Looks like that specific vulnerability was found this summer, disclosed in coordination with the vendor and at least some models were patched [0] (unclear if all models were), but from early reports:
- they either didn't warn their customers this was a critical security patch,
- many of these fridges/freezers were directly accessible on the internet with their own 3G/4F SIM cards without further protection!
> While they may be known across the world as ‘French fries’, there’s nothing French about them. The name ‘friet’ comes from patates frites, Belgian-French for ‘fried potatoes’. One possible explanation for the association could have been formed in the First World War, when American soldiers were introduced to ‘fried potatoes’ in Belgium, but thought they were in France because that was the language spoken in that region. Whether you call them Flemish or Belgian, our delicious fries are made from bintje potatoes per tradition, and are the tastiest you’ll find anywhere on the planet.
Honestly, if you ever come to Cyprus and get good fries from the potatoes here, freshly cut and fried…
The Belgian fries have no leg to stand on, nothing. Sorry. Just my opinion :) but I’ve been a life long fries lover from Germany - and these beat out all other fries I had so far in Europe at least by a wide margin :P
I know it wasn’t your article but I wanted to spread this important knowledge to the world!!
This is pretty interesting as the Danfoss vulnerability was suspected to be related to a similar situation that occurred across US military bases in late August 2026.
immediately thought of this article as well. really interesting. I could imagine someone using options/futures or other obscure financial instruments to make some money off this. hard to think of other motivations
I think Russia is doing random stuff of the kind, my understanding is it’s just about sawing general chaos, not doing a strong action that would be discussed at a diplomatic level.
This feels exactly what Russia has been doing for a couple of years. Not saying they did it this time, I have no idea. But it would be very much in character.
I’m not sure it’s them. But I just watched a video saying that the whole diesel thing is just a troll, it will neither solve the US nor Russia’s problem (the deal is way too small for both sides) but sow discord between the US and Europe for Putin and be a pre-election performance for Trump.
Yes, it's reportedly between 0.9-3 days of USA consumption of diesel ... but it does give Russia dollars to exchange for weapons.
Recall Trump's regime refused at one point to sell weapons to Ukraine.
Continually undermining the leader of a country who's defence prevents Putin's expansion and further war in Europe ... it's not 'discord' it's absolute treachery.
You seem surprised that a nation who invaded Ukraine unprovoked and has regularly gone out of their way to target civilians and has been found guilty of violating the Geneva Convention would carry out exactly the kind of hybrid warfare they have a reputation for. Curious.
Daft pot calling seemingly surprised kettle black!
It was very clearly communicated before the war with Ukraine that the trigger was the threat of Nato expansion into Ukraine. So, don't be daft, Europe and many US administrations wanted war with Russia, they constantly poked the bear with Nato and Maidan and Nordstream since the 90's, and they finally got one.
The truth behind this freezer attack could be Europe's crossing into Russian territory and droning their petroleum infrastructure using Ukraine as the launchpad, and this is Russia is retaliating by hitting some soft targets.
OR, the truth could be America/its factions are drone attacking Russian diesel and independently China is attacking Europe to create chaos. Maybe China and America are secretly working together to get Russia and Europe into a war.
Or the truth could be some qanon teenager in his basement shutting down French coolers for lulz and that has nothing to do with Ukraine, diesel, or anything else.
Curious you would assume it's Russia Russia Russia when no one knows anything and good luck finding out.
"Comfy is easy for kids and adults to pick up. Modeled loosely after the classic BASIC computer language and designed for early readers, Comfy's linguistic rules are easy to teach and to type-in on desktop, tablet, and mobile." -David Woldrich
"It is practically impossible to teach good programming to students that have had a prior exposure to BASIC: as potential programmers they are mentally mutilated beyond hope of regeneration." -Edsger Dijkstra
I suspect we agree on some fundamentals, and I slice the problem differently than you. It's a complicated enough topic that we can allow there to be a nuanced discussion.
An innocent victim does not deserve to be attacked. The people of Ukraine are innocent victims, in my opinion.
ALSO, in my opinion, the leadership of Ukraine are puppets and corrupt. The world leaders who keep them there are responsible for fomenting disastrous war and keeping it going rather than suing for peace before hostilities began.
America is particularly dupicitous on Ukraine, funding and extending the war for years to the tune of hundreds of billions with kickbacks galore, providing intelligence and satellite support for counter attacks on Russian oil while now simultaneously making Russian diesel deals. Absolute clown world.
I don't wash my hands of any of this and I never want war, but my opinion doesn't carry far. I acknowledge war happens without my consent, and I am allowed to speculate why it happens even while propaganda runs thick from all corners.
So, perhaps where we may disagree the most is whether the west was/is making provocative and consequential moves using Ukraine as a sacrificial pawn or not.
I have no idea what or whether you think, but I am curious if you believe I am in error.
DonHopkins! I am gratified you felt inclined to look into me so much! It is hard to get noticed these days, and you know I'm not a bot, which is great. I wish your comment wasn't made dead.
I worry about the elitist BASIC hate too, but many of us cut our teeth on BASIC and turned out fine, so it is my hope the great unwashed masses will naively appreciate my efforts someday and likewise benefit. I like to think the Comfy language is rather more like a veneer over JavaScript with sane defaults and so is more powerful than BASIC.
Microsoft had personas back in the day for the different types of developers in the world. The .Net guys were 'Elvis' and the visual basic guys were something unflattering like 'Wilbur'. It's fine, I don't mind being called a Wilbur.
Anyhow, thanks for caring about me as a person, it means a lot to be recognized. Have a great day!
We funded them hundreds of billions, give intelligence, sell them drones, allow our mercs into Ukraine to fight russians on the ground, we sponsored Maidan before that, biolabs, NATO encroachment. America has done a lot in Ukraine!
> Not surprised they would hack systems, surprised they would spend their efforts on shit like this that doesn't have any real impact
Okay, let me explain why this is wrong. This will be an imperfect example, but hopefully it gets the point across.
When you shut down the refrigerators and freezers of something like 700 stores, people notice. They go to get food that day, and there is nothing fresh. Nothing. Go to the next store, still no fresh or frozen food.
Was there a natural disaster? No. Was there an attack? Yes, but the attacker is unknown. But who was in charge? Who was supposed to prevent this? They remember.
It's getting colder outside in the North, fall is here. This is traditionally a time where a lot of people were, for thousands and thousands of years, stocking up food and doing final harvests to survive the long winter.
If suddenly hundreds of stores don't have fresh food across the country, that is a large impact. Not even just what happened, but what could happen. If it happened to these hundreds of stores, what about thousands? What about other types of stores? What about other types of attacks? And your brain starts thinking about the other possible type of things that might be able to be fucked with remotely. The fear sets in. People that are afraid make less rational decisions. Maybe they also decide the current people in political power aren't fit for task, because they can't keep them safe. Maybe this didn't happen under the other guys.
Meanwhile, millions of dollars of food was just wasted. Not only that, but it also has to be disposed of. Because it's such a large amount of food, it will take additional trips from the trash disposal service. They may even bring people in on overtime across the country. The people at the stores themselves will probably work extra hours, quickly trying to rotate the bad food out and hopefully (now if not soon) get the new food in. In addition, the food logistics network has to get additional shipments of food it wasn't expecting to transport to hundreds of stores. That's a lot of extra time on the road, a lot of extra wear on equipment. It also stresses the food supply and production itself.
So I don't know what "doesn't have any real impact" looks like to you, but to summarize, this is going to do millions of dollars of economic and political damage, and contributes to social upheaval. It probably cost next to nothing to actually attack.
>but to summarize, this is going to do millions of dollars of economic and political damage, and contributes to social upheaval
millions of dollars of economic damage sure, it doesn't contribute to social upheaval. It's a one time pain in the ass, this seems pretty hysterical tbh
Purpose could also be to show “look what we can do” and citizens will think they are more powerful than they are and think “what’s stopping them from causing a nuclear meltdown or releasing all the water in a water resovari”?
Remember lots of Russian tactics is pretending they can do a lot of bad stuff if people don’t do what they want. “Stop helping Ukraine or we will nuke you”.
Also USA has been pinning every single cyber attack on Russia/Iran/NK/China for several years, and I am personally very doubtful that western countries do not run ransomwares. In any case the result is that everyone thinks those countries do have the capability to do this.
Possibly, but I bet most of their nuclear stockpile hasn't been kept maintained and it wouldn't surprise me if parts of it had been stolen to be sold. This is why Putin threatens a nuclear attack, but doesn't do it as there's a good chance it would show how many duds they have (also setting off nukes would likely force a response from other countries).
Should we (the EU?) have sent weapons to the Venezuelan opposition in 1999? When exactly did Chávez become a dictator? He was clearly not a democrat (coup attempt in 1992) but I think it would have been premature and unlikely to have had good outcomes if we had done it in 1999 or 2000 (he was democratically elected both times). He was obviously a dictator when he died in 2013 but a large part of the Venezuelan population still hadn't cottoned on to it or they thought it was great.
Iran was similar. The crazies were quite popular in 1979.
They aren’t in NATO in large part because of the clause preventing participants in active conflict from joining, and because a few key politicians in NATO states are unduly influenced by Russia.
France has presidential elections coming up next year, and growing civil unrest is happening. Cyber attacks are routine, and several have been officially attributed to Russia.
Anything that can trigger fear can elicit irrational reactions. That has been a known propaganda tool since forever.
> Every society is three meals away from revolution.
Well, yes and no. It increases the pressure on people in power. More pressure, more mistakes.
In this case the question is, if US Army freezers were hacked earlier, why did nobody brief other operators of cooling equipment. Its a failure at the top! Everyone is getting flustered and knives are out.
But maybe they could not fix the underlying software or whatever and were not ready to share details without opening themselves up to more attacks. Also there are a lot of attacks happening all the time, which ones do you share?
If the psychological pressure at the top increases, more mistakes will be made. Sometimes mistakes can be subtle over or under reactions, sometimes the mistake is not to do anything. It is real effort to evaluate an appropriate response. For example, the military could reach out to commercial operators quicker, but then they have to handle all the comms, questions, and they also potentially leak more attack vectors. The commercials also start having this overhead of having to read emails from the military and internally those orgs have to deal with that overhead in comms to evaluate the seriousness.
This is a problem, because very few orgs have spare capacity for this stuff and so they have a choice. They can react to the military comms and risk mistakes somewhere else due to comms / management bottlenecks, or vice versa. There are only bad choices. And every time this happens, another choice has to be made.
Lots of these will be low-level attacks with manageable impact, which lowers the alertness over time, until that moment when something serious happens. If at point everyone is exhausted a real costly mistake will happen. Its the long game.
In this case, I am sure a consideration was that the attack was already used against high-profile cases and it makes sense to just use the attack vector more broadly before it gets closed.
They used drones to block airports across Europe (I ended with overnight stay after they attacked Eindhoven) - this one has no direct proof, but it was obviously Russia.
"Russia has never hatched, is not hatching and will never hatch any plans to attack anyone," he stressed. "Russia is a peaceful country, which is interested in good relations with its neighbors." -- Kremlin spokesman Dmitry Peskov
---------
that is just recent, if you look for older then say Beria is case where accurate depiction would be criticized as not realistic and ridiculous
It's been cartoonish for over a decade. An elderly spoiled rich kid is running the USA into the ground along with his playmates starting wars he said he wouldn't. Another elderly infantile man is upset one of his vassal states had a tantrum and invaded it. Some other children got really angry after a terrorist attack and retaliated with 100x casualties in a "nah nah nah we got more bombs than you." A shrewd child is turning his industrial power house into a large technopanopticon while selling it to other nations along with debt traps all while eyeing a former sovereign territory for takeover.
At this point I would rather vote for actual cartoon characters like Daffy Duck or Goofy. Duck Season FIRE!
Russia's idea of hybrid warfare means doing things like dragging anchors across internet cables and paying people to firebomb warehouses and businesses.
Good. I’m not happy that this happened. That’s a large financial loss. I don’t like thinking about all the good, edible food thrown away instead of nourishing people. But the infosec thing that keeps me up at night is the utter lack of SCADA security. “Relax! This dam won’t collapse as long as no one guesses our public IP address!”
Lots of industrial controls haven’t been updated since they were deployed in the 90’s. “And why should they be? If it ain’t broken…” Well, because they’re freaking broken!
So I’m glad that this happened in a tangible, public way people can easily understand without it involving something much more drastic. If your family asks about this, explain that you’re glad no one blew up a gas pipeline… yet.
There is certainly a need to raise awareness of the danger of connected/online devices. If something is connected to the public Internet then it can be attacked. If something has built-in wireless connectivity then it can be attacked. Unfortunately it really is as simple as that. Safeguards are needed accordingly.
Connected vehicles are the example that terrifies me the most. There have been numerous examples of lax security in this area already and a fleet of rogue cars or delivery trucks could obviously cause huge amounts of damage, injury, and loss of life.
There's a legacy of openness in car tech and software that was never designed with robust security and isolation of critical components in mind. I've heard that this has started to change more recently and that's reassuring if true. But this still feels like an area with far too little regulation or oversight given the past choices of vehicle manufacturers and far too much rush to connect everything up remotely even for minor convenience reasons.
In some cases there also now seems to be legally mandated connectivity for things like automated emergency calls after an accident. This should at least have a genuine benefit in the unfortunate situation that it's needed - but until vehicle security looks more like Fort Knox than a sandcastle it might still prove to be a bad choice in the end.
> Connected vehicles are the example that terrifies me the most.
Fortunately, there is a straightforward solution. Find the cellular modem fuse and pull it. You now have a modern, but fully offline car. Security aside, connected cars are absolutely awful for your privacy.
That's a workaround, not a solution. And a partial one at that since it only affects your own vehicle; you'll still be in danger from other people's connected vehicles.
Unfortunately that straightforward solution might also compromise other aspects of the vehicle and/or might also be illegal if it disables a mandatory safety system.
The "straightforward" solution is to tell vehicle manufacturers that they aren't allowed to sell vehicles with connectivity unless they also have proper security and privacy protections in place. If no-one can give them money for it then they won't do it.
> illegal if it disables a mandatory safety system.
I am not aware of such a requirement in the U.S. In any case, it would be extremely difficult to enforce, and many cars that initially had connectivity went offline when 3G networks were decommissioned. I doubt those cars are now "illegal."
Oh, one of my pet peeves: "if it ain't broken don't fix it"? Then you're going to fix it when it's broken, everyone is screaming at you, there's little time, and cannot reason clearly ... what a stupid saying.
That's funny, last I checked my fridge keeps food reliably cold with no internet connection, and most supermarkets have people around all the time to notice such a failure, a plan around such a failure, and expect to have such a failure periodically since fridges break down anyway.
Meanwhile you can use analog gauges if you need perfect max temperature monitoring.
That's what always pisses me off about this. Someone brought up "Hey, if we connect this to the internet to enable that feature, someone will start hacking fridges and hurting our customers, and I don't think the stupid page with a temperature graph on it is worth that tradeoff", and some ass told them to get over it and implement it.
Raymond Chen used to write about feature development at Microsoft, specifically how every single new feature idea started from a negative position, since it requires support and testing and engineering and thought, and has future repercussions, so it's often not a good idea to just add box checking features.
Microsoft believed this in the 90s. For things like UI functionality. That's the effort and thought and restraint required to have a consistent UI, for things to be thought out.
Somehow, between then and now, the industry threw all that thought away, and now everything has 400 totally unused, half implemented, utterly broken features.
Why are we here? "Move fast and break things" just breaks everything eventually. Someone, somewhere, eventually has to fix stuff.
To not control any industrial processes remotely? I hope you realize that requiring that would make solar and wind farms completely non-viable, among many, many other things.
I'm interested to know how many "legacy" controllers no longer patched by the manufacturer are operating solar and wind farms today.
If it's a lot, maybe the manufacturers should be compelled to provide security patches if remote control is required to operate their products. For the sake of national security, of course.
Seems like 95% of devices could be managed with a hardware filter that only allows through a handful of very rudimentary signals (more like Morse code than a full digital transmission), and then of course a properly designed on-device API that defines those signals and doesn't allow you to trigger a defrost remotely, when that should only ever be done with somebody physically present for example.
How exactly would a more obscure (or even “analog”) encoding help? This seems orthogonal to reducing surface complexity and remotely executable command subsets.
The point is having the digital transmission simple enough that you can use fully *physical* filters to discard everything but the 3-4 messages you need through. Of course it is still digital, but my point is, it is a physically enforced studied, safe subset and doesn't allow for full network access. There are of course a variety of ways to further firewall that, but something needs to act like as much of an air gap as possible while allowing for remote communications.
How do you authenticate such a system? 3-4 “quasi analog” messages seem incredibly easy to replay, if nothing else. If you need to depend on something actually cryptographic to make the system replay proof, you can just as well use that system for all aspects of access control. This makes no sense.
Well it would receive control signals from an on-site relay server with the hardware to communicate with it, and that would of course also be firewalled and use encryption to communicate with the outside world. That server could always in theory become compromised despite your best efforts, so the benefit is obvious: don't create even the theoretic possibility of being hacked by a class of message that should never exist.
The idea is not to solve everything with one simple trick, but to reduce the attack surface as much as possible in hardware. If you are dumb enough to make your 4 messages something like off, on, hard reset, random dangerous maintenance protocol, then it does nothing. If instead it encodes 4 useful and typically used states that can't destroy your system, then you have massively reduced the requirement for onsite, and accepted that more serious issues require onsite control.
Oh, so basically, reduce the vocabulary that can be communicated remotely compared to what's available locally? I can get behind that.
It's not an easy balance to strike, though; the less capable the remote interface is, the less useful it is. "Only completely harmless commands" might simply not be good enough. For example, is "deactivate electricity output of this solar panel" (e.g. because market conditions make it unprofitable to supply at a given instance) harmless or not? What about "increase supplied frequency by 0.01 Hz to stabilize the grid"?
Defrost cycles do not require someone to be physically present. These are happening multiple times per day, per evaporate, per cold box. A moderate grocery store or cold storage warehouse will have dozens, it not hundreds, of defrosts per day. They NEED central dispatching and/or remote controls. Controls engineers have already thought of these things. They DO depend on rudimentary signals to schedule these events and coordinate defrosts so that only a selection of evaps defrost at a time and the box can maintain cold temps. It also promotes temperature stability, energy efficiency, and keeps equipment from being overloaded.
Leased lines, MPLS, custom routing setups, hell just a VPN that fails closed. There are so many options for doing this, all more secure that just slapping a device online behind whatever router the cheapest ISP gave you.
The problem is that many of these setups are put behind essentially consumer connections, but with a better support contract or simply fitted with a 5G modem and a SIM card from the cell provider with the cheapest plan.
Building a WAN isn't magic, but it does require working with (competent) ISPs and paying the higher cost.
Of all the things to put on a network, this ranks as one of the dumbest, ever. You don't need control of the unit done over a network, just the data on whether it is working or not. Anything else is simply asking for someone else to come along and break your stuff.
To boot, refrigeration has been wholly automatic for decades. It literally runs itself. It doesn't need any network connectivity other than to say "I work" and "I'm broken" and that's it. Allowing control commands to be sent over the network is, yet again, just asking for trouble.
