Fresh European Fridge Attacks Put Cold-Chain Security in Focus
Beyond food storage, the same combination of Internet connectivity, remote access, and inadequate security practices can put temperature-controlled infrastructure across other critical sectors at risk.
Beyond food storage, the same combination of Internet connectivity, remote access, and inadequate security practices can put temperature-controlled infrastructure across other critical sectors at risk.
A second wave of attacks on supermarket refrigeration systems across Europe this week has heightened concerns about the broader “cold chain’s” vulnerability to similar attacks, given that supermarkets aren’t the only businesses that rely on cold storage.
As in mid-October, an unknown threat actor appears to have gained access to refrigeration controllers at multiple European supermarkets and switched the systems to defrost mode, raising temperatures to 50 degrees Celsius (122 degrees Fahrenheit) and causing food spoilage.
A Second Wave of Fridge Hacks
Reporting by the BBC, Reuters, CNBC, and other outlets suggest the latest attacks were smaller in scope compared to the first wave in October that impacted more than 700 retail and grocery stores primarily in France. A smaller number of stores in Belgium, Germany, the Netherlands, Portugal, Poland and Spain were also caught up in the October attacks.
BBC reported the new attacks as impacting “dozens of supermarkets” in seven European countries including Belgium, Luxembourg, Estonia, Ireland, Sweden and Finland. Spokespersons from several supermarket chains like France’s Carrefour, Belgium’s Ahold Delhaize and Colruyt Group, and Sweden’s Coop chains confirmed varying but relatively limited impacts from the new attacks.
In a Nov. 2 statement, Carrefour said a cyberattack targeting its refrigeration systems had impacted 15 out of 700 stores in Belgium. In an undated statement, US-based Copeland, which manufactures technologies for regulating commercial refrigeration systems, alluded to a cybersecurity incident affecting refrigeration systems in France, which it said related to a discontinued generation of supervisory controllers.
No individual or group has claimed responsibility for either the first or the second wave of attacks, and the motivation behind it remains a mystery. European authorities are currently investigating the attacks.
An Age Old Issue: Skipping Basic Cyber Hygiene
Researchers, including those at France’s CERT, have linked the hacks so far to Internet-connected refrigeration controllers made by Denmark-based Danfoss, Italy-based Dixell, and Copeland. Organizations using these controllers often connect them to the Internet to enable remote maintenance and support, but in doing so also potentially expose them to unauthorized access and remote attack by threat actors.
Risks include unpatched vulnerabilities in these technologies that attackers can exploit, like three in Danfoss’ AK-SM 800A controllers that researchers at Claroty disclosed this August and another two they reported the same month in Copeland controllers. Weak configurations and poor security hygiene are also other major problems.
“Misconfigurations and systemic hygiene failures represent the vast majority of the threat surface,” says John Gallagher, vice president at operational technology (OT) and Internet of Things (IoT) security vendor Viakoo. “While unpatched vulnerabilities exist in older firmware, they are rendered dangerous only because basic architectural hygiene was skipped, especially [when] making them Internet-facing.”
Common mistakes include widespread use of default passwords, vendor-shared service codes, or static credentials across hundreds of locations makes brute-forcing trivial, Gallagher adds.
The Broader Cold Chain Exposure
The weaknesses are not confined to supermarket refrigeration systems. The same combination of Internet connectivity, remote access, and inadequate security practices can put temperature-controlled infrastructure across other critical sectors at risk, according to security experts.
Sean Tufts, field chief technology officer (CTO) at Claroty, points out that “pharmaceutical storage and distribution, food distribution centers, and industrial facilities all rely on connected operational technology to maintain precise environmental conditions.”
The level of exposure will vary depending on how these systems are deployed, connected, and secured. But many organizations that rely on remotely accessible refrigeration or temperature-control equipment face similar challenges around asset visibility, third-party access, and securing legacy systems, Tufts says. “The same types of weaknesses can exist across different industries, even if the equipment and operational requirements differ.”
The potential consequences of a compromise, says Tufts, can vary by sector.
“A disruption to pharmaceutical storage could compromise temperature-sensitive medicines, while an incident affecting food distribution could lead to spoilage and supply chain disruptions,” he notes. “Industrial environments may face additional operational consequences depending on the materials and processes involved.”
The supermarket attacks are a reminder that refrigeration and temperature-control systems are part of essential operations and not just back-of-house equipment, Tufts adds. Organizations should identify these assets and know how they connect to the Internet and third parties.
“Where remote access is necessary, use a VPN, strong authentication, or a centralized secure-access tool with session tracking.” Changing default passwords, keeping firmware current, and segmenting are also recommended security practices, he says.
Gallagher says that while it’s unclear how the attacks on the commercial refrigeration systems played out, the most straightforward theory is the threat actor likely compiled a target list by scanning the public Internet for specific controller fingerprints, such as those tied to Danfoss, Dixell, and Copeland. They then likely deployed an automated script across that target list to exploit known web vulnerabilities or push default credentials, triggering the defrost mode simultaneously.
Gallagher says the same attacks that worked on commercial refrigeration systems can potentially work across almost any form of OT and IoT systems. That’s because these systems often are managed outside of IT, lack automated controls to keep firmware and passwords updated, and have porous network borders. “The growth over the last three years in operational ransomware and in cyberattacks causing physical damage shows that these attacks are on the rise and not specific to any one kind of system.”
Read more about:
