- cross-posted to:
- pulse_of_truth@infosec.pub
- cross-posted to:
- pulse_of_truth@infosec.pub
The refrigeration systems were cranked up to 122 degrees Fahrenheit in at least a dozen countries.
What’s that in normal European (and everyone else) units?
It’s exactly 50°C, which probably means that the figure in the article was converted to fahrenheit by the author.
Patrick Lamplmair, CTO at the Austria-based cybersecurity firm Tributech, demonstrates the Peter Principle by not understanding what a process controller is, says a simple cut-in/cut-out w/ deadband logic should’ve known better, and probably thinks this could have been prevented by removing the image of a flame from the UI of the controller.
Really begs the question… Why are they connected to the internet at all??
Internet connected can be useful in commercial environments. When designed properly it isn’t a issue unless someone is really motivated.
The problem is the lack of a Firewall and network partitioning. The vendor was extremely sloppy in the design and security configuration which made it trivial to attack.
Never said it cannot be useful, just unnecessary.
I hope they aren’t, and we’re seeing the failure of securing the network they’re on.
Companies I’ve worked for keep different stuff on different networks, and to manage those things you either have to physically be connected to that network, or go through some kind of portal (secured with it’s own credentials) then have credentials for the management systems.
I’d bet all the attacked systems are on a fairly flat network, and the control systems (servers and management devices) are poorly secured with minimal credential policies.
Being connected through a portal is still connected to the internet.
It still explains nothing about why is it remotely necessary? A freezer and fridge do not need frequent adjustment. Their ‘monitoring’ can be done by extremely simple thermal regulation systems that have existed for decades upon decades. It’s not necessary what so ever.
It is at the scale these stores are operating at
They were literally exposed to the internet
Anyone could and still can connect to them