This was a solved problem long ago - page/text the person responsible for that facility. If Fac. Man. is too lazy to properly-staff critical things, they deserve every pain they encounter.
All of this remote crap is meant to try to eliminate a physical presence on-site, which is stupid because when things eventually break, a physical presence is required on-site anyways.
One of my jobs in aerospace is systems reliability - an unstaffed system is not a reliable one.
Maybe, just maybe, fridges shouldn't be online. Cue immediate responses of: but don't you understand, management can now monitor it 24/7 and adjust in real time. To which I have about the same response:
Monitoring would be one thing, but there's almost no conceivable reason to allow setting the temperature or triggering a defrost cycle remotely. When was the last time you changed the temperature setting on your fridge or freezer? It's something you set once when you install it and then never touch again.
This kind of inspector gadget "smart tech" lunacy has infected basically all consumer products. It's got to stop.
> This kind of inspector gadget "smart tech" lunacy has infected basically all consumer products. It's got to stop.
Absolutely, and this is why I refuse to connect any home appliances to the Internet. I have a limited number of Zigbee devices, and they are managed through Home Assistant and can't access the Internet.
> When was the last time you changed the temperature setting on your fridge or freezer?
Then again when was the last time you opened your freezer hundreds of times during one day, letting humid air in and building ice at an accelerated rate? These freezers actively heat up the back of the freezer (evaporator plate) nightly to quickly melt the ice without warming up the food.
There is no reason to directly trigger it remotely but they probably work on a customizable schedule, to account for different store opening times, timezones, or freezer size and model. The hackers probably changed the schedule to make the defrost last longer.
You're right, a commercial freezer is a different beast than a household one. But what good does it really do anyone to be able to adjust that defrost schedule remotely? Surely the personnel on site are the ones best equipped to schedule the defrost cycles of their equipment?
Within a store certain freezers get more traffic than others, depending on how they're stocked, where they're located, etc, and therefore likely require more frequent defrosting. But that's something the store managers can figure out. It doesn't need to be managed remotely by some third party. So why did someone engineer that capability?
More features, generally, means more failure modes. More ways to exploit the system. Adding fringe features that aren't actually necessary (or desired) has become a strange industrial compulsion. It's very unhealthy and disordered behavior from an engineering standpoint--sacrificing reliability and simplicity for... what exactly? Some centralized control capability? But why?
That's like saying the store manager should manage the store website and networks instead of the chain's IT department.
No grocery store manager is going to be a licensed refrigeration technician. Ask them if they know about basic refrigeration concepts like superheat and subcooling, high side and low side pressures, compressor oils...
Further, a grocery store wants to optimize efficiency down to the percent, because that will save tens of millions of dollars over the fleet, and CO2 emissions. A store manager hardly has the capability.
You're confusing specialized refrigeration maintenance (which, at least in the US requires EPA certification) with general end user operations tasks. It is the store manager's job to know how to operate, optimize, and take basic care of their equipment. Just like it's an excavator operator's job to know how to check the fluids and grease the machine. They don't need to rebuild the engine or do specialized maintenance like lineboring, but they are responsible for basic care of the machinery.
To be clear I don't think the defrost schedule is the way the hackers enabled this or else every device would be affected. The older devices probably connect to the SaaS server in an insecure way and could be exploited en-masse.
> Surely the personnel on site are the ones best equipped to schedule the defrost cycles of their equipment?
The purpose of the automation is the same as always, to run at peak effectiveness and reduce human error. Most of the workers in this industry much like the fast food one, are low paid, low skill, receiving only basic training, with a high turnover rate, across tens of thousands of locations from major cities to somewhere in the sticks. Even a disgruntled employee can do a lot of damage that's only obvious too late. So this extra work is taken out of their hands. You should really see a lot of the machines the big fast food chains use, you'd be amazed.
This kind of decision was never left to the store manager. In the past they'd get a printout and probably fail to follow the instructions occasionally, which may or may not cause damage or increases operating costs across the entire fleet. Now it's done over the network like everything else, for better or worse.
They only managed to hack a small subset of older freezer models that couldn't be patched which makes me think they've done a decent job at securing them so far. Hiring more people and implementing even more security and hybrid remote+local model, or losing efficiency over tens of thousands of locations costs more than the spoiled food. With the tools available today though, it's an uphill battle to keep thinks connected and secure.
I'd be fascinated to know how much impact on TCO remote control actually has. There's definitely an economy of scale argument, if you can make tens of thousands of devices a couple percent more efficient that has a real impact, but does the remote control capability actually move the needle that much?
There isn't a complex real time control scenario here.. Obviously defrosting too much wastes energy, so you'll want to get that one right. But does having centralized control over that really make a difference at scale? Does having centralized control over temperature set-point make any difference?
From the basic physics of the process it's hard to imagine real time remote control being a decisive factor in efficiency.
> I know you had a solid 5-10 minutes of though on the topic but for supermarket chains that's how they manage to operate cheaper, that's how they don't increase the cost of the food.
I mean.. maybe? But nothing you wrote actually demonstrates that.
Like the other poster mentioned, blanket statements like this ignore the incredibly smart people at major international corporations and their strategies.
I have a smart fridge and washer. I won't name names. But for several years they were never connected or online at all (unless they was compromised and I didn't know). I connected them and one of the first updates included in the washer was changing the default wash cycle from something like 110 minutes to 46 or something. I don't remember all the values if I'm honest.
There are executives who have spreadsheets and charts of how much water that saved per household over varying periods of time. How much it would save with greater adoption. And the unsaid message, or maybe they'll be explicit, of how many people are going to face tragic water supply issues in the future.
It's a powerful message, even if we know it's cyncical and calculated to push not just washers, but firmware security systems and institutions to govern those systems.
And yes, compromised systems can also be used to build zombie networks to push horrible content.
I feel horrible that this critically important surface issue of water supply is used to push other agendas. I honestly wish I could do other work not related to it.
<< ignore the incredibly smart people at major international corporations and their strategies.
Ignore may be a tad strong. I am merely asking for hardware that is subject to my control to be within my control. I think somewhere along the way executives got a little to comfortable saying 'they will buy what we give them'.
More to the point, maybe there is exactly too many smart people with agendas that don't seem to align well with my current needs vis-a-vis fridges:
I want something that keeps things cool with minimum of fuss and does not die upon update.
In short, that executive should be fired as they are not doing their job: they are actively undermining their own market.
>Ignore may be a tad strong. I am merely asking for hardware that is subject to my control to be within my control.
Which is how they got into this situation. These are industrial refrigeration systems subject to a huge list of variables (how many units, their sizes, and doors hooked up to a refrigeration circuit, open vs closed cases, ambient conditions, hours of store operation, what type of refrigerant, whether heat is going to a cooling tower or air heat exchanger). They use a ton of energy, and percent optimization leads to millions of dollars over a fleet. They are designed to let the user dial in every operating parameter, like defrost.
Compare this to my home fridge where all these parameters are fixed in the firmware because the hardware is 100% identical.
Industrial systems are necessarily different from mass-produced home appliances.
Agree. I don't want fridge company or anyone else to turn my fridge into residential proxy with its access sold to the highest bidder to build web scrapers.
It's not a maybe. They simply shouldn't. The level of idiocy of not only management but also those who implemented the "security" protecting those online fridges cannot be understated: we're talking about real dumbfucktards.
I see such idiots daily, in all venues of life: the world is simply really full of dumbfucks.
It's simply how things are and we shouldn't be afraid of pointing it out.
Interestingly, a major Dutch supermarket was also hit by a yet-undescribed cyberattack, prompting them to basically shut down every IT system. So not a hack of a control system, sounds more like an ordinary ransomware attack... but still tantalizing that two EU countries have their food supplies targeted the same day... the day of a big NATO "russia we dont mess around" conference, too.
It really, really irks me that in one of the articles about this, it mentions the manufacturer pointing to "outdated firmware", and even comments here demeaning the store for not "securing" their __refrigerators__. Read that twice, and think how many times this silliness could apply to far too many objects in our lives.
Very few things should be networked, or at the very least, not with any sort of control. I can't even blame the average person anymore for not being as aware about technology, unless there's some sort of aggression or dismissive responses when they're informed of the risks or potential risks. Software developers at this point may very well end up being as despised as lawyers or bankers, for not broadly enough condemning this sort of technological creep, but for being that guy smugly saying something about firmware updates ... on a refrigerator.
Something different came to mind as I read this article - there has been recent chatter regarding impending Food security issues - it was even talked about by India's foreign minister recently:
These are fridges in supermarkets, not home fridges. I think a supermarket capable of administering many fridges can put their big boy pants on and handle the potential downsides of controllability.
So, those fridges are in the supermarkets, right? Where people work, who have to empty a fridge before it can be remotely defrosted. Why can't those people just press a defrost button? What is the point of doing defrosting remotely when you cannot do it without the onsite support?
That's way the non-smart walk-in coolers work; every 12 hours they turn off the fans and heat the cooling element for about 15 minutes to melt any ice that's built up on it.
Ice anywhere else is treated as a separate problem and turning the cooler off to fix it is not typically an available option.
>Where people work, who have to empty a fridge before it can be remotely defrosted.
You don't empty a fridge with built-in defrost. Your home fridge defrosts itself every 12-24 hours and you don't have to do anything.
Normally, the temperature recovers in ~1 hour after a defrost. The attack is apparently chaining manual defrost commands one after another so that the interior gets way too hot.
> Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.
I feel like this is kind of holding the supermarket hostage and saying, “Sure your freezer is working fine, but if you refuse to buy new freezers from us prepare to get hacked.”
Sure you can argue that the supermarket should have just taken the old freezers offline. But you can also argue that the manufacturer could have supplied software updates but didn’t in order to force sales of newer models.
If that’s the case, then supermarkets (who are not in the cybersecurity business) should feel good about filing a claim with their insurance. The insurance company can decide whether the freezer maker owes existence-risking damages.
Maintaining old hardware to 2026 security requirements is damn near impossible, and what constitutes "old" is very variable; HOWEVER putting them behind a dedicated VLAN+firewall+VPN is not that hard.
I've helped do it for industrial equipment (win95 controller or something) that couldn't be upgraded without spending millions, but it sill required pulling out the old 10base2 network and installing cat 6 cables in a factory floor and new switches.
1 data point of Yep.
I went to my local Monoprix to grab a few things during lunch break. For some reason they seemed to have suffered a fridge incident, good for me I didn't need anything from those aisles. I did wonder if it was just a recent problem or if a more sneaky malfunction had silently semi-spoiled some of the products I brought back days before, until it just blew over.
152 comments
[ 3.8 ms ] story [ 35.5 ms ] thread- they either didn't warn their customers this was a critical security patch, - many of these fridges/freezers were directly accessible on the internet with their own 3G/4F SIM cards without further protection!
Crazy stuff
[0] https://www.claroty.com/team82/research/freeze-the-controlle...
No one has to answer for an obviously dangerous risk, not even the company? Ship it!!!!!
Source: https://www.visitflanders.com/en/discover-flanders/culinary-...
The Belgian fries have no leg to stand on, nothing. Sorry. Just my opinion :) but I’ve been a life long fries lover from Germany - and these beat out all other fries I had so far in Europe at least by a wide margin :P
I know it wasn’t your article but I wanted to spread this important knowledge to the world!!
https://signalandsilence.substack.com/p/i-think-someone-hack...
Could this be the same group? Or someone inspired by reading that article? Or just entirely unrelated?
https://en.wikipedia.org/wiki/Bronze_Soldier_of_Tallinn
https://en.wikipedia.org/wiki/Bronze_Night
I mean, how dare Estonia not be ecstatic about the Soviet soldiers who kept them thoroughly liberated until 1991.
Recall Trump's regime refused at one point to sell weapons to Ukraine.
Continually undermining the leader of a country who's defence prevents Putin's expansion and further war in Europe ... it's not 'discord' it's absolute treachery.
It was very clearly communicated before the war with Ukraine that the trigger was the threat of Nato expansion into Ukraine. So, don't be daft, Europe and many US administrations wanted war with Russia, they constantly poked the bear with Nato and Maidan and Nordstream since the 90's, and they finally got one.
The truth behind this freezer attack could be Europe's crossing into Russian territory and droning their petroleum infrastructure using Ukraine as the launchpad, and this is Russia is retaliating by hitting some soft targets.
OR, the truth could be America/its factions are drone attacking Russian diesel and independently China is attacking Europe to create chaos. Maybe China and America are secretly working together to get Russia and Europe into a war.
Or the truth could be some qanon teenager in his basement shutting down French coolers for lulz and that has nothing to do with Ukraine, diesel, or anything else.
Curious you would assume it's Russia Russia Russia when no one knows anything and good luck finding out.
I read the comment as being a satirical way of voicing critique.
"It is practically impossible to teach good programming to students that have had a prior exposure to BASIC: as potential programmers they are mentally mutilated beyond hope of regeneration." -Edsger Dijkstra
An innocent victim does not deserve to be attacked. The people of Ukraine are innocent victims, in my opinion.
