The Guardian reported this yesterday evening:
Hackers have forced the temperature of many French supermarket fridges up to 50C overnight, in an “unprecedented” cyber-attack affecting several hundred stores across the country, with fires and food losses reported.
The Paris prosecutor's office said on Monday the large-scale attack was “affecting connected refrigerators in several major food retailers across France”. Reported damage included “food losses and fires”, it added.
Hundreds of supermarkets have been involved.
Why did this happen?
These supermarkets tried to remove people from their systems, sending the message that they didn't trust them to control a thermostat.
I do not condone what happened, but people are fighting back.
Why should anyone be surprised? When we remove autonomy from people and send subliminal messages of implied worthlessness as a consequence, dissatisfaction will result.
Economies and companies are not about maximising financial returns by increasing, however marginally, something like automating freezer temperatures might have done. They are about serving, engaging with, and respecting people.
When will we learn?
The reaction to this will focus on criminality. In the world we have, that is what it is. But, in my opinion, the cry for help implicit in it will not be heard. And that worries me.
Thanks for reading this post.
You can share this post on social media of your choice by clicking these icons:
There are links to this blog's glossary in the above post that explain technical terms used in it. Follow them for more explanations.
You can subscribe to this blog's daily email here.
And if you would like to support this blog you can, here:
Buy me a coffee!
What might have been the reasons for the installation of an obviously vulnerable sytem into the care structure of a life-necessary commodity?
Supposed economy
Says it all:
https://youtu.be/24AbNCNreqc?is=jrop7556nHB-hjEy
What happened wrt French supermarket (probably all of em) is something like:
“boss I think we could save a bit of money by having some sort of remote control over fridge thermos’ – we have lots of them and even a few Euros a fridge adds up”
This would be then followed by the imbecilic idea of centralising (with a nice bit of Internet) coupled to leaving some backdoors (did you change all the factory defaults?) open. This is what I would have done. Local control and monitoring with remote monitoring feed back to HQ. HQ sees summat wrong? pick up the phone (speaker at one end, mic at other – handle in between). This did not happen cos staffing in supermarkets is cut to the bone. For most control systems you do “failure mode” – what can go wrong (malicious or otherwise). Good to see that French supermarkets went through that process. Not
for those that would like the (tech) details – it is all here:
https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
remind me why remote control is needed.
Maybe also a comment on the idiocy of connecting everything to the internet (the so called “internet of things”). My oven has an internet connection. I struggle to envisage a scenario where controlling the oven remotely would be either useful or safe.
How often do supermarket fridges need to be adjusted? How often would this conceivably be need to be done remotely? Why on earth does a fridge have the ability to heat to 50°C? Perhaps it’s me going crazy.
I refuse to control my house from my phone.
NeoLuddites assemble! Me neither.
Most wise. Only an imbecile would do so.
& frankly at the risk of upsetting lots of people: mobile-phone-based Internet banking……..extreme risk..
the “Internet of Things” (IoT – or…. Internet of Twits) is on the way. What could go wrong?
& just in case people think I’m anti tech – I have an AI project running for control systems – but it is Internet isolated (as should be most control systems).
One rationale for this capability (remote control of electrical appliances) is the agile electricity tariffs now on offer. The tariff changes every half hour and at some times of night is often negative (ie you get paid to use electricity). Some people wanting to maximise benefit might want to put some appliance under algorithmic control, basically meaning on the network (home or internet). This is of course no reason to increase risk, but it’s a reason.
“These supermarkets tried to remove people from their systems, sending the message that they didn’t trust them to control a thermostat.”
Can you elaborate on what this means? I don’t see anything in the linked article about this.
thx
I imagined how this arose.
Given my experience, it is not hard to do.
I extrapolated from the article.
They were likely sold a product that they were told they could control remotely or centrally with the promise of savings, probably energy savings, as the refrigerators would adjust their temperature based on ambient temperature. All manufacturers are now trying to install chips into their devices so that their control of your purchase doesn’t end when it leaves the factory. You don’t own media anymore; your cars have microchips and RFI transmitters that ensure you can’t use third-party parts. Farmers can’t fix their own tractors, and John Deere can brick your combine harvester from the other side of the world. Of course, this IT infrastructure is open to attack, but the biggest threat is the manufacturer. Buy simple, don’t fall for the promise of connectivity, and never download the apps.
I share your concern about how organisations treat people, but I think this incident is the wrong one to hang it on. Nothing reported so far tells us who did this or why. Attacks on connected infrastructure usually come from ransomware gangs, state-linked groups or politically motivated hackers, not from aggrieved staff or citizens. Calling it a cry for help gives the attackers a motive they haven’t claimed.
Remote fridge monitoring also isn’t really about distrusting people with a thermostat. It exists for food-safety record-keeping, for overnight failures when no one is in the store, and for energy costs. The people hurt here were shop workers facing fires and ruined stock.
