Rendered at 13:23:24 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
renyicircle 21 minutes ago [-]
> Connecting your case controller to the internet offers further opportunities to generate savings. If you can diagnose issues and control the case remotely, service engineers needn’t be called out to simple situations like starting a defrost. And being able to compare performance and efficiency across an entire estate of stores makes it easy to spot patterns and make incremental efficiency gains. (https://www.danfoss.com/en/service-and-support/articles/dcs/...)
I wonder if the incremental efficiency gains from this outweigh the damages. That doesn't even sound like a bad idea, unless of course nobody stops to think "but what if someone hacks this".
bluGill 2 minutes ago [-]
Why are technicians (service engineers!) coming our for a simple defrost in the first place? The normal defrost cycle should be automated. For anything else you need someone to come out anyway because something is wrong - there is no point in starting a defrost cycle if the root cause is leaking refrigerant - fix the leak and refill the system both of which need to be done in person.
Delphiza 11 minutes ago [-]
Good find.
The biggest issue is that many of these IoT devices are badly secured. I spent years trying to convince people to build more secure IoT systems, but they always preferred cheap and easy solutions.
master-lincoln 6 minutes ago [-]
I would have said let them be doomed. But due to late stage capitalism so much has been centralized that everybody is doomed in many cases...
pjmlp 14 minutes ago [-]
Thankfully these kind of attacks make pressure to finally have liability in software like in other industries.
Simulacra 18 minutes ago [-]
And I would bet dollars to donuts that someone at that company would respond "who's going to hack a refrigerator? Heh"
MisterMunchkin 32 minutes ago [-]
Interesting. The government has been suggesting war with Russia is coming. This would be a great initial move. Take out the European food supply network, then hit things like the grid and the internet.
It's funny because red storm rising is an old book at this point, but it's pretty accurately shown exactly how conflict with Russia plays out. Even down to Russia realising it is about to run out of diesel... causing it to invade Europe while it still can.
Russia cannot invade Europe, that is nonsense peddled by the EU establishment to support their idiotic military Keynesianism as part of a plan to reboot EU manufacturing.
They are struggling to take a couple of villages in Ukraine, why would they invade the EU.
rwyinuse 15 minutes ago [-]
Large scale invasion is not likely, but they could try some limited operation to test NATO's unity. Most likely location would be somewhere in the Baltics.
wongarsu 14 minutes ago [-]
To be fair, that they are struggling to take over a couple of villages in Ukraine is in large parts due to the intensified arms and ammunition production of the entire EU (and in the past that of the US). And that's only enough for a standstill
flohofwoe 4 minutes ago [-]
Ukraine did a spectacular job to stop the full-scale invasion in the initial hours, days and weeks when there wasn't much international help yet though (and I guess from that moment on the war didn't go quite according to plan from the Russian PoV).
brookst 4 minutes ago [-]
Standstill with Ukraine looks bad, and authoritarian regimes can survive almost anything except looking bad.
Responding to a NATO “attack” from Estonia, Putin can pivot to a bigger enemy where of course Russia has to employ universal conscription / nuclear weapons / whatever. The country must unite against this unprovoked western attack, etc, etc.
goobatrooba 9 minutes ago [-]
Not Europe but a few Baltic states are feasible. No one says they can hold it, but Putin has his own reasons so we should not think we can conclude on future Russian actions based on what we consider reasonable - e.g. no one predicted that a war on Ukraine was likely as it seemed to be completely irrational and self-defeating.
If nothing else, war has been many times convenient to keep regimes in power (see Bush post 9/11 for an obvious example). Putin might want to strengthen his case. See absurd discussions / push for a "Republic of Narva" as an example cause belli.
flohofwoe 14 minutes ago [-]
Never underestimate the stupidity and irrationality of autocratic governments. Putin also decided to invade Ukraine after all even though he should have known better.
AndrewThrowaway 8 minutes ago [-]
My first idea was "who the hell needs connected fridges".
Then I remembered that both my AC and floor heating are connected.
A hacker could easily turn on both AC and floor heating and cause me a few euros of damages in my electricity bill.
alexdrdr 49 minutes ago [-]
Only going to get worse as hackers get increasing access to more advanced AI models and compute
Open weight models catch up quickly, so it is only a matter of time before Fable level models are in the hands of bad players
Key issue will be that banks and key infrastructure *may* get their security patched in time. But there’s going to be so many vulnerable companies like in this case
notyourwork 42 minutes ago [-]
And hopefully regulation following it.
jayGlow 8 minutes ago [-]
What regulations would help with this? companies that actually host the models themselves can be regulated but open models can e abliterated or otherwise modified to stop them from refusing tasks. I'd be very wary of any regulations that prevent people from hosting or making their own models and weights.
fzeindl 55 minutes ago [-]
Great. We already waste a ton of food, let’s destroy even more.
renyicircle 31 minutes ago [-]
It's probably a small drop compared to the overall amounts of wasted food. I guess the hope is that it will teach some people important lessons, like "your refrigerator shouldn't be connected to the Internet, and if it absolutely has to, take some time to consider security".
