Yes, especially after this has now been happening again and again. First case can be excused as usual bad practices and lazyness. But it should have been a wake up call causing anyone else operating commercial freezers (or even other equipment) to review if/how they are connected to the Internet. Anyone getting hit now is maliciously incompetent.
So I worked for a company who's product was sensor networks for this exact situation, and the European company who bought us had a cloud-only solution they wanted to replace our on-premise product with. Thankfully most hospitals and research institutions in the states are smart enough to reject cloud-based solutions for this exact reason. In theory you could penetrate our systems but it would have to be a very direct, specific attack to be able to do it. My colleague in Germany has been an SWE contractor since 1978 and is genuinely the best engineer I've ever worked with. No matter how off the wall my ideas were he'd already considered it and eliminated it as an option.
We're expert of the EU MDR, the "new" medical device regulation, and there are many Cloud services trying to seduce customers. But clearly no-one wants to have their software online: Medical industry is crossing the chasm when they can control when their Cloud software is upgraded, but the aerospace is a hard no and the ISO 26252 field (automotive) is even worse. With AI and Trump, it gives them reason.
The Cloud thing is completely driven by software companies, not by their customers. I'm really surprised that we did succeed at forcefully moving unwilling customers to the Cloud, it really doesn't answer their needs.
You can learn from TSMC or power grid networks. These networks are highly secure and must be separated into internal and external networks. There shouldn't even be any chance for the external network to access the internal network.
Of course, physical ports are also a risk, but they're easier to detect. At least someone has to come in.
Check out /r/NotMyJob/. You can lose faith in employees, and humanity in general, one video at a time. All it takes is few people who DGAF and security issues won't ever be detected, to say nothing about addressing them.
we are a few attacks like this from a country interpreting it as a declaration of war. I have no doubts a developed country counter-intelligence cell can find which country is responsible for such a large scale attack. I wish they target countries like China instead of spineless france.
sure it is the edit that made your comment unfit yet the person who replied to your own comment five 5 seconds after got it. we can discuss reality of the world as you want but it seems u just fine with foreign nations hacking your president. debating would be hard.
>u just fine with foreign nations hacking your president. debating would be hard.
And you are fine with declaring war, pretty sure you not even touched anything warlike.
Try to spy on leaders is a thing since forever, and because both sides want to do it, no one would "declare a war" just for the spying...it's kind of a game, accepted and respected on all sides.
There was a time (and probably still is) when Obama spy'd on Merkel....
> ... were heated to 110C overnight on Sunday after hackers managed to gain access to the temperature settings remotely ... The rooms need to preserve donor blood samples by staying at -30C.
im amazed there's no hard post-install safety installed for a fridge that was delivered with the specific purpose of keeping medical supplies below freezing to not trip even at 0
The first time we found a provable case of malicious hacking, whether by individuals or nation-states, the result should have been the termination of that entity. Nothing says "stay out of my network" like a bloody head on a fencepost.
The advent of AI and its ability to find vulnerabilities so quickly is getting out of hand. Yesterday it was supermarket fridges now its fridges that store blood, they should never have been connected to the internet in the first place especially in these times with AI, but all of Europe needs to invest more into their cyber security systems they are anachronistic at this point.
The way I understand it, and someone please correct me if I’m wrong. Whoever hacked the devices send a command to increase temp to 110, but it never reached that number, instead it just reached the max. But the news story still reports it as if the blood literally started to boil to 110c
can someone please explain how they can heat the blood I understand they can stop the freezing but you cannot set the temperature of a refrigerator to a point where it literally heats the stuff inside since a refrigerator do not have the mean to warm objects inside it can only remove the heat.
Not only freezers, but a lot of other appliances have become IoT-integrated to simplify inspection procedures. Instead of the health department looking at each freezer/smoke detector/gas detector/emergency floodlight individually, you can just present them with a report from your building's safety system. Older systems were mostly some industrial bus and are off-grid by default, but new ones are usually smarter, and as a result, IP-connected.
They could, but the person who's actually making the decision on which vendor to go with will most likely choose the ones that allow for remote management because they think it'll allow them to cut staffing
In the end the market will optimise for that guy's opinion, not the optimal solution
You probably need admin/write concepts in order to change users, rotate keys, allow/disallow IP ranges, network setup, etc....
Still totally agree that there should be guardrails around the core functionality but it's easy to imagine that the thermostat would be something one would expect to be able to control once you implement all this remote functionality.
You need none of that if it's truly broadcast only. The network or receiving system can be configured to accommodate the device. A hardware button and screen on the device can be used to regenerate a key, although that is probably necessary.
The EU will release a statement where they claim to be very concerned. Then maybe write an additional 1200 page regulation on industrial refrigeration that will fix the problem by making impossible to legally refrigerate anything. The usual.
Nope. It's a serious newspaper reporting on serious news. Usually with a vitriolic tone and wordplay, but it's absolutely not a satirical newspaper like the onion (the french equivalent would be le gorafi).
Yes, but not in the same way The Onion (or its French counter part Le Gorafi) are satirical.
Le Canard enchainé makes fun of people and institutions, but never makes stuff up, and are arguably more rigorous than most mainstream media outlet. They have a long history of exposing real scandals, albeit with a tongue-in-cheek manner.
I imagine that, unfortunately, a lot are, but others might lack things like MFA at their trust boundaries
IT security is a pretty complex topic and a lot of businesses don't have the knowledge in-house to access the security of their own infrastructure
If you have no-one to actually patch your devices and architect your infrastructure, you'll probably end up with just asking the "geeky" student assistant to get it sorted. They'll throw it on the office WiFi, set the same user+password on all the devices and call it a day
In my experience, the vast majority of orgs have essentially no IT security
This is easily fixed with data diodes. I can see future industrial appliances and other critical IoT devices with embedded units. You use the read/write port for initial configuration then the diode for permanent monitoring, making it physical impossible to send data to the equipment.
And if you need to alter the initial settings, you do what? Also, your solution is negating one of the biggest benefits of remote control: less errors from tech on the ground.
If I have to enable a privileged operation (like enable container support), I have to change a device-mode flag. To confirm it, I have to either physically push the Reset button on the device or pull the power from it physically within a set window of time.
Push the setting to the freezer but require a physical button press/power control action from someone locally to confirm the new setting change.
Have a big pop-up message on the HMI that says "TEMP CHANGE REQUEST: CURRENTLY 0C, REQUESTED 66C - OK?" so someone can yelp and go This doesn't look right! and call in the experts for help.
Is it perfect? No. Could it be feasible for some applications? Yes.
I think this is probably something good to happen because what it is not normal, is that a company, any company, can sell you a half assed product, call it End Of Life with flagrant issues still happening, clean their hands, and leave you with the problem or having to buy another product, with the environmental cost of it plus the economical cost of it.
And the only solution, it is to enforce company to offer updates and support a product for at least half a century, and enforce that any code of that product must become available and modifiable in case the company is unable to provide with such support.
If that means that company produce less products, so it is. I am tired as a consumer of having to throw away completely good products just for this reason, from ASUS routers, to car. Hopefully whatever legislation that happens to solve this situation with the industry will also affect consumer products (or at least, we could adquire industrial products instead).
How do you deal with bankruptcy? Also most companies, even larger ones with seemingly a well-managed board, actually rely around the aura of the founder.
> call it End Of Life with flagrant issues still happening
It's precisely because there are unreasonable issues that they EOL them. Retiring products because of issues should be encouraged.
How? Well all products should be sold as a service - medical devices are, even if they appear as a purchase, they have strong post-market surveillance requirements. But that makes everything super expensive. It's only affordable for rich economies like Singapore.