ALSO, in my opinion, the leadership of Ukraine are puppets and corrupt. The world leaders who keep them there are responsible for fomenting disastrous war and keeping it going rather than suing for peace before hostilities began.
America is particularly dupicitous on Ukraine, funding and extending the war for years to the tune of hundreds of billions with kickbacks galore, providing intelligence and satellite support for counter attacks on Russian oil while now simultaneously making Russian diesel deals. Absolute clown world.
I don't wash my hands of any of this and I never want war, but my opinion doesn't carry far. I acknowledge war happens without my consent, and I am allowed to speculate why it happens even while propaganda runs thick from all corners.
So, perhaps where we may disagree the most is whether the west was/is making provocative and consequential moves using Ukraine as a sacrificial pawn or not.
I have no idea what or whether you think, but I am curious if you believe I am in error.
I worry about the elitist BASIC hate too, but many of us cut our teeth on BASIC and turned out fine, so it is my hope the great unwashed masses will naively appreciate my efforts someday and likewise benefit. I like to think the Comfy language is rather more like a veneer over JavaScript with sane defaults and so is more powerful than BASIC.
Microsoft had personas back in the day for the different types of developers in the world. The .Net guys were 'Elvis' and the visual basic guys were something unflattering like 'Wilbur'. It's fine, I don't mind being called a Wilbur.
Anyhow, thanks for caring about me as a person, it means a lot to be recognized. Have a great day!
John No-Name McCain apparently did get a street named after him in Ukraine in 2019. The world is so broken. ;(
There was a vote to get Lindsey a street named after him after he was unalived, but the votes fell short.
Okay, let me explain why this is wrong. This will be an imperfect example, but hopefully it gets the point across.
When you shut down the refrigerators and freezers of something like 700 stores, people notice. They go to get food that day, and there is nothing fresh. Nothing. Go to the next store, still no fresh or frozen food.
Was there a natural disaster? No. Was there an attack? Yes, but the attacker is unknown. But who was in charge? Who was supposed to prevent this? They remember.
It's getting colder outside in the North, fall is here. This is traditionally a time where a lot of people were, for thousands and thousands of years, stocking up food and doing final harvests to survive the long winter.
If suddenly hundreds of stores don't have fresh food across the country, that is a large impact. Not even just what happened, but what could happen. If it happened to these hundreds of stores, what about thousands? What about other types of stores? What about other types of attacks? And your brain starts thinking about the other possible type of things that might be able to be fucked with remotely. The fear sets in. People that are afraid make less rational decisions. Maybe they also decide the current people in political power aren't fit for task, because they can't keep them safe. Maybe this didn't happen under the other guys.
Meanwhile, millions of dollars of food was just wasted. Not only that, but it also has to be disposed of. Because it's such a large amount of food, it will take additional trips from the trash disposal service. They may even bring people in on overtime across the country. The people at the stores themselves will probably work extra hours, quickly trying to rotate the bad food out and hopefully (now if not soon) get the new food in. In addition, the food logistics network has to get additional shipments of food it wasn't expecting to transport to hundreds of stores. That's a lot of extra time on the road, a lot of extra wear on equipment. It also stresses the food supply and production itself.
So I don't know what "doesn't have any real impact" looks like to you, but to summarize, this is going to do millions of dollars of economic and political damage, and contributes to social upheaval. It probably cost next to nothing to actually attack.
(This is also right out of Russia's hybrid war playbook against Europe. Russia just sank a Bulgarian tanker btw: https://www.bbc.com/news/articles/cmn06w5x9g25o )
millions of dollars of economic damage sure, it doesn't contribute to social upheaval. It's a one time pain in the ass, this seems pretty hysterical tbh
Remember lots of Russian tactics is pretending they can do a lot of bad stuff if people don’t do what they want. “Stop helping Ukraine or we will nuke you”.
Also USA has been pinning every single cyber attack on Russia/Iran/NK/China for several years, and I am personally very doubtful that western countries do not run ransomwares. In any case the result is that everyone thinks those countries do have the capability to do this.
Possibly, but I bet most of their nuclear stockpile hasn't been kept maintained and it wouldn't surprise me if parts of it had been stolen to be sold. This is why Putin threatens a nuclear attack, but doesn't do it as there's a good chance it would show how many duds they have (also setting off nukes would likely force a response from other countries).
No, the reason is that he's not completely insane and doesn't want to cause a nuclear war as you seem to presume.
Remember that USA had the "strike first" doctrine that the eastern block never had.
Which their leadership never fails to mention when we (the EU) goes past some imaginary red line.
There are no red lines. There is only drone war and making Russia regret that they are attacking our allies.
Should we (the EU?) have sent weapons to the Venezuelan opposition in 1999? When exactly did Chávez become a dictator? He was clearly not a democrat (coup attempt in 1992) but I think it would have been premature and unlikely to have had good outcomes if we had done it in 1999 or 2000 (he was democratically elected both times). He was obviously a dictator when he died in 2013 but a large part of the Venezuelan population still hadn't cottoned on to it or they thought it was great.
Iran was similar. The crazies were quite popular in 1979.
France has presidential elections coming up next year, and growing civil unrest is happening. Cyber attacks are routine, and several have been officially attributed to Russia.
Anything that can trigger fear can elicit irrational reactions. That has been a known propaganda tool since forever.
> Every society is three meals away from revolution.
So I wouldn't entirely handwave it away.
In this case the question is, if US Army freezers were hacked earlier, why did nobody brief other operators of cooling equipment. Its a failure at the top! Everyone is getting flustered and knives are out.
But maybe they could not fix the underlying software or whatever and were not ready to share details without opening themselves up to more attacks. Also there are a lot of attacks happening all the time, which ones do you share?
If the psychological pressure at the top increases, more mistakes will be made. Sometimes mistakes can be subtle over or under reactions, sometimes the mistake is not to do anything. It is real effort to evaluate an appropriate response. For example, the military could reach out to commercial operators quicker, but then they have to handle all the comms, questions, and they also potentially leak more attack vectors. The commercials also start having this overhead of having to read emails from the military and internally those orgs have to deal with that overhead in comms to evaluate the seriousness.
This is a problem, because very few orgs have spare capacity for this stuff and so they have a choice. They can react to the military comms and risk mistakes somewhere else due to comms / management bottlenecks, or vice versa. There are only bad choices. And every time this happens, another choice has to be made.
