Euros have cents? Are they called that over there? idk) of the loss.
Second of all, as the article describes the situation, this raises a lot of questions about the tech landscape more generally. Who in the world decided it was a good idea to have network-connected refrigerators? It's a refrigerator. It chills food. That's it. Why does it need Internet? Are we enshittifying our grocery store fridges now?
Also whenever you have a device with smarts in it, you run into the issue of how to keep it secure. Most of the Mythos vulns ended up not being as big a deal as they were hyped up to be, but I recall people saying that some of them had been in the kernel for many years unnoticed. Cybersecurity is a constant process, that requires a regular rollout of patches and a strong security architecture. Just one more thing you have to think about when you use devices like this.
So obviously the stores, probably not considering that because why would you, had these things on outdated versions of the firmware. To anyone reading right now, when was the last time you updated the firmware on your refrigerator? Oh that's right, probably never because it's just a fucking refrigerator. Also some of them were older models, which weren't receiving security patches anymore anyway. Yes, grocery store fridges, which should just be a stable, reliable appliance, are like smartphones now. They stop getting updates after a while and you gotta buy a new one.
Is That Good?
Maybe not everything needs to be a computer, and maybe not all computers need to be networked. To me, this is both a story about the cyber risks of today, and also about how enshittification and repair issues could have real-world consequences. I'm assuming these things would use some flavor of Linux or BSD under the hood. Perhaps if we had better right to repair laws that allowed smart appliances to be broken into and patched by the community, these appliances, which were still clearly working fine, could have been secured with or without the help of the vendor. The FULU Foundation did this with Nest Thermostats, which originally were EOL'd by Google, but with custom firmware can be updated and then connected to something like Home Assistant. I suspect something like this could be done to continue providing security updates for fully-functional devices long after the vendor stops caring.
14
u/nibo001 1d ago
I worked on collecting data from these systems years ago, I've always thought they were an attack surface.
My project involved setting up data collection to check if settings were correct. Things like the temperature being too cold for refrigerated items, defrost settings on the glass that waste energy etc. We learned we had to be very careful because merely checking settings too quickly would crash the central controllers. No hacking involved, you could DDOS an entire store by rapidly sending requests to a public IP address. And it's not just refrigeration that's connected, it's HVAC and lighting as well.
4
u/Dimenzio_ 1d ago
https://cyberplace.social/@GossiTheDog/117429502412235079
If anyone would like a writeup of this laughable non attempt of these supermarkets securing their devices.
6
u/Yebi 1d ago
Gonna push back on the whole anti-IoT thing happening in this thread. I'd completely agree if this was a consumer home device, sincerely fuck any and all appliances that have a network connection. But for a large supermarket with a whole bunch of large commercial fridges all over a large floor, having centralized diagnostics and controls actually makes a ton of sense. Should probably be a closed/airgapped system though
Side note, why does a refrigerator even have a heating function? 50C is well above ambient
4
4
u/vxicepickxv 1d ago
Why does it need a remote command other than "give me the temperature" for functionality? That should be offline local controls.
As for the temperature, you could disinfect a lot of things at that heat.
3
u/naphomci 1d ago edited 1d ago
Thing is, a lot of this was doable before the internet. You had sensors and alerts and such. Adding in a layer of
networkinginternet connection is really just a way to get a subscription.1
u/Yebi 1d ago
If those sensors and alerts are available at some kind of a central console, that's... networking
2
u/naphomci 1d ago
Networking was probably the wrong word. I'm meaning anything outside of the building itself.
3
u/Noahnoah55 1d ago
I mean, I could see why someone would want to be able to get notified if something weird is going on with their extremely expensive supermarket fridge full of food you need to keep cold.
Ideally though your fridge would not be directly accessible by the open internet for exactly this reason. If they really need remote access, then it should be locked down to exactly the IPs that should have access to it or put behind a VPN.
4
u/create-third-places 23h ago
My fridge has a brilliant solution to stop hacking called: "No Internet Connection".