66 comments
[ 3.6 ms ] story [ 47.9 ms ] threadThe heat/cold switch should be a physical switch.
The Cloud thing is completely driven by software companies, not by their customers. I'm really surprised that we did succeed at forcefully moving unwilling customers to the Cloud, it really doesn't answer their needs.
Of course, physical ports are also a risk, but they're easier to detect. At least someone has to come in.
Because Chinese Life is less worth than "spineless" French? What is that disgusting worldview of yours? You know what a blood-bank is, right?
But let's talk about LLM's, i hope you dont ever use them with a mindset like "pegasus on leaders phone = declaration of war".
And you are fine with declaring war, pretty sure you not even touched anything warlike.
Try to spy on leaders is a thing since forever, and because both sides want to do it, no one would "declare a war" just for the spying...it's kind of a game, accepted and respected on all sides.
There was a time (and probably still is) when Obama spy'd on Merkel....
im amazed there's no hard post-install safety installed for a fridge that was delivered with the specific purpose of keeping medical supplies below freezing to not trip even at 0
How low must one go to do such a thing as attacking a blood bank? Of course, some of these low people are also low life governments.
The first time we found a provable case of malicious hacking, whether by individuals or nation-states, the result should have been the termination of that entity. Nothing says "stay out of my network" like a bloody head on a fencepost.
In the end the market will optimise for that guy's opinion, not the optimal solution
Still totally agree that there should be guardrails around the core functionality but it's easy to imagine that the thermostat would be something one would expect to be able to control once you implement all this remote functionality.
I'm not sure why you're talking about red tape, is that really related to the article?
Same news other serious outlet:
[1]: https://www.franceinfo.fr/internet/securite-sur-internet/cyb...
Le Canard enchainé makes fun of people and institutions, but never makes stuff up, and are arguably more rigorous than most mainstream media outlet. They have a long history of exposing real scandals, albeit with a tongue-in-cheek manner.
Because you'd think it would work to just have them on a VPN, and then they aren't responsive to any non-authenticated internet traffic?
IT security is a pretty complex topic and a lot of businesses don't have the knowledge in-house to access the security of their own infrastructure
If you have no-one to actually patch your devices and architect your infrastructure, you'll probably end up with just asking the "geeky" student assistant to get it sorted. They'll throw it on the office WiFi, set the same user+password on all the devices and call it a day
In my experience, the vast majority of orgs have essentially no IT security
https://help.mikrotik.com/docs/spaces/ROS/pages/93749258/Dev...
If I have to enable a privileged operation (like enable container support), I have to change a device-mode flag. To confirm it, I have to either physically push the Reset button on the device or pull the power from it physically within a set window of time.
Push the setting to the freezer but require a physical button press/power control action from someone locally to confirm the new setting change.
Have a big pop-up message on the HMI that says "TEMP CHANGE REQUEST: CURRENTLY 0C, REQUESTED 66C - OK?" so someone can yelp and go This doesn't look right! and call in the experts for help.
Is it perfect? No. Could it be feasible for some applications? Yes.
* https://lecanardenchaine.fr/police-justice/55332-les-hackers...
And the only solution, it is to enforce company to offer updates and support a product for at least half a century, and enforce that any code of that product must become available and modifiable in case the company is unable to provide with such support.
If that means that company produce less products, so it is. I am tired as a consumer of having to throw away completely good products just for this reason, from ASUS routers, to car. Hopefully whatever legislation that happens to solve this situation with the industry will also affect consumer products (or at least, we could adquire industrial products instead).
> call it End Of Life with flagrant issues still happening
It's precisely because there are unreasonable issues that they EOL them. Retiring products because of issues should be encouraged.
How? Well all products should be sold as a service - medical devices are, even if they appear as a purchase, they have strong post-market surveillance requirements. But that makes everything super expensive. It's only affordable for rich economies like Singapore.
https://www.bbc.com/news/articles/c8vgxyvz6y9ro