0123456789ABCDE 36 minutes ago [-]
these are the visible effects of a hybrid war, not the pranks of script kids
StableAlkyne 38 minutes ago [-]
There is so much needless connection to the internet nowadays; this is the end result of a decade of shoving IoT into everything.
Beyond some corporate manager seeing a dashboard that will cause them to say "oh neat" in a meeting once, there is zero reason to put a refrigerator's cooling system online. Or frankly any network for that matter. Is there really such a massive productivity increase from being able to remotely change the temperature when a human has to physically visit the machine to restock every day anyway?
Delphiza 25 minutes ago [-]
There are a bunch of good reasons to connect a commercial refrigeration unit to the Internet (via IoT). Notification when failover to the secondary cooling system happens, notification of when ambient temperature is too high, optimisation of energy consumption (especially after hours).
Doing it insecurely by, for example, having a device with a web server on the fridge is problematic. Not being able to deploy firmware updates. Having too much of the control loop exposed (as opposed to monitoring only), can lead to issues.
Service-oriented industries with costly assets will look to Internet connectivity for competitiveness and efficiency. It needs to be done better.
renyicircle 7 minutes ago [-]
I didn't expect to spend so much time today thinking about fridges.
I have so many questions. If it's all so connected and monitored and notifies of issues, couldn't it notify anyone that the settings are weird, like continuous 50 degree Celsius defrosting? How much access did the hackers have, apart from temperature controls? Could nobody intervene quickly before the damage was done? Was there a way to "unplug" the fridges or they would just keep frying, so they had to get people across all the stores doing manual resets?
Lyngbakr 7 minutes ago [-]
I always feel like such a buzzkill and Luddite when talking about IoT. My sister-in-law excitedly told me how her air fryer can be controlled remotely via an app. I think she also expected me — a techie — to be excited, but all I could see was unnecessary risk and usage data being slurped up by a corporation. I'm sure there are lots of good applications of IoT; however, I don't think this is one of them.
pjmlp 8 minutes ago [-]
Added to it that those devices are powered by firmware written in C and C++, with various levels of quality control if any, and no field updates.
quickthrowman 12 minutes ago [-]
> there is zero reason to put a refrigerator's cooling system online.
There are plenty of good reasons to do that. It’s not a consumer refrigerator, it’s a collection of evaporators and condensers and sensors that are controlled by an automation system. Remote monitoring can alert operators to problems so they can be fixed before the food spoils.
Authentication is hard.
47282847 52 minutes ago [-]
Fridge attack! We live sci-fi indeed! %-)
pjmlp 15 minutes ago [-]
Another good example why writing secure software matters in the age of connected devices.
flohofwoe 8 minutes ago [-]
Of course the bigger question is why a refrigerator is even a "connected device".
pjmlp 4 minutes ago [-]
Because it is cool! (pun intended)
For the same reason, we hardly have heating meters in Germany that aren't wireless connected to the maintenance company.
To save costs doing maintenance trips to check their state.
arwineap 4 minutes ago [-]
So they can monitor if something goes wrong, have a tech troubleshoot and deploy with the right parts.
Modern HVAC and fire control b systems for buildings are often connected now as well
Jamesbeam 9 minutes ago [-]
Only three more Russian datacentres to go, and Belgians won’t be the only ones eating each other again this winter.
gessha 52 minutes ago [-]
“Got another blackout in Santo Domingo. Netrunners are at it again, poking holes in the power grid!”
0123456789ABCDE 46 minutes ago [-]
that's happened in Ukraine, a few times already — search for sandworm
Why is this even connected to the internet. If you want to monitor it remotely, you can set that independently from the actual controls.
ex-aws-dude 48 minutes ago [-]
Why is that even internet enabled?
If you want to defrost it presumably someone already needs to be physically present to unload the fridge?
Kevin_Flynn 38 minutes ago [-]
My guess, its a service contractor type situation, like getting a smart meter. You can opt out, you just wont have power.
They had a contract with a fridge company, and the service agreement required remote monitoring such that, the service company would be able to detect and troubleshoot remotely, and schedule calls.
The problem with situations like these is that your network security falls to the lowest common denominator, which in this case, is a group of HVAC technicians.
