World News

I work with these controllers. Remote access is a lifesaver, makes remote diagnosis much easier, and lets us tell the client to move product before it spoils. Similar refrigeration controllera have had remote capability since the dial-up era, this isn't a new trend.

With that said, these things need to be behind a VPN. I don't care if the manufacturer promises their controller is safe for direct access from the internet.

It's kinda like a factory assembly line, once these things get installed and the system is stable, the client gets allergic to any changes. I come across old control systems that have been running for 30+ years, once it's in it's in.

Probably for telemetry and monitoring

So they cant be turned off remotely if the company doesnt agree with the yearly price increase.

Laziness and/or convenience. It's always those. What supermarket would pay for an actual IT person that can setup a VPN and configure access control when "it just works" anyway.

It also acts as a reminder that this is also true for some critical infrastructure. Thankfully not all of them, but there's been stories.

Probably step 5 of the quick start guide:

"It's important that you connect your refrigerator to your WiFi to find out about incredible deals, product updates, and maybe once in a great while security patches!"

Some business major over at Fridgey Fridges Ltd. thought, 'Ooh la la, if we add €20 worth of electronics to these things, we can sell them for an extra €500 and when they break they'll generate an extra €100/yr in service calls and parts.' Then some business major at the grocery co. said, 'wow, we're going to get fridges that can connect to the internet. Now we won't have to have Guy go check the temperatures. (which we already don't do) I can convince my idiot boss this saves the company €100B and get a bigger bonus this quarter.' Then the CEO says 'look investors, we've put AI in our fridges to manage the temperature,' and the share price flew up and gave him a giant bonus.

Never underestimate the ability of business majors to think the solution to a problem, which mightn't really exist in the first place, is to pay someone else to automate it without regard for how badly it will break after they've moved on.

so many things should just not be on the internet or to me even networked. Seriously how often do you need to micromanage your fridge/freezer? These are places with plenty of employees. Having someone go through with a laser thermometer first thing in the morning and last thing at night and on some cadence through the day would be fine. You can automate the process calendar wise.

Defrost mode. https://www.bbc.com/news/articles/crq5nzxv9q4yo

Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports about just how warm the fridges and freezers could become in that process.

Industrial controls are terrifying in terms of just how catastrophically they can cause the device to fail. Connecting machines to the internet is an incredible liability.

I once tried to beg the SCADA department to let me have a single line of sight radio transmitter for data collection. Not for control, and not even over the internet! They said no, which was the right thing to do.

True, but that's still no reason to hack their supermarkets.

Same country, or a friend, that was trying to sabotage the Paris Olympics and paid guys to set rail infrastructure on fire to cause chaos.

Isn't France going through protests at the moment? Destroying the food supply adds pressure, I don't know enough to guess who did what.

Some big org or state actor for an attack with that dimension and target. Possibly state sponsored for political pressure or but much less likely a competing business. But they usually have less obvious ways to fight competitors. So I go with a state sponsored cyber attack.

Competing business