This weekly roundup thread is intended for all culture war posts. 'Culture war' is vaguely defined, but it basically means controversial issues that fall along set tribal lines. Arguments over culture war issues generate a lot of heat and little light, and few deeply entrenched people ever change their minds. This thread is for voicing opinions and analyzing the state of the discussion while trying to optimize for light over heat.
Optimistically, we think that engaging with people you disagree with is worth your time, and so is being nice! Pessimistically, there are many dynamics that can lead discussions on Culture War topics to become unproductive. There's a human tendency to divide along tribal lines, praising your ingroup and vilifying your outgroup - and if you think you find it easy to criticize your ingroup, then it may be that your outgroup is not who you think it is. Extremists with opposing positions can feed off each other, highlighting each other's worst points to justify their own angry rhetoric, which becomes in turn a new example of bad behavior for the other side to highlight.
We would like to avoid these negative dynamics. Accordingly, we ask that you do not use this thread for waging the Culture War. Examples of waging the Culture War:
-
Shaming.
-
Attempting to 'build consensus' or enforce ideological conformity.
-
Making sweeping generalizations to vilify a group you dislike.
-
Recruiting for a cause.
-
Posting links that could be summarized as 'Boo outgroup!' Basically, if your content is 'Can you believe what Those People did this week?' then you should either refrain from posting, or do some very patient work to contextualize and/or steel-man the relevant viewpoint.
In general, you should argue to understand, not to win. This thread is not territory to be claimed by one group or another; indeed, the aim is to have many different viewpoints represented here. Thus, we also ask that you follow some guidelines:
-
Speak plainly. Avoid sarcasm and mockery. When disagreeing with someone, state your objections explicitly.
-
Be as precise and charitable as you can. Don't paraphrase unflatteringly.
-
Don't imply that someone said something they did not say, even if you think it follows from what they said.
-
Write like everyone is reading and you want them to be included in the discussion.
On an ad hoc basis, the mods will try to compile a list of the best posts/comments from the previous week, posted in Quality Contribution threads and archived at /r/TheThread. You may nominate a comment for this list by clicking on 'report' at the bottom of the post and typing 'Actually a quality contribution' as the report reason.
Jump in the discussion.
No email address required.
Notes -
https://uk.finance.yahoo.com/news/french-supermarket-chains-cyberattack-forced-115141288.html
This is a poetry of stupid and the hackers are the least guilty party here. Lets start with the obvious. Why freezers needs to be visible, why do they need to be remotely managed, why is not this done on dedicated internal network, why do they need firmware updates. How did we get to the point where a device that should be pid controller, compressor and alarm can be hacked.
To make you feel better - all of your nice EVs are also permanently connected and I doubt that there is air gap between the infotainment and the firmware of the battery pack. Someday someone will be able to accelerate or set on fire EV remotely. And probably soon.
No, the hackers are the most guilty. This was stupid and pointless, and the best reason I can put on it was to show that "next time we'll ask for ransom not to do this, this isn't a spoof, we just proved we could fuck your stores up", which is criminal behaviour.
Otherwise it's just destruction for the sake of it, spoiling food for nothing more than showing off how clever they are. Yeah, the stores should have better IT security, but who would have thought anyone would be destructive for the sake of mindless vandalism to do something like this?
Anyone frequenting IRC in the late 90s?
Do you have any proof that the hackers were in jurisdiction in which spoiling French food is a crime?
Do we really need to be at the point of "oh show me the jurisdiction where this activity is a crime" now? Whatever happened to "only fuckwits do this"?
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
My house has smart lights in it. I decided to try pairing them to my phone in case I have time to ever want to change their color one day.
After connecting the app tells me some of the bulbs need a firmware update. Light bulbs need firmware updates these days, apparently.
So yes of course supermarket refrigeration systems also need firmware updates.
Light bulbs shouldn't need firmware updates either.
More options
Context Copy link
One man's modus ponens is another's modus tollens.
I think the lesson here is that electronics are not expensive enough.
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
I despise this framing, and it is obviously false. The most guilty party in any situation is always the actual guilty party. When a women walks down a dark alley in skimpy clothing and gets raped, the most guilty party is the rapist. When a farm sets out an unattended stand with fresh produce and a box to put money in and someone comes and steals everything, the most guilty party is the thief. When a supermarket doesn't put locks on their toothpaste and someone comes and shoplifts a bunch of toothpaste, the most guilty party is the shoplifter. When someone puts refrigerators on the internet and they get hacked, the most guilty party is the hacker.
Yes, you need to be vigilant and aware that bad people exist and take precautions to protect yourself from them. If someone is in a low trust environment where bad people are prevalent, it is irresponsible and negligent not to take precautions, and anyone who fails to do so does share some of the blame for the obvious outcome where the bad people harm them. But they share less than half of the blame, because if the bad people didn't exist then obviously no harm would happen at all and the precautions wouldn't be necessary. There is a finite amount of blame to distribute, and the majority always belongs with the bad people who actually do bad things.
Yes. The sysadmin. IT security with minimal exceptions[1] always had serious component of victim blaming in the 90s.
The difference with the rest of your scenarios is that in IT there was never trust which could be betrayed. Everyone knew from the beginning that everyone is out to get you. There was never presumption of safety on the internet.
So a better analogy is who is to blame when a soldier dies on the battlefield - the enemy shooter or the soldier that didn't take cover?
[1] Technically illiterate activists in the third world and the likes.
You're missing the point. Low trust societies are worse than high trust societies, because even when you take all of the appropriate security measures, those measures inherently come with costs and friction that wouldn't be necessary if there weren't untrustworthy people around. The actual perpetrators are the people directly inflicting all of the costs, both the damages when they get away with something and the security costs when people move to stop them. The naive people are indirectly responsible for the costs caused by insufficient security measures. If they weren't naive OR if there weren't scumbags around, they wouldn't get sabotaged so drastically, but no matter how cynical they are there's nothing they can do to prevent the security costs and friction forced upon them by the scumbags. There's a clear asymmetry here.
I wonder if the issue is just treating criminals as sub-human or something, the fargroup, and thus absolving them of responsibility because you're not even being thinking of them as rational agents in the interaction. They're not just some environment, like wandering into the woods and getting mauled by a bear. They're people and thus deserve blame when they inflict harm.
I think you are missing my point. To commit crime you have to have law, the DNA of the internet was always lawlessness and anarchy. It started as a warzone. The fact that meatspace has claimed control and thinks its rules apply - doesn't change the nature of the place. Hackers are not criminals - internet was created to be unrulable - well it was created to be undisruptable, but the two kinda go together. So the burden is on the defender, by default. In the real world you have the whole monopoly of violence thing that says rape is not ok. Internet was designed so that monopoly of violence is impossible. Well the governments figured this one clever trick that if they can put chokepoints and match your digital to physical identity they could break your kneecaps. But still.
More options
Context Copy link
However, the converse also applies: the most cynical (who demand others pay more for security) impose costs when they want too much security.
This is how progressives can [correctly] accuse everyone else of imposing too many costs on the community by impeding the immigration they want, and how everyone else [correctly] can accuse progressives of imposing too many costs through failing to ensure immigrants behave themselves.
There's a meme in software about "move fast and break things". Same thing- you can either have more software faster and cheaper but having more security issues [which create cost indirectly], or you can have no software and have systems that are extremely expensive [which create cost directly].
Either one fundamentally creates a cost, but it's asymmetrically enforced, as humankind hasn't figured out how to measure much less begin to force the people who argue conservatism in a particular area to pay the opportunity cost that creates beyond "move to a land of plenty such that conservatism doesn't work".
Sure there is- you organize meanness to degrade their capabilities. Typically this requires grouping people by class- sex, race, age, nationality [Irish need not apply], social standing, g, whatever- and forcing them to pay for "being scumbags".