The conversation was something like this:
HVAC company: "Oh yeah, our software does this, and that, and we monitor everything, and thats why our contract is less, we dont waste time and we use sophisticated technology. And of course its 100% secure because expert boffins wrote it."
Grocer w/ 2% margins: "Sounds great."
To be clear, I'm not throwing shade on HVAC technicians. I'm only saying, they aren't network security specialists, thats all.
wongarsu 20 minutes ago [-]
Somebody wrote the software that is the interface between the fridge and the internet. And while it would be nice if HVAC technicians would remember to only make this software accessible via VPN, it is in fact possible to write software that is reachable from the internet while still being secure
Given that we agree that HVAC technicians can't be relied on for network security, this is 100% on the fridge company for having insecure software. If it's a bad password or an unchanged default password that's still on the fridge company for not enforcing something better
Delphiza 3 minutes ago [-]
IoT platforms provided all the required functionality. Device provisioning (it is not easy to do identity on 'things'). MQTT for service-assisted communication where devices don't need to accept incoming connections. Over-the-air software updates. Over-the-air kernel security updates.
The 'fridge company' and other product manufacturers decided to skip all that and run everything on a raspberry pi with apache, or an ESP32 soldered onto the control board, and call it finished. There are millions of these devices out there.
Kevin_Flynn 13 minutes ago [-]
Of course its "possible" for it to be secure, but the people involved are not experts.
The grocer likely has the least expertise.
The HVAC company has more, but as evidenced by the article, not enough.
Now obviously, these companies have internal "information systems experts" but again, how does the banana guy interview a CIO ? Grocery store CIO might have gotten the job because he made the banana guy comfortable by talking about sports.
Each party was confident in a successful outcome, until the 15 year old kid across the globe pulled the rug.
The processes that created this situation were inadequate, because glad handing and name dropping cost less than formal systems validation.
Of course, the other way to view all of this is ... they just completed formal systems validation, found 1 bug, and paid whatever the food spoilage cost was for it, because no matter how much preperation one does on a project, at some point the power switch gets flipped, and its wait and see.
In a group project, noone is ever sure if Poindexter over there in the corner is quiet because he's quiet, or is quiet because he knows the code is crap and his boss ordered him to ship it anyway.
polytely 39 minutes ago [-]
Yeah I feel like cheap enough AI will make having internet connected appliances such a huge liability that most devices will have to go back to as dumb as possible
0123456789ABCDE 43 minutes ago [-]
someone, or something, needs to monitor the fridges remotely, which means networked thing with all the cute little details of the IOT tacked to it
edit: these are unlikely to be directly connected to the internet, but rather part of an internal network that got popped, likely a while a go too
quickthrowman 10 minutes ago [-]
Have you ever been to a grocery store?
These aren’t consumer refrigerators, it’s a collection of large cold rooms and cases with a bunch of refrigerant tubing and multiple condensers, evaporators, and sensors. It’s a bit more complex than a single home refrigerator.
lornmorkse 21 minutes ago [-]
Wait until they figure out they’re all filled with butane as a refrigerant thanks to global warming.
poontangpoo 6 minutes ago [-]
well that will be explosive!
kotaKat 53 minutes ago [-]
... Feels like deja vu. Didn't the US military just have this happen at its military exchanges... a month or two ago?
"ALL freezers went into defrost mode – ALL frozen food has spoiled".
chimneychanga 10 minutes ago [-]
Yeah I remember that, and it seems like the military was very hush-hush about the cause. Now I wonder if they were hacked too.
ninefathom 26 minutes ago [-]
This was precisely my first thought upon reading. "Ah, yes - the attack that was PoC'ed against commissaries operated by the US armed forces a bit over a month ago."
black6 44 minutes ago [-]
Yes, not exactly "unprecedented." The news of Commissaries having their freezers hacked should have been a kick in the rump for everyone else with infrastructure needlessly connected to the Internet.
RugnirViking 6 minutes ago [-]
the sort of people doing this security posture definitely are not up to date on the latest security news...
It would take something truly monumental to make a local supermarket owner to even consider the potential for their fridges to be an attack vector.
robthebrew 50 minutes ago [-]
TomsHardware hit? I'm getting spinning beachballs on this link
pjmlp 6 minutes ago [-]
All Future sites are junk now, and I imagine even with subscription they aren't much better.
I wonder if the incremental efficiency gains from this outweigh the damages. That doesn't even sound like a bad idea, unless of course nobody stops to think "but what if someone hacks this".
The biggest issue is that many of these IoT devices are badly secured. I spent years trying to convince people to build more secure IoT systems, but they always preferred cheap and easy solutions.
