On this page · 5 sections ▾
Commercial fridges and freezers are often run by networked controllers, small computers that set temperatures and defrost cycles and can be reached remotely for maintenance and alerts. If an attacker gets into one of those controllers, the same remote access lets them command the cooling equipment directly. In the latest wave across Europe, the apparent result was freezers pushed to around 50°C (122°F).
What is a refrigeration controller?
A supermarket does not rely on a simple thermostat in each cabinet. Refrigeration units are managed by control systems that regulate temperature, schedule defrost cycles and raise alarms when something fails. As The Verge noted, many modern units are connected to the internet to support remote maintenance and failure alerts.
That connection is useful. A technician can diagnose a fault without driving to the store, and a manager can be woken by a phone alert at 3 a.m., as one Delhaize manager described to Belgian broadcaster RTBF, according to Digital Trends. The cost is that a device built for cooling is now also a networked computer that can be attacked.
How does the attack work?
According to Tom's Hardware, the hackers remotely activated the built-in defrost mode and overrode both the temperature and the time spent defrosting. Defrost is a normal function: it warms the evaporator coils briefly to clear ice. Sabcobel, a Belgian refrigeration company, said the units' evaporators had been switched into defrost mode, as The Next Web reported.
The attacker does not need to break any hardware. A normal feature is simply run with unsafe settings and no end time. Frozen and chilled food warms quickly, and one Belgian store manager told RTL Info the result was "catastrophic" and that the whole fresh and frozen range had to be thrown out, per The Register.
Why is it so hard to fix?
The first problem is age. After the attack on French supermarkets last month, Danfoss, a Danish maker of refrigeration software, said the hacked units were older machines it could no longer patch against the threat, according to Digital Trends. The Register adds that some affected stores ran outdated firmware on Danfoss controllers, and that CERT-FR published an alert about compromised Danfoss AK-SM and AK-SC controllers.
The second problem is that software fixes are not always enough. Sabcobel's CEO said that physical modifications to its units are required, and that many will need them to be restored, per Tom's Hardware and The Next Web. As an interim step, he said, putting units on a secure internet connection is the simplest measure, one most customers took after the French attack.
It is also not yet clear that the same flaw was used each time. The Register notes it remains unclear whether the latest attacks used the same methods as in France, and The Next Web reports no evidence linking the incidents in Sweden, Belgium, France and the US. Nobody has claimed responsibility.
