Wednesday Morning Rant

This article was written before election returns came in, so this is not an election thread. You are welcome to discuss that anyway if desired, since election returns are probably the main topic of conversation

The past decade or so has seen a wild proliferation of stuff that falls into the general category often called the "Internet of Things," or IoT. These are things that do something and connect to the internet either to perform its work or to extend its functionality. IoT devices are often referred to as "smart" devices. "Smart" cameras, doorbells, TVs, locks, thermostats, switches and more all go online to function or to work to their maximum effect. This is all increasingly common and often underscores security and privacy issues or risks. Those risks are so real that it's not unreasonable to just assume that all of it is simply not secure at all, and implement or it not based on your risk appetite.

But that's in the household. IoT is not merely merely for consumer electronics and household gadgets, it's also industrial equipment, and the risk profile there is radically different. If someone hacks your "smart lock," he can wander in and rob your house. If he hacks your "smart camera" and catches something compromising, he could blackmail you. If he hacks your factory, that's a whole different story. If he hacks your supply chain management, that's a whole different story. The risk blast radius in industry is much greater than it is at the household level, and those risks are not merely hypothetical. There have been some very public incidents in Europe that demonstrate the problem, as multiple attacks on industrial IoT were targeted squarely at the food supply.

Last month, there was a coordinated attack on commercial refrigeration equipment produced by a Danish manufacturer. Most of the targets were in France, and multiple supermarkets and suppliers were exposed to major product loss as a result of their refrigerators being told to stop refrigerating. This was accomplished setting the refrigeration temperatures high or turning on the integrated defrost cycle. The machines were not off, nor were they offline - they were just set high enough to let things spoil:

Speaking to BBC Radio 4's PM programme, Alex Pearce, the managing director of fruit and vegetable supplier Langridge Organic, said he had noticed on Monday morning that two of his company's fridges were showing "abnormal temperatures and defrost settings".

"A third fridge suddenly went into a defrost mode ... At the back of my mind I thought, 'I think we're being hacked.'

"So I unplugged the cable from the wall which disconnected our fridges from the outside world."

He said the company's fridges had been set as high as 150C.

Mr Pearce said: "I reckon I caught them by luck right in the middle of it being hacked."

Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".

It said its AK-SM800 and AK-SC355 fridge regulator systems were notably affected, with a version of the former using "outdated firmware". It added that it had long advised supermarkets to update from those models. Danfoss gave no figures of how many systems were affected.

Authorities in France described the attacks as "amateurish" and offered assurances that there was almost no chance a state actor was involved. That is probably true, but that also makes it worse, not better. If some unsophisticated hackers can cause a few million Euros in losses (which are food losses) literally overnight, imagine what the sophisticated ones can do - especially since it happened again this week, in a different set of countries and with a different manufacturer's equipment. Like last time, some outfits noticed right away and intervened while others suffered significant product losses. The overall scale of the more recent event was smaller, but it was the exact same style of attack: instruct the connected refrigerators to change their setpoints.

Connected industrial equipment gives a real benefit to the operator, which is why it is used and why organizations will pay for it. Centralized monitoring capability alone is probably worth it for any organization with multiple locations. Real-time status, conditions monitoring, fault detection and isolation, coordinated maintenance activities, utility cost optimization and more are all very real improvements to large-scale operations and industrial IoT makes that possible. Those very real benefits, however, come with very real risks when it comes to both failure scale (the consequences of errors can be more severe, because they are wider in scope) and external threats (hackers and similar). The convenience and optimization of industrial IoT requires rigorous change control, security-conscious infrastructure design and strict security process control. Many places - and manufacturers - embrace the former and skimp on the latter. Control surfaces are directly connected to the internet, updates don't get applied, change control is lackadaisical, corporate infrastructure security is poor, etc. Fixing those things not only reduces operational convenience, it increases cost - though probably not more than major equipment failures.

These have been comparatively little incidents and were not disasters. They were loss-making inconveniences, but the scope of these attacks has been thankfully limited. These small-scale incidents, however, highlight a major risk. More than a decade ago, someone once put to me as, "our only hope is that the Internet of incompatible Things collapses under its own weight before the Internet of insecure Things gets us all killed." Engineers have largely solved the compatibility problems, because that's what engineers do. The security problems, however, must be dealt with before little incidents like these refrigeration attacks are seen merely as contextual footnotes in the history of industrial IoT disasters.

posted by Joe Mannix at 10:57 AM

| Access Comments