Somebody learns the term "single point of failure" now...
Technology
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
I wonder how much money was saved by having someone manage the freezer section, or how much money was earned by not having an empty fridge.
The management quarterly meeting PowerPoint presentation says x3 more yachts for us.
Attacking a countries food supply and food reserves really seems like a act of war.
The term "hackers" really downplays the severity of these kinds of cyber attacks IMO. It makes it kind of sound like a teenager in a basement somewhere, as opposed to some foreign state cyber warfare group or something along those lines.
Also it's madness that systems like these are connected directly to the internet without read-only permissions implemented. Controls should only be accessible locally on some kind of airgap or local seperate VLAN.
The disconnect between how systems "should" be and how they actually are is disappointingly enormous.
Retailers are surprisingly enough just like consumers and want things to "just work" without caring about security.
And so they get Internet-connected fridges, and it's all fine, until the very moment it isn't.
I hope this is a learning experience and they beef-up their systems.
I hope this is a learning experience and they beef-up their systems
I hope this is a learning experience and they realize that commercial refrigerators don't need to have internet access.
Please stop with the acts of war or terrorism BS. The article also mentions "in-store pricing powered by electronic shelf labels" so lets not ignore this is about multi-billion companies trying to suck every penny out of our pocket. If these companies design and manufacture and buy stupid hardware that is susceptible to such hacking, they really deserve it. I mean they really do.
Second, this is a good thing. Systems will be hardened now. You think there would be any other fucking way they would upgrade their security unless something like this happens? Beatings will continue until security improves. This is why even chaotic hackers that cause damage and inconvenience are ultimately a positive force on our IT infrastructure. Think of it as an ecosystem and evolutionary pressure. Free marketplace of security models.
An apparently untargeted attack on food supply is an attack on society before it has anything to do with that specific company, in my eyes.
Well, it is true. It is an attack on a society with internet connected refrigeration units with bad security. But fuck that society in particular.
Also it’s madness that systems like these are connected directly to the internet without read-only permissions implemented.
Water systems in the US are, too. And they have been hacked.
This is exactly what happened to the US Army about a month ago.
Why the fuck are all of your fridges controllable from the Internet? We didn't have to build such a stupid, stupid society.
Because this way the bill of materials, design work, and labor cost are all higher; and that way the company can earn more money!
Capitalism is so far detached from what capitalists pretend it's like. Wealth distribution is so uneven in the U.S. that there's extremely little incentive to lower costs, even if the business is worse off because of it.
Morgan Freeman Narrating: It was in that moment, they realized the IoT was a very, very dangerous idea.
Remote monitoring 👍
Remote control 👎
David Attenborough butting in: "That's when they should have realized it, but did not. A fatal mistake."
Why the fuck does a refrigerator need to be on a network?
Controls have to be put somewhere, and networked interfaces mean fewer physical controls that may be difficult to access, tampered with or fail. Having a standard control protocol means interfaces can be changed and improved without modifying the hardware. They're not a bad thing.
However, having networked controls exposed on anything other than private, air-gapped, wired-only LANs seems rather foolish, to me.
What's missing from this report is more detail on how exactly this attack went down. Did the attackers compromise supermarket networks and manipulate the fridges through lateral movement within the network; or were the fridges accessible from the open internet? If the latter is the case (and there's a non-zero likelihood they were): why the fuck?
why the fuck
Because, despite us being in the Information Age, and computers surrounding us everywhere, only a very small portion of the population consider that learning how they work may be useful.
I'm sure if more people learned about how computers work, AI wouldn't be a thing because they'd realize that computing-based tasks can already be automated without LLMs.
Tell that to my developer colleagues who are busy defining "skills" for the AI to do the mundane things our tools could already do. It may waste huge amounts of electricity, water and money, make us dependent on American megacorporations, cause their skills to atrophy, and be a gamble every time, but at least they don't have to read the manual.
I assume because of the monitoring cloud-based IoT thing from Danfoss fridges were so comfortable to use. Ok, you don’t need it so often, but hey it’s a cool IoT feature.
Idiot design and engineering for the sake of cheep managers. Same reason they are taking all the air gaps out of critical infrastructure. Instead of having Internet connected monitoring separate from the controls like a normal person, they hook controllers to the Internet too, so they don’t have to pay a technician to come in.
For added stupidity, the department at my job which has monitors and controls online just caused a number of techs who only do monitor and control to retire by making them return to work in office.
The executives that allowed the system to be built this way belong in prison for the value of the destroyed food. An engineer almost certainly told them this system needed better design and security and was told no by some cheap ass trying to preserve their executive bonus.
Nothing will ever change until these monsters have personal consequences.
Just wait until some cars get hacked to accelerate as fast as possible because we just had to have telemetry in them for surveillance and profit.
Being "smart" and connected to the internet is about to devalue a lot of manufactured goods that have no business being either one of the those things.
One can only hope
Maybe they learned they need to air gap critical infrastructure, and leave the management to on-site humans who are paid well enough not to hold their inventory for ransom.
“Learn” hahahahaha
Did having centralized control and monitoring of coolers save a fake number of man-hours on a spreadsheet instead of paying a store employee already on the clock to check temperatures occasionally?
They’re going to keep doing it because the spreadsheet says the risk is worth saving those fictional man-hour costs.
They will calculate that they spend less on recovering from these cyberattacks than they would on paying staff fairly, and carry on.
The nice lady who sold me my home left a fancy washer and dryer set and it can connect to my internet but my fucking question remains why lol. Fridge is normal thankfully.
Someone on Twitter is saying that the username for the fridges was "admin" and that the password was the current date... Prime security in effect here, clearly /s
Well, this means the password is very often changed, so it is secure /s
I can understand a lightweight IoT network to monitor temperatures and get alarms automatically. But why on earth would it allow controlling the fridge remotely?
Having fridges connected to the internet and getting them Hijacked is stupidity, not a cyberattack.
2010s - We made everything smart, networked, and IOT!
2015-2025 - We need you to put your personal details into everything, everywhere, all the time!
2026-???? - We invented a machine that can hack everything on earth and steal all data for nefarious purposes.
Anyone ever worked with management and chatted about security on this stuff, they never wanna know. They never want to pay, its a line item of risk that is just a problem to budget or deadlines....that's a tier three wish list item that we can deal with later. Surprise it never happens.
Being a manager is an invisible job. When everything goes smooth then 'that's just how it's supposed to go'. When things break or get hacked the manager looks like they aren't doing enough. Meanwhile manager responsibilities cover an unreasonable amount of work and stack up fast.
Managers can be in a good place work wise and then get 1 phone call that ruins their schedule for the week. When it rains it pours because then employees call out, some employees can't get along so you have to deal with their high school drama, then someone needs a report, then there was an inventory supply or a computer/accoubt isnt working etc etc etc. At some point the manager has to say 'this isn't my company and I'm not going to put in a bunch of unpaid overtime (your salary and only get paid 40 hours a week. Anything over is you working for free instead of enjoying your personal life) to fix this'.
Just like the people they manage, managers aren't very incentivized to sign up for their own big projects that don't require their immediate attention. Managers might get a bonus for a job well done at the end of the year but is it really a bonus if they worked a bunch of unpaid overtime all year? Feels more like a partial refund to pay some of that time back.
Im surprised that the EU doesnt have a secuirty requirement for IT infrastructure in the food supply. Seems like an oversight
We do, but companies are given a billion years to implement that because The Economy ™️