Supermarket Freezer Attacks - Not That New, and What It Means for Your Smart Home

Overview

There have been a spate of attacks on supermarket freezers in recent weeks. I was recently asked some questions about this, and am sharing my responses.

These attacks aren’t new

The attacks on freezers in “industrial settings” across Europe are not actually that new. Earlier this year, in August, what look like the same style of attacks were happening across US military bases and some grocery store chains. Check out I Think The Military Commissary’s Freezers Were Hacked, which was written back in August, many months ago. More recently, Reuters reported that the Pentagon is treating the military base freezer malfunctions as a suspected cyberattack.

The attacks are not on “smart fridges” like you would have installed at home. These are industrial control systems that are used to regulate fleets of freezers. The problem is that these control systems are exposed over the internet, or on weakly secured networks. Flaws in refrigeration control systems specifically were published around that time in the research literature: Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers (Claroty Team82).

It’s unclear what the motivation of the current attacks is (basically, ruin a whole lot of frozen food), other than to hurt the economy or just demonstrate it’s possible. Given the state of these systems and the types of attacks (they are all very similar), this is not something that takes a ton of technical ability. So it could be done just because they can, without a real desired outcome.

What about my smart home?

How easy would it be to hack a smart home system controlled by one app on your phone?

It depends on the system! Most are controlled remotely through a cloud provider. These are inherently only as secure as the cloud provider makes them. Generally, if something is controllable from anywhere in the world via your phone, you should think about whether you really need that to be accessible. If it’s accessible to you, it’s technically accessible to anyone.

What’s the worst-case scenario?

Worst case is an attacker uses a smart device as a jumping off point (or pivot, in the jargon) to compromise other systems, like your laptop or desktop. From there they can steal your data (passwords and other credentials) and do any number of attacks (drain bank accounts, ransomware, etc.).

Are hackers more likely to go after home appliances or large businesses?

It’s really a matter of scale. If there are millions of home appliances and someone finds a simple attack, they will probably go after them.

What should you do?

Keep devices patched

Keep devices patched! If your phone says there’s an update, don’t wait to install it. Same thing on your computers, be sure to update. But also be sure you are using the actual update mechanism (Windows Update, the Apple App Store, etc.). A blinking popup while you are on the web is probably not a legitimate update!!

Do you really need a smart appliance?

Are we better off just having a dumb HVAC and refrigerator? In my humble opinion, yes. I personally consider whether or not the convenience of a “smart appliance” is really worth it, and usually decide it’s not.

Separate your networks

I also recommend segregating networks for IoT (Internet of Things) devices at home. That means having a totally separate wifi network for “smart devices” that’s different from the network your computer is connected to. Sometimes there will be a “guest” network with your Internet service that’s less trusted, and you can use that if you have it. Having an actual separate network/wifi router is even better, but it’s probably outside of the realm of most users (technically much more difficult for an average user).

Interested?

If you’re already a student at DU, join the DUCC (DU Cyber Club) slack channel for updates CS@DU Slack. You’ll have to join our CS@DU slack workspace first, then join the DUCC channel. Email us if you have any issues!

If you’re not already a student at DU, but are interested in learning more, Email us about the courses and programs at the University of Denver, browse this site, or check out the University of Denver Ritchie School of Engineering and Computer Science main site for more info!