And the ways you might force them to pay are many- you can levy fines, imprison them (which is more a fine on their time), disenfranchise them, physically injure them, and deploy various means of scumbag-icide (from assassinations of key figures to whatever prefix for -cide you wish).
On the other hand, of course, "being scumbag" is sometimes not something one can avoid. Perhaps one is born stupid, or with some trait that make their existence untenable (including relative statuses, since human beings work that way), so either they themselves, or those with whom they can co-ordinate, will seek to take away what you have because there's no particularly attractive alternative.
The thing that complicates this analysis is the fact that "people that just want to watch the world burn" (as in this case) are always a net positive to kill, but it's not possible to ensure the social machinery that kills those people is never turned in their direction.
More options
Context Copy link
Agree this is how people in Johannesburg end up living their lives shuttling in between walled security compounds and still get robbed.
More options
Context Copy link
I think you're on to something. A whole bunch of the thoughts I've been thinking about posts from the last couple weeks about the ongoing Lindsey Clancy drama, AI doomerism, European Diplomats, the Cornel 7, and Spiderman: Brand New Day, all seem to be converging on a similar conclusion and I really want to explore in an effort post but it's already late and I really ought to call it a night.
More options
Context Copy link
More options
Context Copy link
I don't fully buy this. Telecoms were originally bult completely unsecured until phreakers ruined it. And even up until 2024 or so people could put whatever number they wanted on the caller id. Email was largely the same, totally unsecured, until the spam waves forced the mass lockdown.
There was the presumption of safety on the internet when it was a place only accessible to elites and nerds. And maybe now that's over, especially with the shitholes of the world getting hooked up. Indian cubercriminals act with absolute impunity, and nobody does a thing about it.
I'm not sure if we can ever get the trust back, but drone striking a few fraud factories would be a great start
On the other hand, the first ever spam campaign happened in the 70's on ARPANET
Was that e-mail spam in roughly the modern sense? The word "spam" was originally used to describe off-topic posts repeatedly posted to Usenet, and only later became a term for unsolicited bulk e-mail. (In both cases, the junk was mostly but not entirely commercial ads, initially for legitimate businesses like immigration law firms but over time only for scams as spam became illegitimate)
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
Feels like every major tech news should have the accompanying HackerNews thread just for more industry context or related info.
HN threads: https://news.ycombinator.com/item?id=50055304 and https://news.ycombinator.com/item?id=50058569
This is an interesting connection for essentially the same hack in the past: https://signalandsilence.substack.com/p/i-think-someone-hacked-the-commissary
More options
Context Copy link
Having worked as a refrigeration tech before, I may have some insight- this was almost certainly done for management and monitoring. Defrost cycles are very important to keep freezers from bricking themselves, and danfoss controllers are very common as an alternative to a mechanical time clock- because they’re fully programmable to the conditions of the specific box.
Why they were connected to the internet is probably because corporate wanted to be able to mess with it without sending someone in person. The stated reason was probably so they could set passwords but in reality it was to make in house maintenance personnel’s lives easier.
There's a lot of value in things like alerts, too. Being able to send someone an text message or even call someone when a glycol loop herps the derp can be a 10k-100k dollar value proposition, and pulling good logging data about current draw can give you warning months before actual death about a failing motor or compressor.
That said, the idea of inbound open ports for management is mind-boggling, even for hardware in the 2000s era. Even before you get to the security ramifications, it's just an absolute nightmare trying to get fifty sites to stick with static IP addresses, inform you when changing ISPs or modifying firewall configurations, or your DDNS provider changes literally anything. I know OT has worse practices than IT, but this one is pretty mind-boggling.
