Hacker News Reader

"... I think this may have to do with rural stores having essentially consumer-grade internet routers connected to ..."

It has to do with refrigerators reachable on the Internet.

If the refrigerators were not reachable on the Internet, none of this fragility would exist.

The fragility of refrigerators reachable on the Internet was demonstrated just a few weeks ago. These refrigerators were left connected to the Internet.

This lack of discernment and misunderstanding of risks and fragility will not be solved with a better router or a different uplink.

Yeah

And it would be (mostly) fine if they were on the net, with read only access

Do you think the code in these systems is secure enough to enforce read-only access?

It doesn't need to be perfect, it only needs to be better than what it is today (predictable passwords)

Easy, you don't connect the control systems to the monitoring systems.

At the very least the system should pull configuration info from a trusted source at predefined times instead of being available for it to be pushed at any time.

The entire reason they are put on the Internet is to allow for remote control. What problem would it solve to allow remote monitoring of refrigerator data without control?

I'm not in perishable food so what do I know.. But organization wide food safety measurements are probably more important than the average process BS.. Performing a full heat cycling of a freezer while no one is present to confirm the correct device OTOH sounds idiotic.

How many times have you changed your fridge temperature in the last year? Once a year? Twice?

And most importantly, these fridges always have someone close by. Make it a physical button instead of a remote function

Because then you can monitor it, and then call someone at the store to change the settings. Or go into the store to fix the one that isn't doing what's expected. You can still get alerts, diagnostics and data.

I mean, what happens when a compressor or other physical part goes out? You can't fix that remotely anyways. You might still want remote monitoring for that kind of situation.

Many of these smaller stores (and probably some of the larger ones too) rent or lease refrigeration equipment from one of a handful big providers. These are large and expensive systems, and there is costly paperwork involved together with logistics suppliers to show that the cold chain is satisfactory.

These refrigeration providers work with local contractors and HVAC companies to set things up. Their installation techs do what they think is required to remotely operate these systems. If you bring up the question keeping these systems offline or at least on airgapped networks you will most likely get a shrug as reply.

This is not a technology problem. This is problem of responsibility. One can hope things will improve when litigation starts happening, but it doesn't look good considering these people had literally months of notice since the well-publicized attacks on the American fridges, then the French fridges, and now these.

Litigation is not how we fix things in Sweden, the system is very different from the US. The companies will have to take the losses or try to recoup from insurance and update their systems. They might be able to negotiate deals w the fridge install companies.

How do things get fixed if not by litigation?

Usually national associations get together, discuss issues, and come to some sort of agreement or recommendation that is then followed by most actors.

Litigation does of course occur but it's not the main mechanism.

We try this in the US as well, it’s commonly referred to as “hopes and dreams”.

Do you folks coordinate in the way described, and show success with it? (Would most people agree with you?)

Is this a stupid question..?

Are you using the up and down votes as a Yes and No reply? ^_^ Should I follow the white rabbit?

The Swedish national anthem is entirely defined by common consensus, there was a proposal to establish it by law in the 2000's but that was rejected.

Sweden doesn't have a state created e-id system, instead a consortium of banks jointly funded development of a solution in the early 2000 and this is basically the default way you prove your identity online in Sweden.

Fucking Saltsjöbadsavtalet.

Parent is not correct. Litigation certainly is a thing, but it is less prevalent than in the US. Perhaps the food chain will take the loss, be covered by insurance, and the insurance company will sue.

If not buy insurance, the customers will have to pick up the tab. Vendors sell the product/service and are completely responsible for any losses.

That is the same way it works in the US.

Some countries have regulatory bodies that are empowered to effectively regulate industry.

It's a nice thought. I doubt it's true in reality. If it were true in this specific case for example, the industry wouldn't have the freezer situation to begin with (it implies non-effective regulation is already the context).

It is simultaneously true that:

1. many countries have higher regulatory burden than the US

2. that does not mean regulatory gaps don't exist

The person above was simply pointing out that litigation is not the only way to solve a problem. Which is plainly true, you can simply require compliance via other legal means. For example, a government could create a regulatory standard for security and require vendors to follow it. Whereas in the US the political appetite is to be more hands-off and allow people make vulnerable products if the market allows.

Isn’t that just litigation brought by the government instead of private citizens?

No, most of the activity or function of regulatory bodies is not litigation. Litigation would be the last resort.

Litigation is the last resort in the US system, too. It is the threat of fines/damages that incentivizes a company to do right by its customers/other stakeholders.

I never said it wasn’t. What is different in the US is a political reluctance to enact regulatory controls to protect rights proactively.

All of the fridges stayed online after the hack. I ran a Shodan scan a few days later, and the number of reachable fridges actually increased. The first hack might have been a surprise, but anyone who was IT in a refrigerator management company should have been able to run a (free) Shodan scan like mine and get the whole list.

> I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router.

Why would there be accidental port mappings on their router though? I could maybe see owners setting it up so they could monitor from home, but even that is a bit of a stretch for rural supermarket owners

> Why would there be accidental port mappings on their router though?

That's the point of NAT-PMP / UPnP, it just works (for game servers, torrent clients, industrial control systems etc.)

The idea of a control system requesting a port forward rule using NAT-PMP is itself rather questionable.

Ah ok, I misunderstood what NAT-PMP was. Thanks for explaining.

My guess is setting up a port forward in the gateway router is part of the freezer install process. The customer probably had to give the tech the router credentials and the tech sets up the forward themselves.

> In Scandinavia you can bypass CG-NAT on mobile connections by setting a particular APN

Details, kind sir

absolutely unbelievable (even by the very low standards I see, being in iot myself) that any commercial equipment would be doing upnp

someone manually poking a hole in their firewall is way more likely

It shouldn't matter anyway. The endpoints should been using default and secure technology or vpn only.