A wave of hacks that involves spoiling food by getting into Internet-connected refrigerators and freezers and turning the temperatures up to as high as 120oF has run across Europe in the last few weeks.
The hackers—whose identities and motives remain unknown—had found a way to take control of internet-based computers that supermarket chains and refrigeration firms use to oversee the systems, cybersecurity researchers said. In some cases, hackers appeared to target systems with outdated software.
Leave aside the foolishness of connecting these devices to the Internet in the first place, no matter the convenience of doing so. (How convenient is it for a supermarket to toss whole freezers-full of food because the food was spoiled by those hacks?) Given that companies are going to do so, there are obvious steps that can be taken to minimize this threat.
France’s cybersecurity agency issued an alert about refrigeration-system controllers made by Danfoss, a Danish maker of refrigeration equipment, and US-based Copeland. The agency warned that the controllers were prone to being hacked and urged users to bolster their security or remove them from the internet.
Indeed. Find another controller company if these two (for instance) are too slow to update and patch their software.
And this, especially:
The default administrator password for the Danfoss controller is set to “12345,” according to documentation on the manufacturer’s website. If a supermarket chain or its refrigeration contractor didn’t change the password, that would create a gaping security hole.
That’s no knock on Danfoss. Of course any company producing this kind of device must deliver it with an easily discerned password so that the user can gain entry and set up its network security parameters. The first thing the installer should do, before connecting the device to the Internet, is change that password to a strong password that includes upper and lower case letters, numbers, and special characters. Not doing that simple step isn’t just lazy; it’s appallingly negligent. (Aside to individual readers: have you changed the password on your WiFi device in your home’s network that connects you to the Internet away from the manufacturer’s default? On your TV? Your refrigerator?)
For a business to not take even these minimal network security steps isn’t just negligence. I claim it’s criminal in its magnitude. IT types and company CEOs and equivalents who tolerate these failures need to be held criminally as well as personally civilly liable. And yes, that includes the Mom-and-Pops, who in the aggregate form much of the backbone of an economy’s food distribution infrastructure.
Other distribution infrastructures in an economy—electricity, fuel, water—similarly have no excuses for not securing their networks from this sort of hacking.