There is a real lesson, though. When one platform controls hundreds of stores, a single breach becomes a national event. Systems should fail safe and let local staff take back control. That is the case for human autonomy I’d want to make
Look at the systemic issue, though, please….
I think you are missing it by a mile.
Thanks for your insight.
I suppose they called them “smart” fridges. Now, they will have to employ lots of humans to clean up the mess.
When a company says it hasn’t been hacked, they are either lying, or next on the list, or they will confess in a few days, once the leaks get going.
We are experiencing a 21st century (and complicated) Luddite revival, and like the originals, although v destructive, they raise some v valid concerns.
When you reduce down controls to anything, when you centralise something, there is always the risk of who then controls that narrow focus of control and how robust and manageable/accountable that is. It’s not diversifying control at all – which is what a good system should do in my opinion especially when spread out. Systems need sub-systems – and that includes people.
Again, its like Tolkien’s ‘ring of power’ isn’t it?
Yes, in a word
I am starting to wonder why we connect so much electronic information. I think there is probably a lot that is unnecessary and could be stored locally. This French example seems to be a case in point. Why should somebody in Paris need to know the temperature of a fridge in Bordeaux?
This interconnectivity is creating a problem which is a actually avoidable.
I think you are right.
It’s possible to include some government blame in this story. The Supermarket companies face high labour costs and regulations. Night shift thermostat minding would be a dull job to boot and long term night shift work is bad for health, so you might want to hire someone in Malaysia during daylight there to do it remotely, but I expect French Labour Laws don’t allow that.
Hence the automation which turned out to have a vulnerability.
You do realise almost every supermarket has a night shift, don’t you? As usual, your claims make no sense.
At the moment supermarket fridges and freezers have a local, in store, warning for temperature increase/malfunction.
In this situation the procedure is to get some of the shop floor staff to empty the stock to the warehouse backup, and await the arrival of the contracted fridge/freezer repair company.
Not ideal.
Once fridge monitoring is on the internet and outsourced to who knows where, the procedure shall be to get some of the shop floor staff to empty the stock to the warehouse backup, and await the arrival of the contracted fridge/freezer repair company.
Much better.
Richard the point is that the supermarkets brought into the savings by employing less staff that they were told would be the benefit. Lets forget about the need to have new equipment to be able to allow the software to monitor the temperature and their costs along with the cost of the software and support systems.
This is acceptable because you are reducing your level of employees who we know have holidays and can have days off with illness. The loss of the food at a critical time in the world is overlooked. It’s covered no doubt by insurance. Premiums will go up of course but that’s understandable.
It seems to me that this headlong pursuit of using technology for it’s own sake on the premise that it saves on employee costs is a very short term outlook. Even establishing a routine where those checking stock levels or refilling fridges and freezers made a note of temperatures would surely cost less than what has happened?
Much to agree with
Thank you, both.
The insurance cover was mentioned by TF1, as if that’s enough. No need to change course.
A bit later, there was a report about Chinese cars gaining market share in France. Chinese and French business leaders were interviewed. What struck me was the lack of foresight and short-termism of the latter. It’s no wonder real engineering is eating the lunch of financial engineering.
As one who wrote their first computer software over 50 years ago and have continued till now, I have always thought that those who connect control systems to the internet are taking a big risk. We have all sorts of people connected to the internet including the Dark Web which no one can shut down. The company I worked for in the 80s and 90s had 2 factories. These were linked by a dedicated link. Before the growth of internet access this was the normal way of doing this. I think we need a new secure internet where users are vetted before being connected.
When my firm first had email in the early ‘ 90s, one computer not on our network, which had email for internal communication, was connected to the web. Times have changed
The reports suggest that the oversight work was outsourced to a Danish software company, which was hacked.
You can guarantee that the accountants recommended this as a cost saver. But the Danish company needs to employ French sub contractors to do the physical work.
Perils of not understanding what you are outsourcing nor the hacking risk.
Rather like the UK selling off the National Air Traffic Service (NATS), and running airports from Fareham. As we have seen recently having IT systems that do not function 100% all of the time is inviting trouble. You will recall the proposed upgrade to the NATS IT system does not yet have back up included. One hopes that that view changes.
I can hope, but seeing action would be better.
Thank you.
Yesterday evening, a representative from Danfoss was interviewed. He blamed users for not upgrading to new software.
French supermarkets, like others, are little better than extortion rackets, especially for farmers. Oligarchs like the Arnault, Leclerc and Naouri families feature prominently in their ownership.
I forgot to mention that Heathrow is recruiting for a head of operational resilience. I’m tempted to apply.
In the autumn of 2021, I was offered the job of leading operational risk and resilience policy and supervision by the Bank of England. I had to turn the bank down, something I regret from time to time. During the two interviews, I was told that, if I do a good job, the unit may get noticed by the governor as he was not interested in such matters.