It's funny because red storm rising is an old book at this point, but it's pretty accurately shown exactly how conflict with Russia plays out. Even down to Russia realising it is about to run out of diesel... causing it to invade Europe while it still can.
https://www.imdb.com/title/tt4192998/
They are struggling to take a couple of villages in Ukraine, why would they invade the EU.
Responding to a NATO “attack” from Estonia, Putin can pivot to a bigger enemy where of course Russia has to employ universal conscription / nuclear weapons / whatever. The country must unite against this unprovoked western attack, etc, etc.
If nothing else, war has been many times convenient to keep regimes in power (see Bush post 9/11 for an obvious example). Putin might want to strengthen his case. See absurd discussions / push for a "Republic of Narva" as an example cause belli.
Then I remembered that both my AC and floor heating are connected.
A hacker could easily turn on both AC and floor heating and cause me a few euros of damages in my electricity bill.
Open weight models catch up quickly, so it is only a matter of time before Fable level models are in the hands of bad players
Key issue will be that banks and key infrastructure *may* get their security patched in time. But there’s going to be so many vulnerable companies like in this case
Beyond some corporate manager seeing a dashboard that will cause them to say "oh neat" in a meeting once, there is zero reason to put a refrigerator's cooling system online. Or frankly any network for that matter. Is there really such a massive productivity increase from being able to remotely change the temperature when a human has to physically visit the machine to restock every day anyway?
Doing it insecurely by, for example, having a device with a web server on the fridge is problematic. Not being able to deploy firmware updates. Having too much of the control loop exposed (as opposed to monitoring only), can lead to issues.
Service-oriented industries with costly assets will look to Internet connectivity for competitiveness and efficiency. It needs to be done better.
There are plenty of good reasons to do that. It’s not a consumer refrigerator, it’s a collection of evaporators and condensers and sensors that are controlled by an automation system. Remote monitoring can alert operators to problems so they can be fixed before the food spoils.
Authentication is hard.
For the same reason, we hardly have heating meters in Germany that aren't wireless connected to the maintenance company.
To save costs doing maintenance trips to check their state.
Modern HVAC and fire control b systems for buildings are often connected now as well
andy greenberg wrote a book on this -> https://app.thestorygraph.com/books/a2d3f71e-e9aa-4947-8aa0-...
If you want to defrost it presumably someone already needs to be physically present to unload the fridge?
They had a contract with a fridge company, and the service agreement required remote monitoring such that, the service company would be able to detect and troubleshoot remotely, and schedule calls.
The problem with situations like these is that your network security falls to the lowest common denominator, which in this case, is a group of HVAC technicians.
The conversation was something like this:
HVAC company: "Oh yeah, our software does this, and that, and we monitor everything, and thats why our contract is less, we dont waste time and we use sophisticated technology. And of course its 100% secure because expert boffins wrote it."
Grocer w/ 2% margins: "Sounds great."
To be clear, I'm not throwing shade on HVAC technicians. I'm only saying, they aren't network security specialists, thats all.
Given that we agree that HVAC technicians can't be relied on for network security, this is 100% on the fridge company for having insecure software. If it's a bad password or an unchanged default password that's still on the fridge company for not enforcing something better
The 'fridge company' and other product manufacturers decided to skip all that and run everything on a raspberry pi with apache, or an ESP32 soldered onto the control board, and call it finished. There are millions of these devices out there.
The grocer likely has the least expertise. The HVAC company has more, but as evidenced by the article, not enough.
Now obviously, these companies have internal "information systems experts" but again, how does the banana guy interview a CIO ? Grocery store CIO might have gotten the job because he made the banana guy comfortable by talking about sports.
Each party was confident in a successful outcome, until the 15 year old kid across the globe pulled the rug.
The processes that created this situation were inadequate, because glad handing and name dropping cost less than formal systems validation.
Of course, the other way to view all of this is ... they just completed formal systems validation, found 1 bug, and paid whatever the food spoilage cost was for it, because no matter how much preperation one does on a project, at some point the power switch gets flipped, and its wait and see.
In a group project, noone is ever sure if Poindexter over there in the corner is quiet because he's quiet, or is quiet because he knows the code is crap and his boss ordered him to ship it anyway.
edit: these are unlikely to be directly connected to the internet, but rather part of an internal network that got popped, likely a while a go too
These aren’t consumer refrigerators, it’s a collection of large cold rooms and cases with a bunch of refrigerant tubing and multiple condensers, evaporators, and sensors. It’s a bit more complex than a single home refrigerator.
Yes, yes they did. https://www.militarytimes.com/news/your-military/2026/08/28/...
"ALL freezers went into defrost mode – ALL frozen food has spoiled".
It would take something truly monumental to make a local supermarket owner to even consider the potential for their fridges to be an attack vector.