Forget setting up VPNs. Buy and configure a single main operational server, have the hardware send regular updates there, move all the heavy lifting and the UI somewhere you can control if and limit firmware updates to message protocols, certificates, and fundamentals. Allow big customers to buy, run, and redirect to their own server if they really need to own everything. Done. Two or three months work for an intern. I hate Everything Is The Cloud, but this is a tailormade situation for just putting things on the cloud.
They had inbound open ports to allow their maintenance managers to change settings store managers were messing with, probably. But why they didn’t take security precautions to prevent that I don’t know. Probably because they’re career hvac techs and it doesn’t occur to them that someone would want a freezer to stop working.
What were the hackers after? Ransom ware?
Seems like pure destruction to me, most likely from a nation state (who else would have motive, means, and opportunity?). Maybe it's retaliation for that Russian bot farm that got blown up?
Destruction and/or criminality. Next time someone in corporate HQ gets an email about "set up a crypto account to pay us $$$$ or else we shut your stores down", they'll know this isn't a spam email or pointless threat.
More options
Context Copy link
A practice run for the Chinese hackers who've already infiltrated much of American infrastructure.
MO seems more Russian than Chinese, Iranian is also technically possible. But I agree that hostile nation-state is the most likely motive.
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
It's still weird that the guy building the web interface would do it, even if he was a career HVAC tech that had gotten pushed into software dev. But it's plausible.
That's a fun thought. Ransomware naively feels a little weird for me. Telling the people they need to pay you gives them a window to replace the controllers (or just turn off internet access and hope you didn't leave a time bomb). But I may be missing an attack vector there, or they might have been working toward the timebomb and just noticed enough devices they got interrupted.
There's some more esoteric options, though. Hitting food supplies is famously one a target for causing political unrest. Just shorting a few of the supermarkets would potentially be a very remunerative option, though it'd be a hilarious way for the hackers to get caught (or lose money). Burning Danfoss itself might be a thing, especially for the more ideological actors -- even if the threat genuinely doesn't exist for their newer products (not a given), there's no way its buyers avoid a security audit, and no way Danfoss avoids a ton of support costs downstream of that, on top of lost goodwill. Political or nationalist drives are always an option, if a goofy one. "Hey, Look At Me" or a personal grudge turned public is just plain dumb, but if any attack could be executed by a script kiddy, this one could.
Not sure some other options.
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
Seems to me that the smarter way to do this would be to have a site-to-site VPN between your corporate office and the store's internal network. Then the freezers remain on the "internal" corporate network and aren't exposed to the internet.
This may be shocking to professional software engineers, but most companies do not put systems on a VPN prior to those systems being hacked.
I guess a lot depends on when the system was put together, but as a professional I.T. guy, oof. Of course you put them on the VPN! That's been the sane choice for at least twenty years. If you absolutely, positively can't for some reason, then you at least whitelist the control server at the firewall level and block other traffic to the device.
Now if they were small enough not to have an I.T. department, I'd understand. But more likely I.T. was overruled.
It was probably put together by career HVAC techs who told them to set up communication via a web portal so they could initiate defrosts* on their cellphones, and then set the passwords to their lastnames.
*For those in the back who don't know, commercial freezers are supposed to have an electronic defrost that clears ice off the evaporator so it doesn't inhibit airflow. This attack worked by reprogramming that defrost to never end.
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
Yes but that does require more infrastructure. It's also very possible that the units connect to a manufacturer cloud controller on the Internet only on outbound connections, which is typically reasonably secure so long as you use SSL pinning etc, or even on an IPSEC tunnel, but that the cloud controller was itself compromised in some way.
The manual for one of the affected models is available online, see page 11. The idea of a web host running on the hardware controller is... not the worst thing I've ever done, but :
Definitely worse. I was building web-accessible hardware in 2013. This was, to be fair, a couple years pre-Let's Encrypt, and SSL wouldn't have solved this specific problem.
But I still knew better than that.
Early descriptions of the attack have claimed that there was a master password for the device exposed on the same interface (unclear if it's the HTTP or XML), which allowed the control commands through in bulk.
