Kaspersky comments on supermarket fridge cyberattacks in Europe
In the last few days, multiple supermarket chains in seven European countries have been hit by cyberattacks that affected their refrigerators and freezers. In several chillers and freezers located in supermarket chains around Belgium, Sweden, Ireland, the Netherlands, Estonia, Luxembourg and Finland, threat actors were able to switch the units to defrost mode, causing millions of Euros worth of food to be thrown away..
Supermarket fridge cyberattacks – what happened?
While cyberattacks against critical infrastructure like power plants or financial institutions are higher profile and bear closer scrutiny by cybersecurity organisations, the latest supermarket fridge cyberattacks hit people where it hurts – right where we store all the good stuff. How will people get through the weekend without ice cream?
Commenting on the supermarket fridge cyberattacks, Vladimir Dashenko, Principal Security Researcher at Kaspersky said that modern refrigeration systems like those encountered in the cyberattacks are a typical example of cyber-physical systems that can be monitored and controlled remotely.
However, their level of security often remains insufficient with manufacturers failing to implement basic safeguards such as password policy enforcement, two-factor authentication and other standard security controls, said Vladimir.
Vladimir Dashenko, Principal Security Researcher at Kaspersky commenting on the recent fridge cyberattacks in Europe
In addition, these refrigeration systems often exhibit weaknesses in secure software development and SSDLC (Security Software Development Life Cycle) processes.
Further, such cyber-physical systems are often exposed to the internet rather than properly isolated from it and such refrigeration control panels can be identified through search engines like Shodan and Censys, which are index internet-accessible devices, said Vladimir.
In effect, if a device is reachable online and insecurely configured, it can be discovered by both administrators and threat actors. Needless to say, this increases the risk of unauthorised access and the exploitation of known vulnerabilities and interference with equipment operations, added Vladimir.
“What’s worse, information on achieving remote arbitrary code execution on similar refrigeration control panels as those affected by the back have previously appeared in the public domain and in some cases, manufacturers lack a mechanism to enforce the installation of critical updates, making this a plausible vector for this kind of cyberattack,” said Vladimir.
Kaspersky security recommendations
To prevent future incursions, Kaspersky recommends vendors to incorporate security requirements from the design stage onward, avoid direct internal exposure, implement strong authentication and ensuring timely installation of critical updates. Further, buyers and organisations procuring such hardware should pay attention to the vendor’s cybersecurity practices including patch management and management of remote access.