Hacker News Reader

Comment by drillsteps5 | Hacker News Reader

To be fair, their entire threat model was likely "who TF would want to break in to change the settings on a thermostat on a fridge at a grocery store".

A valid question which has yet to be answered (at least not publicly).

View on HN

If 'who TF' includes "everyone on the internet", then there are more than enough people who would do it to prove a point, for bragging rights, just for kicks, or because they want to cause as much damage as possible. The only question is how large is the intersection of that group and those with the ability and awareness to do it (something that is growing with the increased capabilities of LLMs).

Well _obviously_ there were enough people willing to go into the trouble of doing that. Because someone(s) actually did.

I'm just saying it wasn't a high value target like a bank. Which is what they counted on.

Some threat actor that demands quick payment or their perishables perish?

It's a fridge. In a grocery store. You just get an employee to adjust the thermostat dial. How would the hackers demand payment if all you need to do is turn the dial back to "frozen"???

Edit: Yes i know the commercial fridges do not have "dials" and it's more involved. Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.

> Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.

Sure, with time and expertise. How does the average employee adjust the virtual thermostat on fifty network-controlled fridges before the food goes bad?

I don't know about your grocery store but the ones I've been to have maybe 5 on the shopping floor and probably a few more in the back. They all have physical controls which (I'm assuming) override the controller if something goes wrong. So if big bad hacker says "I'm gon' turn y'all fridges off if you don't pay me" it's not a threat, it's a silly joke.

Unless of course they turn it off without telling the businesses so the products go bad because nobody's watching over the weekend or smth. But then again, why would someone want to do that. I wonder.

not if you set it to defrost at 1AM. the food's gonna be cooked by the time someone comes in

Clearly, somebody TF had a strong enough motivation to do it. Not for ransom (unless stores are hiding part of story) just for the lolz or directed harm.

Could be competition, could be lonely angry incel hacker, could be state actor (ie russia would not be out of picture given their past actions and current war they wage against entire western culture, but they are far from the only ones).

Leave phpbb forum unguarded, it will get hacked quickly. What gain? None apart from hoping to mine some crypto or be part of botnet. Still, will happen reliably.

That's true, however (phbb/mediawiki/wordpress/etc)'s exploits are very well documented and widely available for people to use simply due to popularity of these software. Which is not true for much more obscure software running on these controllers. So breaking into these was not not only low value but also high effort.

Reply on news.ycombinator.com