All of these manuals are online for technicians to read.
More options
Context Copy link
Oh my, that is indeed dire.
More options
Context Copy link
Geez, page 60 has a default admin password of 12345... There's a decent chance they just used that and then clicked the defrost button. It's fortunate that the attackers appear to have been unsophisticated, apparently you can also remotely upload new firmware and they don't describe any verification or signature validation.
Or maybe half a step more sophisticated they got VPN creds for the grocery store from a data breach or something, I doubt they were just sitting accessible on the internet. That's the sort of thing Shodan would have flagged years ago.
And right next to the default password:
More options
Context Copy link
Yes, all of that stuff is absolutely industry standard- because most of these freezers are worked on by contractors with an end user who don’t know nothing about nothing and they need a default admin password.
Their main competitor is even worse.
The default admin password would be common in normal IT world until 2020: it took a combination of California law (2018's SB-327) and NIST's mandate, along with some questionably-authorized-by-statute contracting pressures, that really made it universal for routers. I'll still see it (or password) on internal-only equipment, including some still-being-sold-as-new Unifi devices.
It's not even necessarily wrong in an environment where you'd expect some intrusion detection, or where the device requires a change on first login. It's just bizarre to do it, and then recommend people forward a WAN directly. This particular attack seems to have depending on another, different 'master' password, so I guess it doesn't even matter, but that's another thing that on its own points to 'reasonable if you're not that concerned about horizontal movement' (common in 2013) and really bad if you have any reason to worry about being the first hop in an infection.
Like, I'd hope they have fail2ban or equivalent set up? But I wouldn't be optimistic.
The competitor being worse makes me really concerned.
You are aware these are freezers, right? Like they're important but they're not holding onto private data or whatever.
Emerson writes the password on the device for technicians to have access to, and Ke2therm uses all fives(no, it can't be changed).
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
This system was not designed by IT professionals.
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
I can see there being utility for your freezers being on the network - maybe if one of them has a mechanical problem or other fault, having it on the network and reporting to a dashboard somewhere can raise an alarm to get that taken care of.
I would definitely agree that having any of your infrastructure on a network that is accessible from outside of your organization is fucking retarded.
More options
Context Copy link
We had a similar incident of a firmware update bricking Samsung refrigerators. Just a continuation of the trend of "you own nothing" and you need to rent everything and pay service contracts to the vendor. We got hp printers where you don't own the ink cartridge in your hand, but just a subscription contract to allow you to print a certain number of pages. We got subscriptions for heated seats and enabling the maxiumum power of the car.
Doesn't help that these legacy companies have notoriously incompetent software engineering and nonexistent concern for security. Things were real bad well before vibe coding and they'll only get worse.
I watched the Cyberpunk Netfix show and it had a bit about needing to pay a subscription to use your own washing machine. As shown by it locking up on a child when full of his wet school clothes. And the resulting cost of living ends up high enough that a regular non-corpo working mom can barely afford to live. They don't explicitly say the prices were algorithmially determined to be exactly what you can bear, but I'll assume something like that is happening in the setting. That's quite a cynical "late stage capitalism" take; as appropriate for cyberpunk.
But back in real life they are actually pushing to make something like that sci-fi dystopia real. We're just missing the cool cyber mods and true AI. We get to keep the appliances that lock up and the most banal firms of electronic surveillance.
More options
Context Copy link
Companies that pull this sort of Stierscheiße ought to be charged a 99.5% tax rate on subscription revenues, and have to write the government a thank-you note for the C-suites not spending the rest of their lives at donkey-work in inhospitable climates.
More options
Context Copy link
The issue probably is the cloud accounts, not that they had real ip addresses. Even my mild contempt towards french IT prowess doesn't assume a world in which they will leave them out in the open or allow them NAT traversal. Having the right to install your own server to manage your own devices should be basic ownership. But this is often impossible. Which is really infuriating with the security cameras that needs cloud account in china. Yaay.
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link