"Disconnect our fridges from the internet — NOW" is kind of the simplest policy to implement, yet many companies and hospitals failed to do just that for months, so these fridges keep getting manipulated by script kiddies.
That's the story.
0 Boosts
0 Likes
@eckes You did not read my first reply to my post, I guess? https://social.wildeboer.net/@jwildeboer/117591203640974728
@jwildeboer I would just ask the vendor to fix it, much less work
@eckes The vendor did. The customers didn't install the updates nor did they change the default password ...
@jwildeboer
There are a lot of apologists for why various infrastructure both is and "should be" connected to the Internet, even among IT experts, and it'd all bullshit. What no one wants you to know I'd that the real reason they connect everything to the Internet is because they're f***ing.cheapskate bastards.
1/
@jwildeboer seemingly these fridges were not only connected to the Internet but many of them were still using the default user name "admin" and password the current date. Presumably they also routed through a local network so why wasn't admin access, if not just local to the network, restricted at the router to a secure VPN from wherever they were managed from?
Here's the simple emergency action plan:
"Until we have a proven and tested way to make sure that control messages that can change the temperature setting of our fridges can only be sent from known good sources, we block all control messages, either in transit or at the device. If this means disconnecting and taking sensor data by hand for the time being, so be it."
@jwildeboer or, in other words, extremely basic / standard considerations for ANY piece of software.
@jwildeboer The key problem as always was to get customers to actually apply those updates and put the new practices into place.
Or even update systems that are so old that they're out of the limited maintenance cycle. (The CRA et al are going to help with that, but not retroactively for the huge footprint that already exists ...)
GenAI is great at finding vulnerabilities, but it seems to not help at all with fixing the actual problems in the industry 🙂
@jwildeboer simple to write, much harder to actually do in practice
@dequbed I work with customers who not only plan emergency procedures, they actually test them in practice at random times. It's called "being responsible" :)
@jwildeboer True, but do those emergency procedures include a sudden hundred-fold multiplication of workload within strict and very short deadlines?
@jwildeboer starts to sound cheap compared with all the food that was canned, right?
@goncalor It should be part of any decent operations plan. You should have plans you regularly test to be prepared for emergencies ranging from "no connectivity at all", "connectivity is unreliable", "connectivity is limited to 1 hour per day" etc.
@jwildeboer
Die Preisetiketten an den Regalen sind auch digital und werden zentral gesteuert. Die Kassensysteme und Scanner auch.
Kühlschränke sind das geringste Problem.
@jwildeboer There are different stories....
@jurjen_heeck I know them all. I was there, talking with customers, when the whole Siemens PLC story unfolded and networks were redesigned to mitigate the risks. That was some 5-7 years ago. Good CISOs learned from that. So no, I have zero sympathy for the cheapskates that decided to ignore the whole issue because they convinced themselves that no one would ever care about their exposed fridges ...
@jwildeboer @jurjen_heeck The same goes for printers and advanced photocopiers IMO. Looks bland, innocuous, but should be shot when making the wrong noise.
@koen_hufkens Yep. Buy a used office print station, extract the hard drive or SSD inside and find tons of stored print files with loads of confidential information because removing or at the very least wiping the drive isn't part of the decommissioning process 😉 @jurjen_heeck
@jwildeboer But why are they failing to implement such simple policy? Can it be that they dependent on such fridges to be connected?
PS: Are those fridges really on the internet? At least from the experience I made with retailer, they are behind a VPN (that hundred of underpaid support workers in different countries have access to)
@jwildeboer "we don't have the money for a firewall in that location but we need connectivity for the legally mandated temperature check protocol and the documentation for it"
Now what?
@Laird_Dave @jwildeboer in our shop we walk around writing down the temps for the morning using eyes, pen and paper. Legally mandated ✅
Hackable (bribable), Hmmm, how much are we talking.....😆
@mrshsaxon @jwildeboer one shop != an entire chain, one chain != each and every retailer
Especially in retail margins are slim and many, many owners, managers and others try to cut costs wherever possible, thereby generating (often unnoticed) risks.
@Laird_Dave And they got their first wake up call a few weeks ago. A second one now. If they keep on ignoring the problem, they will be next and face far higher costs to fix it and in addition a big hit to their reputation. That's called risk calculation. Make the wrong decision and you risk going out of business. @mrshsaxon
@jwildeboer I'm visiting my parents this week.
One of their first technical requests was asking if I could get their new fridge connected so they'd get filter reminders.
We had a talk.
@jwildeboer But how do you disconnect that WLAN cable?! 🙀
@jwildeboer because they need the insurance and monitoring/alerting for legal requirements