Weak passwords were enough to hack supermarket fridges, says France's cybersecurity agency

“Basic security failings.” That is how Vincent Strubel, director general of ANSSI (France's national cybersecurity agency), summed up for senators the attack that disrupted the refrigeration systems of hundreds of supermarkets in mid-October, according to Public Sénat.

The hearing took place on October 21 before the Senate's Foreign Affairs committee. The head of ANSSI described refrigeration equipment exposed directly on the internet, administered with no particular protection and secured by weak passwords. The attack hit Intermarché, Super U and Leclerc stores, more than 700 according to Public Sénat. Temperatures rose in display cases and freezers. In some cases, several hundred thousand euros' worth of goods were thrown away.

Why ANSSI rules out known vulnerabilities

Since the attack, several hypotheses have circulated. The supervisory controllers from Danish manufacturer Danfoss, present in the affected stores, had been the subject of researchers' work over the past two years, and CERT-FR (the French government's computer emergency response team) had issued an alert on October 12. Vincent Strubel dismissed these “third-party analyses” that pointed to the exploitation of published vulnerabilities. In his words, these are “fairly classic vulnerabilities that are covered by recommendations.”

These recommendations are not new. Since 2014, ANSSI has published a guide to securing industrial systems, whose first rule is not to expose them directly on the internet. That advice is “not systematically followed,” Vincent Strubel noted.

Vaccine fridges in the spotlight

The head of ANSSI broadened his remarks. Comparable equipment is used to store vaccines, from research laboratories to pharmacies. He said quick work had been carried out with healthcare stakeholders to check how well these fridges are protected.

During the same hearing, Nicolas Roche, secretary general for defense and national security, pointed to a rise in hybrid attacks in recent months, combining cyberattacks, drones and espionage. He also described threats that are very unsophisticated but have a strong political impact, the work of young, local petty criminals. Vincent Strubel called the phenomenon “endemic,” describing young French people motivated by reputation more than money. Public Sénat's report does not say who is behind the fridge attack.

Good habits for your remotely controlled equipment

No cutting-edge technique here: a controller reachable from the internet and a weak password would have been enough. The steps to take are therefore within reach of any site manager:

• check that no refrigeration, heating or ventilation controller is reachable directly from the internet: this is ANSSI's first recommendation;
• route remote access through a VPN or a controlled gateway rather than an open interface;
• replace default or overly simple passwords, including those used by maintenance contractors;
• ask your refrigeration technician for the list of people who can connect to your installations, and from where;
• apply the manufacturer's updates.

Two questions remain open: who carried out the attack, and who will pay for the lost goods. Neither has received a public answer yet.