Lots of these will be low-level attacks with manageable impact, which lowers the alertness over time, until that moment when something serious happens. If at point everyone is exhausted a real costly mistake will happen. Its the long game.
In this case, I am sure a consideration was that the attack was already used against high-profile cases and it makes sense to just use the attack vector more broadly before it gets closed.
“Also there are a lot of attacks happening all the time, which ones do you share?”
In Poland there were arson attacks on malls - https://warszawa.tvp.pl/95886809/pozar-marywilskiej-44-ruszy...
They also attempted to derail passenger trains - https://www.rp.pl/kraj/art43362151-rzecz-w-tym-sabotaz-na-to...
They used drones to block airports across Europe (I ended with overnight stay after they attacked Eindhoven) - this one has no direct proof, but it was obviously Russia.
Russia used list of hospitals in Syria. As bombing target. https://en.wikipedia.org/wiki/Russian%E2%80%93Syrian_hospita... https://www.nytimes.com/2019/10/13/world/middleeast/russia-b...
When Armenia complained about poor performance of Russian weapons video of one of attacks was released as proof that weapons are fine.
https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvine...
https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17
"Russia has never hatched, is not hatching and will never hatch any plans to attack anyone," he stressed. "Russia is a peaceful country, which is interested in good relations with its neighbors." -- Kremlin spokesman Dmitry Peskov
---------
that is just recent, if you look for older then say Beria is case where accurate depiction would be criticized as not realistic and ridiculous
It's been cartoonish for over a decade. An elderly spoiled rich kid is running the USA into the ground along with his playmates starting wars he said he wouldn't. Another elderly infantile man is upset one of his vassal states had a tantrum and invaded it. Some other children got really angry after a terrorist attack and retaliated with 100x casualties in a "nah nah nah we got more bombs than you." A shrewd child is turning his industrial power house into a large technopanopticon while selling it to other nations along with debt traps all while eyeing a former sovereign territory for takeover.
At this point I would rather vote for actual cartoon characters like Daffy Duck or Goofy. Duck Season FIRE!
Russia's idea of hybrid warfare means doing things like dragging anchors across internet cables and paying people to firebomb warehouses and businesses.
That's exactly what's happening.
https://brusselsmorning.com/von-der-leyen-proposes-european-...
Lots of industrial controls haven’t been updated since they were deployed in the 90’s. “And why should they be? If it ain’t broken…” Well, because they’re freaking broken!
So I’m glad that this happened in a tangible, public way people can easily understand without it involving something much more drastic. If your family asks about this, explain that you’re glad no one blew up a gas pipeline… yet.
Connected vehicles are the example that terrifies me the most. There have been numerous examples of lax security in this area already and a fleet of rogue cars or delivery trucks could obviously cause huge amounts of damage, injury, and loss of life.
There's a legacy of openness in car tech and software that was never designed with robust security and isolation of critical components in mind. I've heard that this has started to change more recently and that's reassuring if true. But this still feels like an area with far too little regulation or oversight given the past choices of vehicle manufacturers and far too much rush to connect everything up remotely even for minor convenience reasons.
In some cases there also now seems to be legally mandated connectivity for things like automated emergency calls after an accident. This should at least have a genuine benefit in the unfortunate situation that it's needed - but until vehicle security looks more like Fort Knox than a sandcastle it might still prove to be a bad choice in the end.
Fortunately, there is a straightforward solution. Find the cellular modem fuse and pull it. You now have a modern, but fully offline car. Security aside, connected cars are absolutely awful for your privacy.
The "straightforward" solution is to tell vehicle manufacturers that they aren't allowed to sell vehicles with connectivity unless they also have proper security and privacy protections in place. If no-one can give them money for it then they won't do it.
I am not aware of such a requirement in the U.S. In any case, it would be extremely difficult to enforce, and many cars that initially had connectivity went offline when 3G networks were decommissioned. I doubt those cars are now "illegal."
Meanwhile you can use analog gauges if you need perfect max temperature monitoring.
That's what always pisses me off about this. Someone brought up "Hey, if we connect this to the internet to enable that feature, someone will start hacking fridges and hurting our customers, and I don't think the stupid page with a temperature graph on it is worth that tradeoff", and some ass told them to get over it and implement it.
Raymond Chen used to write about feature development at Microsoft, specifically how every single new feature idea started from a negative position, since it requires support and testing and engineering and thought, and has future repercussions, so it's often not a good idea to just add box checking features.
Microsoft believed this in the 90s. For things like UI functionality. That's the effort and thought and restraint required to have a consistent UI, for things to be thought out.
Somehow, between then and now, the industry threw all that thought away, and now everything has 400 totally unused, half implemented, utterly broken features.
Why are we here? "Move fast and break things" just breaks everything eventually. Someone, somewhere, eventually has to fix stuff.
If it's a lot, maybe the manufacturers should be compelled to provide security patches if remote control is required to operate their products. For the sake of national security, of course.
How exactly would a more obscure (or even “analog”) encoding help? This seems orthogonal to reducing surface complexity and remotely executable command subsets.
The idea is not to solve everything with one simple trick, but to reduce the attack surface as much as possible in hardware. If you are dumb enough to make your 4 messages something like off, on, hard reset, random dangerous maintenance protocol, then it does nothing. If instead it encodes 4 useful and typically used states that can't destroy your system, then you have massively reduced the requirement for onsite, and accepted that more serious issues require onsite control.
It's not an easy balance to strike, though; the less capable the remote interface is, the less useful it is. "Only completely harmless commands" might simply not be good enough. For example, is "deactivate electricity output of this solar panel" (e.g. because market conditions make it unprofitable to supply at a given instance) harmless or not? What about "increase supplied frequency by 0.01 Hz to stabilize the grid"?
Yes you might need to be able to centrally monitor and manage things but that should be happening on a private network.
The problem is that many of these setups are put behind essentially consumer connections, but with a better support contract or simply fitted with a 5G modem and a SIM card from the cell provider with the cheapest plan.
Building a WAN isn't magic, but it does require working with (competent) ISPs and paying the higher cost.
To boot, refrigeration has been wholly automatic for decades. It literally runs itself. It doesn't need any network connectivity other than to say "I work" and "I'm broken" and that's it. Allowing control commands to be sent over the network is, yet again, just asking for trouble.
All of this remote crap is meant to try to eliminate a physical presence on-site, which is stupid because when things eventually break, a physical presence is required on-site anyways.
One of my jobs in aerospace is systems reliability - an unstaffed system is not a reliable one.
Maybe they shouldn't.
