"Disconnect our fridges from the internet — NOW" is kind of the simplest policy to implement, yet many companies and hospitals failed to do just that for months, so these fridges keep getting manipulated by script kiddies.
That's the story.
0 Boosts
0 Likes
@jwildeboer The key problem as always was to get customers to actually apply those updates and put the new practices into place.
Or even update systems that are so old that they're out of the limited maintenance cycle. (The CRA et al are going to help with that, but not retroactively for the huge footprint that already exists ...)
GenAI is great at finding vulnerabilities, but it seems to not help at all with fixing the actual problems in the industry 🙂
@jwildeboer simple to write, much harder to actually do in practice
@dequbed I work with customers who not only plan emergency procedures, they actually test them in practice at random times. It's called "being responsible" :)
@jwildeboer True, but do those emergency procedures include a sudden hundred-fold multiplication of workload within strict and very short deadlines?
@jwildeboer starts to sound cheap compared with all the food that was canned, right?
@goncalor It should be part of any decent operations plan. You should have plans you regularly test to be prepared for emergencies ranging from "no connectivity at all", "connectivity is unreliable", "connectivity is limited to 1 hour per day" etc.
@jwildeboer
Die Preisetiketten an den Regalen sind auch digital und werden zentral gesteuert. Die Kassensysteme und Scanner auch.
Kühlschränke sind das geringste Problem.
@jwildeboer There are different stories....
@jurjen_heeck I know them all. I was there, talking with customers, when the whole Siemens PLC story unfolded and networks were redesigned to mitigate the risks. That was some 5-7 years ago. Good CISOs learned from that. So no, I have zero sympathy for the cheapskates that decided to ignore the whole issue because they convinced themselves that no one would ever care about their exposed fridges ...
@jwildeboer But why are they failing to implement such simple policy? Can it be that they dependent on such fridges to be connected?
PS: Are those fridges really on the internet? At least from the experience I made with retailer, they are behind a VPN (that hundred of underpaid support workers in different countries have access to)
@jwildeboer "we don't have the money for a firewall in that location but we need connectivity for the legally mandated temperature check protocol and the documentation for it"
Now what?
@Laird_Dave @jwildeboer in our shop we walk around writing down the temps for the morning using eyes, pen and paper. Legally mandated ✅
Hackable (bribable), Hmmm, how much are we talking.....😆
@mrshsaxon @jwildeboer one shop != an entire chain, one chain != each and every retailer
Especially in retail margins are slim and many, many owners, managers and others try to cut costs wherever possible, thereby generating (often unnoticed) risks.
@Laird_Dave And they got their first wake up call a few weeks ago. A second one now. If they keep on ignoring the problem, they will be next and face far higher costs to fix it and in addition a big hit to their reputation. That's called risk calculation. Make the wrong decision and you risk going out of business. @mrshsaxon
@jwildeboer @mrshsaxon I agree. However, there are a lot of things that are not reasonably fast and easy taken off the grid.
Where this is possible, it would be absolutely moronic to not implement it as a stop-gap-measure at least until something better can be implemented.
For other applications - they're up the creek without a paddle...
@Laird_Dave A stop-gap measure could be to configure the fridges to only send sensor data (that's what they need to collect to satisfy regulations) and ignore/block all control messages that can change the temperature and other settings. An even more simpler temporary solution would be to disconnect completely until a solution is ready to be deployed and take the measurements by hand for now. Solutions are not the problem, the (un)willingness to act is ...
@jwildeboer I'm visiting my parents this week.
One of their first technical requests was asking if I could get their new fridge connected so they'd get filter reminders.
We had a talk.
@jwildeboer But how do you disconnect that WLAN cable?! 🙀
Here's the simple emergency action plan:
"Until we have a proven and tested way to make sure that control messages that can change the temperature setting of our fridges can only be sent from known good sources, we block all control messages, either in transit or at the device. If this means disconnecting and taking sensor data by hand for the time being, so be it."