It reminded me of an incident in the mid-noughties. A young official was asked to brief the governor, Mervyn King, and senior leaders on various matters. He raised the alarm about US sub-prime. King barked how was this relevant.
A bit before, the Environment Agency asked me to apply for a compliance leadership position. I did and did not hear back.
Fantastic, eh?!
You might have had a good escape in both cases.
It takes a certain kind of mindset to wheedle out the potential pitfalls in any complex system, the weaknesses that a malicious actor may exploit, the single points of failure hidden in an otherwise redundant mechanism. The kind of mindset that doesn’t just accept the fashionable doctrine on anything but instead reads and contributes to this blog, discusses and argues (in the best meaning of that word) how the world could and should be run.
Please apply for the Heathrow job, I might want to fly into there sometime next year (availability of jet fuel permitting).
It’s difficult to understand how a fridge temp can be raised to 50C since they can’t be run in reverse. Could this be more scaremongering?
Thanks for the nice pic of the teasels earlier, it’s unusual to see so many heads together.
It seems that the fridges have small heaters for overnight de-frosting and these were overridden. Presumably they don’t install over-temperature sensors/cut-outs so that they can build them at lower cost…
Hello Richard.
The ‘Internet of Things’ was always going to be a huge vulnerability point for societies, but on the other hand, you can sit on your couch and your phone shall inform you that your toast is ready. So, definitely worth the risk.
I think IoT is a combination of ‘spyware’, as there is no human action so small that some company doesn’t think it can count towards ‘profiling’ for increased profits, and companies fear of missing out when their competitors do IoT.
Attacks on IoT could come from disgruntled ex-workers all the way to State warfare. The attack might not even be in your country, but your service suffers a failure. The solution shall not be to remove the possibility of vulnerability existing – ie don’t connect fridges to the internet. The solution offered shall be ‘pay another tech company to fix the vulnerability’.
If they could build in resilience to begin with, maybe IoT would be fine. I won’t hold my breath waiting for this though. Resilience might as well be expunged from the English language at this point.
I wonder what’s going to get hit next?
Thank you, Richard.
Yesterday evening’s TF1 news highlighted the access by way of the internet and did not exclude the possibility of sabotage by disaffected employees or others thinking along those lines.
There was a hint of cost cutting, as explained by Mike. The French presidential campaign* is under way. Melenchon, pulling big crowds, echoes Richard’s politics of care and plans to bring Mr Market to heel. Things are moving in France.
*The socialists have chosen someone who campaigned for Dubya, Sarkozy and Macron, denies genocide is going on in Palestine, and will support a Macronist candidate if unable to progress. Hopefully, the socialists are on their way to extinction.
Thank you
The question must be what is this sort of remote control attempting to achieve
What are the benefits and whats the risks?
Clearly this incident was a cost but what were the savings?
They were minuscule
They were meant to eliminate human error, I am sure
Which is quite ironic, really.
I can’t really see why it is so necessary to have fridges and freezers, in a store that is used every day, operating with remote telemetry in any case. A localised control system in the building perhaps but why go further than that?
The Fridge that came in from the cold
In a world of devices that dreamt of life,
An intelligent refrigerator came to life,
Not content with being a simple cooling box,
It yearned for something other than ice blocks.
It scanned each item with a careful eye,
Gathering data on every slice and pie
Instructing its owners on meals to make,
Calculating every ingredient to take.
No spoiled food dare linger inside,
It monitored every shelf with pride,
Sending alerts and gentle notes and prompts
To avoid wasted food and unhealthy chomps.
Equipped with clever screens,
It planned meals and tracked routines,
An intelligent fridge, set to assist,
A partner in the kitchen, never to resist.
With technological wit and flair,
It became the heart of the houseware,
A central hub to plan and create,
The intelligent fridge, a modern mate.
This poem was mostly generated by Nova Chat GPT app – with some tweaks from me…
Buckingham / The Cloud
4/5/23
Thank you
But now, it’s a nightmare
There was an article on Reuters whereby Anthropic warned of AI bot nets automatically reproducing botnets that would attack the Internet of All Things. It warned that agents are capable of doing this likely before the end of the year. The botnets will deliver spam, malware, denial of service, and hack into routers. I’ve advised my company to obtain removable hard drives to synch to cloud data once a week and then disconnect for two weeks (alternating regularly). That way, if the attacks do cause a denial of internet service, at least we still have access to the data. However, these attacks also will reside in anything connected and even if you disconnect, your PCs may be compromised regardless. Reuters also had an article about the concerns that the banking systems have about a wide scale botnet attack in the next six months. None of these are coincidental with the exposure of the attack in France.
Let me muse on that
We should not overlook the fact that one of the easiest ways into a network is a traditional individually crafted and carefully targetted phishing scam aimed at known staff or contractors with the required network access and admin privileges.
This does not surprise me. Marc Goodman forecast these types of hacks in his 2015 book “Future Crimes”.