Adjust: possibly, withing a range
Shutting down: Big no no
This kind of inspector gadget "smart tech" lunacy has infected basically all consumer products. It's got to stop.
Absolutely, and this is why I refuse to connect any home appliances to the Internet. I have a limited number of Zigbee devices, and they are managed through Home Assistant and can't access the Internet.
Then again when was the last time you opened your freezer hundreds of times during one day, letting humid air in and building ice at an accelerated rate? These freezers actively heat up the back of the freezer (evaporator plate) nightly to quickly melt the ice without warming up the food.
There is no reason to directly trigger it remotely but they probably work on a customizable schedule, to account for different store opening times, timezones, or freezer size and model. The hackers probably changed the schedule to make the defrost last longer.
Within a store certain freezers get more traffic than others, depending on how they're stocked, where they're located, etc, and therefore likely require more frequent defrosting. But that's something the store managers can figure out. It doesn't need to be managed remotely by some third party. So why did someone engineer that capability?
More features, generally, means more failure modes. More ways to exploit the system. Adding fringe features that aren't actually necessary (or desired) has become a strange industrial compulsion. It's very unhealthy and disordered behavior from an engineering standpoint--sacrificing reliability and simplicity for... what exactly? Some centralized control capability? But why?
That's like saying the store manager should manage the store website and networks instead of the chain's IT department.
No grocery store manager is going to be a licensed refrigeration technician. Ask them if they know about basic refrigeration concepts like superheat and subcooling, high side and low side pressures, compressor oils...
Further, a grocery store wants to optimize efficiency down to the percent, because that will save tens of millions of dollars over the fleet, and CO2 emissions. A store manager hardly has the capability.
> Surely the personnel on site are the ones best equipped to schedule the defrost cycles of their equipment?
The purpose of the automation is the same as always, to run at peak effectiveness and reduce human error. Most of the workers in this industry much like the fast food one, are low paid, low skill, receiving only basic training, with a high turnover rate, across tens of thousands of locations from major cities to somewhere in the sticks. Even a disgruntled employee can do a lot of damage that's only obvious too late. So this extra work is taken out of their hands. You should really see a lot of the machines the big fast food chains use, you'd be amazed.
This kind of decision was never left to the store manager. In the past they'd get a printout and probably fail to follow the instructions occasionally, which may or may not cause damage or increases operating costs across the entire fleet. Now it's done over the network like everything else, for better or worse.
They only managed to hack a small subset of older freezer models that couldn't be patched which makes me think they've done a decent job at securing them so far. Hiring more people and implementing even more security and hybrid remote+local model, or losing efficiency over tens of thousands of locations costs more than the spoiled food. With the tools available today though, it's an uphill battle to keep thinks connected and secure.
There isn't a complex real time control scenario here.. Obviously defrosting too much wastes energy, so you'll want to get that one right. But does having centralized control over that really make a difference at scale? Does having centralized control over temperature set-point make any difference?
From the basic physics of the process it's hard to imagine real time remote control being a decisive factor in efficiency.
> I know you had a solid 5-10 minutes of though on the topic but for supermarket chains that's how they manage to operate cheaper, that's how they don't increase the cost of the food.
I mean.. maybe? But nothing you wrote actually demonstrates that.
I have a smart fridge and washer. I won't name names. But for several years they were never connected or online at all (unless they was compromised and I didn't know). I connected them and one of the first updates included in the washer was changing the default wash cycle from something like 110 minutes to 46 or something. I don't remember all the values if I'm honest.
There are executives who have spreadsheets and charts of how much water that saved per household over varying periods of time. How much it would save with greater adoption. And the unsaid message, or maybe they'll be explicit, of how many people are going to face tragic water supply issues in the future.
It's a powerful message, even if we know it's cyncical and calculated to push not just washers, but firmware security systems and institutions to govern those systems.
And yes, compromised systems can also be used to build zombie networks to push horrible content.
I feel horrible that this critically important surface issue of water supply is used to push other agendas. I honestly wish I could do other work not related to it.
Ignore may be a tad strong. I am merely asking for hardware that is subject to my control to be within my control. I think somewhere along the way executives got a little to comfortable saying 'they will buy what we give them'.
More to the point, maybe there is exactly too many smart people with agendas that don't seem to align well with my current needs vis-a-vis fridges:
I want something that keeps things cool with minimum of fuss and does not die upon update.
In short, that executive should be fired as they are not doing their job: they are actively undermining their own market.
Which is how they got into this situation. These are industrial refrigeration systems subject to a huge list of variables (how many units, their sizes, and doors hooked up to a refrigeration circuit, open vs closed cases, ambient conditions, hours of store operation, what type of refrigerant, whether heat is going to a cooling tower or air heat exchanger). They use a ton of energy, and percent optimization leads to millions of dollars over a fleet. They are designed to let the user dial in every operating parameter, like defrost.
Compare this to my home fridge where all these parameters are fixed in the firmware because the hardware is 100% identical.
Industrial systems are necessarily different from mass-produced home appliances.
Honestly, reality begs to differ.
I see such idiots daily, in all venues of life: the world is simply really full of dumbfucks.
It's simply how things are and we shouldn't be afraid of pointing it out.
Very few things should be networked, or at the very least, not with any sort of control. I can't even blame the average person anymore for not being as aware about technology, unless there's some sort of aggression or dismissive responses when they're informed of the risks or potential risks. Software developers at this point may very well end up being as despised as lawyers or bankers, for not broadly enough condemning this sort of technological creep, but for being that guy smugly saying something about firmware updates ... on a refrigerator.
https://www.thehindu.com/news/national/eam-jaishankar-warns-...
I wonder if this attack is some kind of early warning about capabilities of disruptive forces.
Ice anywhere else is treated as a separate problem and turning the cooler off to fix it is not typically an available option.
You don't empty a fridge with built-in defrost. Your home fridge defrosts itself every 12-24 hours and you don't have to do anything.
Normally, the temperature recovers in ~1 hour after a defrost. The attack is apparently chaining manual defrost commands one after another so that the interior gets way too hot.
I feel like this is kind of holding the supermarket hostage and saying, “Sure your freezer is working fine, but if you refuse to buy new freezers from us prepare to get hacked.”
Sure you can argue that the supermarket should have just taken the old freezers offline. But you can also argue that the manufacturer could have supplied software updates but didn’t in order to force sales of newer models.
I've helped do it for industrial equipment (win95 controller or something) that couldn't be upgraded without spending millions, but it sill required pulling out the old 10base2 network and installing cat 6 cables in a factory floor and new switches.
https://news.ycombinator.com/item?id=49508506