The case of the French supermarkets that have been hacked has been in the news these days. Several supermarket chains have been affected. Apparently, the hackers exploited a vulnerability to tamper with the temperature of the fridges overnight, raising it to 50 degrees. Several hundred supermarkets were affected, between 350 and 700 depending on the source.
Changing the temperature over the internet? Is that even possible?
Well, for a while now, yes, it is possible, and many companies use this kind of device. Are you familiar with the concept of IoT (the Internet of Things)? In recent years, all these devices that let you control gadgets over the internet have become fashionable, from light bulbs to plugs and even household appliances, in this case fridges. In principle it is very cool, but it is a huge security risk.
But goguma, the app asks for a username and password, shouldn’t that be secure? How did they do it?
Very simple. When you buy this kind of device, has it ever been updated? I have tinkered with a few of these and very few of them ever got an update. After a while, when the manufacturer decides it is no longer profitable, or has already released a newer model, there are simply no more updates. And obviously any software has bugs, so it should be updated regularly to patch them.
Many people, in fact a huge number of people, do not give this the importance it deserves. If you are an individual with a smart light bulb, you may not care: the most anyone can do is turn it on or off. But things change, and a lot, if you are a company.
The supermarkets have learned a lesson the hard way.
In my opinion, the mistake was leaving these systems without updates and not keeping these things under control. They underestimated the risk that this could happen, and they left a door open that is going to cost them hundreds of thousands or even millions of euros.
And why do fridges need to be connected to the internet?
For me, this is the point: not everything needs to be online. A supermarket can keep these systems disconnected from the network. I do not know for sure, but do they actually change the temperature remotely on a regular basis? Probably not. At most, I imagine they adjust it depending on the time of year, and that could be done by sending a memo to the supermarkets so they adjust it themselves. So much connectivity is often unnecessary.
What consequences could this have?
Possibly few, apart from the cost to the supermarkets. They will probably release a patch in a hurry and move on. I know there will be a judicial investigation, but this should be taken as a very serious warning of what could happen.
Very few people or companies are going to rethink their cybersecurity policy, especially in sectors that are not focused on it. They see it as secondary: their business is having everything in stock and cutting costs. In banks, for example, companies and customers are much more aware.
But for a moment, imagine the chaos if someone (whoever it may be, for example some hackers or an enemy country) infiltrated these systems all at once. Imagine, for a moment, that all the fridges in a port were hacked, or the traffic lights of a city. We are talking about the fact that people could die because of these things. It is no joke.
What is your solution, goguma?
Very simple: critical things like these should be disconnected from the network. Only connect the ones that are essential. And, at an individual level, smart plugs or light bulbs should be connected to things that are not critical. For example, personally, I have one of these plugs connected to a fan so that it switches off at night in summer. If someone hacks my plug, the only thing they can do is turn the fan on or off. Neither case has serious consequences, and the power consumption is limited. But I would never put one on a fridge, because if they switch it off, goodbye food.
The same goes for businesses. Only connect what is essential. If there is no online access, it cannot be hacked (well, it is possible, but it is harder). And if it is essential to connect the system to the internet, security must be reinforced. Using a VPN, changing access passwords to strong and unique ones, updating them every few weeks, two-factor authentication, segmented networks and user permissions are some of the measures that can be taken to limit the damage.
Do you use this kind of device? Did you know that supermarket fridges are connected to the internet?
I will read you in the comments.
If you have made it this far and enjoyed the content, you can help me keep the blog ad-free with a small donation at Buy Me a Coffee.
Photo: fajri nugroho on Pexels.