Fridge hack costing millions and sparking fires stemmed from poor security

Earlier this week, a mass hack of refrigeration systems at an estimated 700 supermarkets throughout France caused them to suddenly malfunction, causing spoilage of untold tons of perishables and, in some cases, fires. As is now the norm, basic cybersecurity would have prevented it.

本周早些时候，法国约 700 家超市的制冷系统遭到大规模黑客攻击，导致系统突然故障，造成难以计数的易腐食品变质，在某些情况下甚至引发了火灾。正如现在常态化的情况一样，基础的网络安全措施本可以防止此类事件发生。

French authorities say the systems, made up of entire fleets of refrigerators and freezers throughout a store, were hacked. More specifically, Internet-connected controllers that allow technicians to remotely administer the store-wide systems were compromised. The unknown attackers responsible then activated defrosters long enough for the fridges to reach temperatures as high as 50° Celsius (122° Fahrenheit). By the time the mass compromise was discovered, food was spoiled, and in some cases their electrical systems caught fire.

法国当局表示，这些由店内整套冰箱和冷柜组成的系统遭到了黑客攻击。更具体地说，是那些允许技术人员远程管理全店系统的联网控制器被攻破。负责此事的未知攻击者随后启动了除霜功能，持续时间长到足以让冰箱温度升至 50 摄氏度（122 华氏度）。当大规模入侵被发现时，食物已经变质，在某些情况下，其电气系统甚至起火。

Multiple security advisories and public research reports show that all three of the controller models reportedly hacked in the incident—sold by Danfoss of Denmark and Dixell and its parent company Copeland in the US—contained critical vulnerabilities that allow attackers to remotely log in to the devices with the same system rights as administrators.

多项安全公告和公开研究报告显示，据报道在此次事件中被黑的三款控制器型号——分别由丹麦的丹佛斯（Danfoss）以及美国的 Dixell 及其母公司谷轮（Copeland）销售——均包含严重漏洞，允许攻击者以管理员权限远程登录设备。

Until recently, Danfoss controllers, for instance, used a credential that changes each day. The password is generated by the publicly available firmware based on the date. A hacker who takes the time to analyze the code can do the same thing on any device that hasn’t received a recent update. Daily passwords are identical across models located in hundreds or thousands of stores. A raft of critical vulnerabilities fixed in the past few months in Copeland/Dixel controllers also give similar remote access.

例如，直到最近，丹佛斯的控制器仍在使用一种每日更换的凭据。该密码由公开的固件根据日期生成。黑客只要花时间分析代码，就能在任何未进行近期更新的设备上实现同样的操作。在成百上千家门店中，同一型号的设备每日密码都是相同的。过去几个月里，谷轮/Dixell 控制器中修复的一系列严重漏洞也提供了类似的远程访问权限。

Besides running controllers with outdated firmware, the affected stores likely also failed to put the devices behind a VPN and create a restricted list of IP addresses allowed to log in. These protections are standard but often not followed. In this case, that failure enabled a mass hack that likely cost tens or hundreds of millions of euros. Spain, Portugal, Poland, Germany, and Belgium were also reportedly affected.

除了运行固件过时的控制器外，受影响的门店很可能也没有将这些设备置于 VPN 之后，或建立允许登录的受限 IP 地址列表。这些保护措施虽属标准配置，但往往未被遵循。在此次事件中，这种疏忽导致了一场可能造成数千万甚至数亿欧元损失的大规模黑客攻击。据报道，西班牙、葡萄牙、波兰、德国和比利时也受到了影响。

“Two things would have changed the outcome,” researchers at Pen Test Partners said Wednesday. “Cyber hygiene would have prevented the access: take the controller off the public internet, put remote access behind a VPN and an IP allowlist, bring third-party kit onto the network in a controlled, owned and documented way rather than leaving it on a contractor’s own connection, change known and default credentials, and patch to a current release.”

Pen Test Partners 的研究人员周三表示：“有两件事本可以改变结果。网络卫生本可以阻止这种访问：将控制器从公共互联网上移除，将远程访问置于 VPN 和 IP 白名单之后，以受控、归属且有记录的方式将第三方套件接入网络，而不是任由其连接在承包商自己的网络上，更改已知和默认的凭据，并修补至当前版本。”

Researchers from security firm Claroty warned of the threat of ignoring these common-sense steps last October. The US Cybersecurity and Infrastructure Security Agency did the same in February. In an email, Copeland acknowledged a vulnerability “identified in a discontinued, end-of-life generation of controllers” and said the company is working with customers to prevent similar incidents in the future. Danfoss representatives didn’t immediately respond to questions. CNN said the company also cited discontinued models.

安全公司 Claroty 的研究人员去年 10 月就曾警告过忽视这些常识性步骤的威胁。美国网络安全与基础设施安全局（CISA）也在 2 月份发出了同样的警告。谷轮公司在一封电子邮件中承认，在“已停产、生命周期结束的控制器产品中发现了漏洞”，并表示公司正与客户合作，以防止未来发生类似事件。丹佛斯的代表没有立即回应置评请求。据美国有线电视新闻网（CNN）报道，该公司也提到了停产型号的问题。

So far, the party behind the attack has remained silent. That raises the possibility that the motive was vandalism on a mass scale. Another possibility is a nation-state or other international actor aiming to create a continent-wide disruption. The incident underscores the tension between the financial and security departments in most businesses. Some companies are loath to spend large sums of money on new equipment when there are no tangible benefits or savings. Only after a devastating hack do they realize why the investment was worthwhile.

到目前为止，攻击背后的势力仍保持沉默。这引发了一种可能性，即其动机是大规模的蓄意破坏。另一种可能性是某个民族国家或其他国际行为体旨在制造全欧洲范围的混乱。此次事件凸显了大多数企业财务部门与安全部门之间的紧张关系。一些公司在没有切实利益或节省成本的情况下，不愿在购买新设备上投入巨资。只有在遭受毁灭性的黑客攻击后，他们才会意识到为什么这些投资是值得的。

Executives at affected supermarket chains will likely learn the hard lessons. Less clear is whether the cautionary tale will sway other businesses.

受影响连锁超市的高管们很可能会吸取惨痛的教训。但这一警示故事是否会影响其他企业，尚不明确。