Hackers hit French national blood bank

So I worked for a company who's product was sensor networks for this exact situation, and the European company who bought us had a cloud-only solution they wanted to replace our on-premise product with. Thankfully most hospitals and research institutions in the states are smart enough to reject cloud-based solutions for this exact reason. In theory you could penetrate our systems but it would have to be a very direct, specific attack to be able to do it. My colleague in Germany has been an SWE contractor since 1978 and is genuinely the best engineer I've ever worked with. No matter how off the wall my ideas were he'd already considered it and eliminated it as an option.

Or if you really really want to, make sure it’s just a read/view only architecture?

Yes, especially after this has now been happening again and again. First case can be excused as usual bad practices and lazyness. But it should have been a wake up call causing anyone else operating commercial freezers (or even other equipment) to review if/how they are connected to the Internet. Anyone getting hit now is maliciously incompetent.

You can learn from TSMC or power grid networks. These networks are highly secure and must be separated into internal and external networks. There shouldn't even be any chance for the external network to access the internal network.

Of course, physical ports are also a risk, but they're easier to detect. At least someone has to come in.

Centralized monitoring of thousands of refrigerators makes sense but it should be read only.

Yeah. Whoever is responsible for this is sufficiently evil to warrant termination.

These things happen in (hybrid) war.

What remote control mechanisms do detectors needs? Can't they just be broadcast only devices?

> The advent of AI and its ability to find vulnerabilities so quickly

No AI needed. The supermarket controllers had software with guessable passwords and outdated nginx, both of which had patches out for a year.

Some hardware had reached end-of-live, and were never replaced.

All were connected directly on the internet instead of secure APNs or VPNs.

This is long-standing, basic management failure, and the fines should reflect that.

How do you deal with bankruptcy? Also most companies, even larger ones with seemingly a well-managed board, actually rely around the aura of the founder.

> call it End Of Life with flagrant issues still happening

It's precisely because there are unreasonable issues that they EOL them. Retiring products because of issues should be encouraged.

How? Well all products should be sold as a service - medical devices are, even if they appear as a purchase, they have strong post-market surveillance requirements. But that makes everything super expensive. It's only affordable for rich economies like Singapore.

And if you need to alter the initial settings, you do what? Also, your solution is negating one of the biggest benefits of remote control: less errors from tech on the ground.

I imagine that, unfortunately, a lot are, but others might lack things like MFA at their trust boundaries

IT security is a pretty complex topic and a lot of businesses don't have the knowledge in-house to access the security of their own infrastructure

If you have no-one to actually patch your devices and architect your infrastructure, you'll probably end up with just asking the "geeky" student assistant to get it sorted. They'll throw it on the office WiFi, set the same user+password on all the devices and call it a day

In my experience, the vast majority of orgs have essentially no IT security

It's the defrost cycle.

Modern "frost-free" freezers have resistive heaters inside them.

Basically understand that fridges and freezers work by making a surface, heat exchanger or some type of pipe cold. Being cold leads to moisture in ambient air condensing on that. And being usually below freezing to icing on it. Ice is not very good heat conductor. So you want occasionally get rid of it. Easiest way to achieve this is heating it. Simple resistive heaters are cheap and maluable for this.

Now if you can control these heaters you can pump up the temperature to quite high. And I imagine with certain uses cases actually emptying the whole thing heating it up to melt ice and then bringing temp back down is not that unreasonable process. Also allows keeping the temperature in very close range. For home appliances bit more temperature variation is acceptable.

Seems like it's more of a walk in freezer situation and it can be controlled in either direction.

They have had over 60 days.

https://signalandsilence.substack.com/p/i-think-someone-hack...

We're 30-35-ish years too late.

The first time we found a provable case of malicious hacking, whether by individuals or nation-states, the result should have been the termination of that entity. Nothing says "stay out of my network" like a bloody head on a fencepost.

Only if you can find them. And only if they are in a country where you can get them.

Agree. There should be a worldwide effort against them by all governments everywhere.

How low must one go to do such a thing as attacking a blood bank? Of course, some of these low people are also low life governments.

They're state actors performing hybrid warfare.

Yes, but not in the same way The Onion (or its French counter part Le Gorafi) are satirical.

Le Canard enchainé makes fun of people and institutions, but never makes stuff up, and are arguably more rigorous than most mainstream media outlet. They have a long history of exposing real scandals, albeit with a tongue-in-cheek manner.

Nope. It's a serious newspaper reporting on serious news. Usually with a vitriolic tone and wordplay, but it's absolutely not a satirical newspaper like the onion (the french equivalent would be le gorafi).

Same news other serious outlet:

[1]: https://www.franceinfo.fr/internet/securite-sur-internet/cyb...

yes but The Telegraph too runs invented stories

Check out /r/NotMyJob/. You can lose faith in employees, and humanity in general, one video at a time. All it takes is few people who DGAF and security issues won't ever be detected, to say nothing about addressing them.

The way I understand it, and someone please correct me if I’m wrong. Whoever hacked the devices send a command to increase temp to 110, but it never reached that number, instead it just reached the max. But the news story still reports it as if the blood literally started to boil to 110c

There is plenty of options already on the market. From specifically for remote use to simple features on routers.

Still, spending any money on basic security seems to be way too much these days.

Conveniently already backdoored!

The article states there was no impact on stored products, because the attack was detected early.

I'm not sure why you're talking about red tape, is that really related to the article?

The EU will release a statement where they claim to be very concerned. Then maybe write an additional 1200 page regulation on industrial refrigeration that will fix the problem by making impossible to legally refrigerate anything. The usual.

>I wish they target countries like China instead of spineless france.

Because Chinese Life is less worth than "spineless" French? What is that disgusting worldview of yours? You know what a blood-bank is, right?

Spineless or beholden? That is the question.

So if the attack comes from groups hosted in <checks notes> Israel, Russia or some SEA proxy of China, what does France do? Nuke the country?