You didn’t need to be a cyber genius to cook the frozen peas in supermarkets across Europe this month.
asserted
You → need → Europe
On November 2, freezers in dozens of stores across at least 11 countries were cranked up remotely, some to 50 degrees.
asserted
freezers → crank → degrees
Carrefour and Ikea in Belgium, ICA and Coop in Sweden, Kesko in Finland and SuperValu in Ireland were among those hit.
asserted
Carrefour → hit → those
Three weeks earlier, hackers had done the same to hundreds of French supermarkets.
asserted
hackers → do → supermarkets
Security agencies have been warning about this since 2014, when France’s cyber agency, ANSSI, first told operators never to put these controllers directly online.
asserted
agency → warn → controllers
Overnight, French Foreign Minister Jean-Noël Barrot named Iran as the country behind the hacks and called for European sanctions against Tehran, amid broader concerns about Iranian cyberattacks and terrorism.
asserted
Barrot → name → cyberattacks
It sounds innocuous – defrosted peas, carrots and cauliflower – but it should worry Australians.
asserted
it → sound → Australians
The same controllers, the small computers that set a fridge’s temperature, also run cold rooms in hospitals, medicine warehouses and data centres.
asserted
that → set → hospitals
In France, hackers have already reached the cold storage of at least three blood banks, the national blood service said last week.
asserted
service → reach → banks
The blood was moved, and no patients were harmed.
asserted
patients → move → ?
The French attackers barely had to try.
asserted
attackers → have → ?
ANSSI chief Vincent Strubel told the French Senate the controllers had been sitting on the open internet with no firewall, their admin screens guarded only by weak passwords.
asserted
screens → tell → passwords
The second wave looks no more sophisticated.
asserted
wave → look → ?
A spokesperson for Danish controller maker Danfoss said the Dutch systems that were hit were not on a secure network and still had their factory passwords.
asserted
that → say → passwords
The default passwords for one company’s systems were printed in its manuals, according to Paul Chichester, director of operations at Britain’s National Cyber Security Centre.
uncertain
passwords → print → Centre
On the day of the second wave, at least 1000 Danfoss store systems were exposed online worldwide, according to US security company Claroty.
uncertain
systems → expose → Claroty
It couldn’t say how many are in Australia.
asserted
many → say → Australia
Sabcobel, Belgium’s refrigeration industry group, says the damage would have been far worse if its members hadn’t started patching the vulnerabilities after October 12.
asserted
members → say → October
Danfoss said in a statement that most of the equipment that was hit was old and no longer received security updates.
asserted
that → say → updates
That leaves no excuse for operators who left their systems exposed.
asserted
who → leave → systems
Nobody has yet claimed the attacks or asked for money.
asserted
Nobody → claim → money
Tom Hegel, a lead researcher at US security company SentinelOne, says Russian-aligned groups are also credible suspects because they have attacked similar systems before.
asserted
they → say → systems
But that is “only context, not the missing evidentiary link”, he says.
asserted
he → say → ?
Romania’s cyber security director, Dan Cîmpean, called the attacks “semi-amateurish”.
asserted
director → call → attacks
Samuli Bergström, who used to run Finland’s national cyber emergency team and now leads threat intelligence at Finnish security company WithSecure, suspects it is “less about food than about opportunity”.
asserted
it → use → opportunity
Retailers’ defences are generally weaker than those of banks or energy companies, he told this masthead, and “if the security is poor, someone will find it”.
asserted
someone → tell → it
Who pays
Breaking in is getting cheaper, largely thanks to AI.
asserted
Breaking → pay → AI
In August, Claroty published details of security holes in controllers made by Danfoss and US company Copeland.
asserted
Claroty → publish → Danfoss
A day after the French attack, its researchers showed an AI tool could build a working attack on those holes, on a test device, in about 28 minutes.
uncertain
tool → show → minutes
It cost $US6 (about $9).
asserted
It → cost → US6
Luc De Laet, who runs a small butcher chain in Belgium, told Reuters he lost about €15,000 ($24,000) of meat in a single night.
asserted
he → run → night
That’s more than 2500 times what the AI test cost
asserted
test → cost → what
“A hacked bank is abstract, but an empty shelf is visible within a day and triggers stockpiling that makes things worse,” Bergström says.
asserted
Bergström → hack → stockpiling
No attacks have yet been reported in Australia.
asserted
attacks → report → Australia
Woolworths is understood to have no store refrigeration controllers connected to outside networks, and Aldi is similarly understood not to use outside networks to manage or maintain its refrigeration.
asserted
Aldi → understand → refrigeration
Coles did not respond to questions.
asserted
Coles → respond → questions
Leah Pinto, a director in the intelligence team at Melbourne-based security company CyberCX, says attackers are getting better at hitting the internet-connected gear that runs lifts, air-conditioners and fridges.
asserted
that → base → lifts
They are also keener to try, “particularly as criminals experiment with artificial intelligence”.
asserted
criminals → try → intelligence
“Cyberattacks can now be highly disruptive to our daily lives and the broader economy,” she says.
asserted
she → say → lives
But Bergström says the real question is whether a device needs to be reachable from the internet at all.
asserted
device → say → internet
…and 9 more, not listed.
The Aporia