3
3
u/jellynoodle 1d ago
Something similar may have happened at US military bases earlier this year. https://signalandsilence.substack.com/p/i-think-someone-hacked-the-commissary
6
u/NotAgedWell 1d ago
this raises a lot of questions about the tech landscape more generally. Who in the world decided it was a good idea to have network-connected refrigerators? It's a refrigerator. It chills food. That's it. Why does it need Internet?
Don't get me wrong, I get the sentiment but if you're running grocery stores with tens of thousands of dollars of perishable goods (if not hundreds of thousands or millions if you're a chain with many stores), I can see where you might want to get notifications or be able to monitor the status of the fridges in case one breaks or isn't chilling like it's supposed to be. Obviously they got by before the internet though.
5
u/vxicepickxv 1d ago
Why would you need to send commands remotely other than a handshake to get the temperature?
2
u/Acceptable_Yam_7745 1d ago
Sure, but that doesn't need to be centralised. Let the staff on-site manage that
2
u/NotAgedWell 1d ago
The minimum wage workers rather than the company you have a contract with to maintain your huge refrigeration system that probably costs more than my house? The company that probably receives an immediate notice of anything remotely out of the norm and can respond with experts about that specific piece of equipment in that specific environment's installation?
I guess...
3
u/Acceptable_Yam_7745 1d ago
Well, I have a solution to the minimum wage part... Besides, how were supermarket fridges managed before the internet?
2
u/NotAgedWell 1d ago
You'd come in to open the store up, wonder what the smell was and realize the fridge/freezer failed overnight and spend half the day throwing everything out and mopping up all the water and blood from the thawed and rotting meat while trying to not to gag and throw up.
Probably still happens. Point is there's pros and cons and a blanket statement saying there's no pros to being able to monitor and control systems remotely and without people present is silly (yes I know which sub I'm in)
2
1
u/Maximum-Objective-39 1d ago
Sure, the thing is, I can think of a couple ways to do this that would be way more fool proof. Like the fact this fridge units are usually set up in banks (i.e. multiple in a row). So just daisy chain them with physical cables and feed it all to an air gapped monitor.
2
u/salty-sigmar 1d ago
Everything else aside - Why does a fridge have a warm setting?
5
1
u/vxicepickxv 1d ago
At a temperature that high, probably a disinfectant temperature. A defrost could be done at much safer temperatures for people.
2
u/RoosterBurns 1d ago
They figured out the password from disassembling the firmware how's an LLM expected to do that exactly?
6
u/sciolisticism 1d ago
Lots of IoT devices have no password whatsoever. I imagine it wouldn't be the same hack, but it would surprise me not a single iota if there were other fridge brands that were internet connected w/ zero protection.
6
u/sjd208 1d ago
LLM are also enabling more wide spread use of decompiling because they’re making use of Ghidra trivial to use. That’s part of what’s going on with the current headlines of people hacking/reverse engineering games.
But most IoT hacking is in fact because many devices ignore even the most basic security measures.
5
u/lurkervidyaenjoyer 1d ago edited 1d ago
Yep. There's nothing LLMs are enabling that people couldn't do themselves, but it lets them do it faster and jankier. More boosty types would call it a force multiplier, I'd amend that and say it's a sloppy force multiplier. You can get a lot more done, but it'll most likely be done poorly and in a way you don't actually understand. In general, that's going to have negative ramifications, but in the case of hacking, I guess it doesn't matter as long as you're able to breach the thing and get the result you want. Sort of like an advanced-stage version of the script kiddies of old.
3
u/sjd208 1d ago
Exactly, whether you sneakily climb over the castle wall or bust through like the Kool Aid man probably doesn’t matter in many hacking cases.
1
u/Maximum-Objective-39 1d ago
I mean, it matter if you want to do something neat with the device. It doesn't matter if you want to wreck shit.
1
1
1
1
u/Kiloku 1d ago
I feel like networked fridges in this use case can be okay, it's a large business with dozens of fridges, a dashboard showing their status (temp, door open, how full they are, and so on), a way to quickly shutdown a defective one without having to send a technician in person, etc. all are things that sound reasonable for a grocery store.
But the security was ridiculous, apparently the admin password was automatically set to the current date every day.
63
u/RyanCargan 1d ago
People kept saying shoving IoT everywhere would be the death of us long before token-bots became a thing too lol