Hackers activate automatic defrosting in supermarket fridges across Europe (tomshardware.com)

I think it's more than this. Industrial control system upgrades are serious business and (at least if you're doing them properly) require a lot of planning and consideration. Particularly when the subsystem being replaced is decades old already.

I think the overwhelming majority of people (including on hn) have no understanding of how complex industrial systems are - even as-built, but particularly after decades of evolution. Doing proper engineering in these spaces is expensive.

You can reasonably blame supermarket chains for being insecure, but we certainly aren't currently enabling them (or anybody else) when it comes to fixing these issues.

Sir, I think you just invented entirely new type of technomarxism. Sunrise, parabellum!

...

As fun as it is, this has nothing to do with laptops and everything to do with someone not implementing Purdue model right.

It is absurdly tragic/hilarious that the lowest margin business in all of capitalism is the one that the communists have set their sights on as being a central site of oppression.

(I can see the need for remote monitoring, that the freezer actually worked. Controlling the temperature is the issue.)

Security isn't optional just because margins are low. If eg FedEx decided to disregard security because they only made 3% of the value of the packages they ship in profit, they'd lose most of that business fast. But yes, let's not shame folks for failing to preempt theoretical-yet-unseen threats, if that's what you mean.

What these idiots just don't grok is that there's no margin for that stuff. Sure, sometimes people say things like "if you can't buy a truck that keeps workers safe and still make a profit, perhaps you don't have a viable business" but that's just crazy talk. What's important is that things are made cheaply so that our margin can be preserved.

Lots of completely out of touch comments

Of course, the reality is more likely that the hospital still has to buy things and the subscription is a net loss on top of that so patients (or the people paying for the care) are screwed twice.

Disrupt the internet and good luck getting your emergent studies read by doctors who don’t look at anything to do with the scans and X-rays they order other than the Radiologists report.

The biggest issue is that many of these IoT devices are badly secured. I spent years trying to convince people to build more secure IoT systems, but they always preferred cheap and easy solutions.

Lets combine some testy topics: will LLMs make this any better? On the one hand, if it's easy for fridge manufacturers to churn out code, will the slop create enough cracks in the icemaker to sail the titanic through? Or will the lower barrier to pretty good security agents get more security into the IoT field (assuming it's taken advantage of?) Or will it not matter because the store manager will just set the web portal password to 123456?

The perspective of resiliency and how much will you lose if things go wrong seems kinda… new?

Funny that it should happen in France which has been at the forefront of European self resilience.

For the latter I would imagine you could have a short (maybe a month) logging period where you connect the fridges and collect data and then comeup with some offline system to manage them generally for better efficiency. You could even have a test group or single fridge that you keep connected to the internet for future data points (like in case of a giant heatwave or something)

Connectivity in these environments is often challenging, it isn't like connecting a consumer fridge to wifi. Sometimes you are bridging weird networks that multiple parties need access to. It should be secure but that isn't as straightforward as one might assume. Many of these systems have very long lives, so there are many limitations that reflect the technology that existed when they were built.

All of this is invisible to the average person but it is what makes the world work.

Anything you might want to change with a freezer already requires someone physically there. It's like making a socket ratchet have a remote controlled direction toggle. Or a remote control button to light the inside of your money box on fire.

That doesn't really make a ton of sense. Stores have personnel in them pretty much all the time, who can take action when necessary. Data collection for monitoring, forecasting, etc. is a reasonable thing to do obviously, and centralized aggregation clearly makes sense. But remote control smells more like a fanciful shiny tech bauble than an actually useful, let alone necessary, feature. It's easy to imagine how that feature got sold internally within an engineering organization, but it's very hard to imagine customers clamoring for it.

I understand why it's beneficial to have these systems connected to a network. You have not explained why that network has to be the Internet, and TFA is one reason why it shouldn't be.

Dear god I hope the moron manager responsible for that got their bonus revoked

A quick search puts the list price of the touchscreen-equipped controller at around €7,000 [1]. So this is hardly the typical dirt-cheap IoT device you can buy for a few bucks from China. The product label also says "Made in Denmark."

This vulnerability certainly appears more complex to exploit than the ones routinely found in cheap IoT devices.

Still, I wonder why, in the age of Tailscale and Nebula, a large company like Danfoss doesn’t use overlay networks to make these services accessible only to technicians and other authorized personnel, rather than exposing them publicly. From a technical standpoint, a company with 40,000 employees should be capable to pull this off.

[1] https://www.lefroid.fr/fr/c/p/402785

Um, if everyone needlesly suffered, we'd not have the problem.

Whereas we have in fact generously provided life-enrichment opportunities - to miscreants.

2014:

> A fridge has been discovered sending out spam after a web attack managed to compromise smart gadgets.

> The fridge was one of more than 100,000 devices used to take part in the spam campaign.

https://www.bbc.com/news/technology-25780908

Lessons were not learned:

2017:

> A critical security flaw dubbed HomeHack exposed 1 million LG smartThinQ IoT home devices, enabling hackers to easily gain access to users’ homes and take full control over any LG smart device connected to the account, including dishwashers, vacuums, air conditioners and washing machines, found security researchers from Check Point.

https://www.bitdefender.com/en-us/blog/hotforsecurity/securi...

IOT security needs to change.

There have been some changes to SCADA security, making it harder to hack into water treatment facilities (for example) but in my opinion, not enough.

They'll do nothing until a few get pwned into the dirt. Same for power distribution systems, it's all parochial boomers calling all the shots.

For AI, what's funny is that it's the solution to securing your ancient hardware that's no longer supported. I reverse engineered almost all electronics I own, just by having modern AI models have a go at it and knowing almost nothing about the topic. It's something that a person can do, but a company won't even consider.