European supermarkets that failed to act after French freezer attack are now feeling the heat
Network World ·
Just a couple of weeks after a cyberattack on French supermarket refrigeration systems resulted in spoiled food, and even some fires, retailers in Belgium, Ireland, Sweden, Finland, and Estonia were hit with nearly-identical attacks on Monday. The mid-October attack prompted an advisory from the French Computer Emergency Response Team (CERT-FR) recommending that organizations disconnect any refrigeration control systems with public IP addresses from the internet, and to reconnect them via a secure VPN only after verifying the configuration and, if necessary, restoring factory defaults. In an emergency, the advisory suggested, organizations could simply filter connections to allow only the IP addresses of their refrigeration suppliers or service providers to connect, but this should not be a long-term solution. The Monday attack, like the one in October, “resulted in sudden changes in the temperatures of their fridges and freezers,” according to a Bloomberg report , which confirmed incidents with impacted retailers, including Carrefour, Spar, and Ahold Delhaize. No group has as yet claimed to be behind the attacks. Delay understandable Analysts and consultants said the lack of an immediate response to the initial refrigeration attacks is understandable, given the complex nature of the systems and the multiple vendors who typically manage such systems for major retailers. Gartner Distinguished VP Analyst Katell Thielemann said that although the impacted European retailers own the hardware, they outsource the maintenance, upkeep, and the management. Thus, she said, “there is some confusion about who owns what in this black box of outsourcing.” IDC Senior Research Manager Bobby Kuzma agreed. “There’s a huge gap in visibility between the folks who monitor threat intelligence and vulnerability reports, and the people who manage the OT/industrial side of the universe,” he said. “The cybersecurity teams may not have even been aware that the devices were network connected, especially if they were riding on dedicated internet circuits for manufacturer support.” Thielemann added that the incident was made worse because of the historic lack of priority given to cybersecurity defenses in retail. “It’s proof that cybersecurity is still not top of mind,” she said. “Even when it’s so egregious, senior [retail] leaders are not asking, ‘How do we get ahead of this?’” However, Kuzma argued, this problem comes down to asset inventory visibility. “You can’t protect a system that you don’t know you have. You can’t scan for exposures on a connection that you don’t know exists,” he pointed out. “Sometimes that inventory requires somebody physically going into the telco closet at the locations and asking pointed questions about equipment that’s present. In this day and age, having devices of any type hanging off a public internet connection and accessible is asking for trouble.” IoT handled outside of IT David Neuman , an executive advisor with consulting firm Acceligence, also noted that it was never realistic to assume that issuing a cybersecurity advisory was going to meaningfully address this security hole. “An advisory doesn’t fix a system nobody in the building owns,” Neuman said. “Contractors often install and service store refrigeration controllers under arrangements that rely on a constant data feed, so they can sit outside the security team’s inventory and authority. Taking the controllers offline means finding them, then reworking how the contractor gets in, store by store.” That, he said, “explains the gap, but it doesn’t excuse it: France gave everyone a three-week warning. Abusing a legitimate function like defrost causes physical and financial damage without any malware.” Brian Levine , a partner at consulting firm Control Risks, added that another part of the problem is that IoT devices have always been handled outside of IT. “For years, organizations treated connected operational equipment as a facilities issue. These incidents end that debate,” Levine said. “Security professionals never dismissed this risk; budgets deprioritized it because nothing had failed at scale. Now it has, and boards will ask why vendor contracts, incident response plans, and tabletop exercises never accounted for a physical outcome.” And, said Noah Kenney , principal consultant at Digital 520, this issue goes beyond the fact that the attackers could gain access. He said that he is most concerned about the range of things the attackers were able to do with that access. “The attackers could reportedly manipulate refrigeration systems to operate far outside their intended parameters,” Kenney said. “Even if someone gains access to a system, there should be independent safeguards preventing commands that could damage equipment or disrupt operations. The fact that remote access can potentially translate into physical damage suggests some serious gaps in how these systems are designed and secured.” Kenney also noted that some of these devices had long passed their end-of-life, meaning that security patches and other upgrades may have been unavailable. “Organizations can end up relying on equipment that still functions perfectly well operationally, but can no longer be adequately secured,” he pointed out. “That creates difficult decisions about network isolation, compensating controls, and ultimately when equipment needs to be replaced.” Indeed, said independent technology analyst Carmi Levy , some in IT tend to ignore IoT systems, especially when they were deployed by functional units without permission from IT or cybersecurity teams. “Enterprises don’t tend to look at fridges in the same light as servers, smartphones, and other traditionally connected devices,” he noted. “If anything, most IT shops have a limited view of what constitutes a connected device in the first place. That means many organizations are running connected devices, such as appliances, floor cleaners and once-dumb but now increasingly smart machines, with dangerously outdated firmware because they never identified them as connected in the first place.” Unexpected threat to IT As well, said Frank Dickson , principal analyst at Dickson Research, there are also corporate legal issues that may undercut cybersecurity’s need for quick action. “CERT-FR’s own alert shows why that takes time. Before cutting a controller off the internet, it tells operators to check the insurance terms in their contract with the refrigeration provider. That one line says a lot,” he said, adding that many of these controllers are installed, monitored, and guaranteed by a contractor who depends on the data feed. The store may have neither the ability nor the authority to shut them down. “Three weeks of warning is a long time for an attacker and a short time for a supermarket chain. Close the door to the internet first and renegotiate the contracts second,” he said. Dickson also argued that these refrigeration attacks pose an unexpected threat to traditional IT systems as well, because servers and other equipment are temperature-sensitive. “An attacker who reaches the building management system does not need to touch a single server. The servers will shut themselves down rather than cook,” Dickson said. “You do not need to hack the data center. You only need to hack the air conditioning.” This article originally appeared on CSOonline .