French fridge fopar gives cyber security community the chills

Key Insights:

• A high profile cyberattack on European refrigeration systems has been called a 'catastrophe'
• Hackers are reported to have remotely changed the temperatures of supermarket facilities causing the destruction of fresh and frozen foods
• Attacking equipment essential to the preservation of fresh products and the food supply called "an unprecedented event"
• Opinions differ - is the event a simple failure to patch vulnerable systems or "a means of political destabilisation"
• Danish systems vendor Danfoss had published advisories and claims impacted fridges "were running outdated firmware"
• Media coverage shows the emotional impact an OT incident can have globally

Food security a growing concern

"If France is not supplied by its supermarkets, the people would be hungry, and a hungry people goes to revolution. It would be a catastrophe"
Thierry Cotillard, president of the French retailer group Les Mousquetaires

Global media coverage of recent events in Europe has highlighted the scale of the potential impact of technology failures when a vendor vulnerability is not proactively patched.

Les Mousquetaires, owner of the retailer Intermarche, said fridges at around 150 of its ⁠French stores were heated up to 50C for six hours overnight. As a result, all affected food was discarded to prevent possible health risks

Carrefour, Monoprix, Netto and other brands reported similar impacts across refrigeration systems with dozens of supermarkets in France, Belgium and the Netherlands also said to have been affected. Resulting losses from food being thrown away is said to be in the region of multi-millions of Euros.

Retail chief Thierry Cotillard called the event an “unprecedented” attack with losses prerdicted to reach “tens ​of millions of euros nationwide in a single day.”

And European Commissioner for Agriculture, Christophe Hansen, said on X: "Food security requires more attention at all levels. Because the weaponisation of food has become a reality."

An attack or a failing?

The resulting financial and political fallout has prompted the French government to investigate a high profile cyber incident and blame was initially laid at the foot of the systems software supplier Danfoss.

France's National Cybersecurity Agency (ANSSI) and the Paris prosecutor's office are reported to have opened formal criminal investigations into the widespread attack.

Danfoss has responded by saying that the modified control systems were "were running outdated firmware" and that it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions".

Hackers have previously exploited outdated firmware on connected refrigeration management systems in other countries including the US and retailers have proven to be an attractive target for criminally minded threat actors seeking ransom payments to enable a return to operations.

Security specialists responsible for OT operations have considered the tampering to be common failings due to a range of factors:

• Refrigeration systems can be bought and owned by engineering specialists in Facilities not IT
• Remote access is mandated by suppliers or vendors to support systems but security may not be the priority
• Alarms on failing fridges must be monitored and responded to rapidly so blocking outbound alerts is problematic
• Patching systems can fall between stools when ownership is uncertain for ongoing cyber hygeine

The key questions to ask in supermarket operations remain the same for any OT operator - not necessarily "is it patched?" but "who can access the equipment and would anyone notice is anomalous changes were made?"

A fridge is just another endpoint

Whilst todays media coverage has proven widespread, there have been previous instances of common security failings as root cause. for technical tampering.

In January 2019, a Dutch man was sentenced to four months in prison for hacking into a supermarket’s refrigeration system in the Netherlands.

The individual was a disgruntled former employee of the refrigeration contractor Nijmeijer Koeltechniek and the cause was a failure to rotate key credentials following offboarding.

Used known log-in credentials and existing passwords to gain unauthorised access to the network of a Plus supermarket, the man remotely altered the temperature settings of the store's commercial refrigerators.

Fortuneately in this event, prompt intervention by the supermarket limited actual stock damage highlighting the need to monitor and respond to such activity and resulting alarms.

That same year, UK controls manufacturer RDM responded to security research showing Shodan could uncover many similar internet-connected management interfaces for refridgeration used by supermarkets, hospitals and pharamceutical companies.

The vendor responded by saying that controls documentation required default passwords to be changed during set-up and blamed installers for failing to follow guidance on secure configurations.

It's often the foundational security practices that may be skipped that can be blamed for resulting losses.