This weekly roundup thread is intended for all culture war posts. 'Culture war' is vaguely defined, but it basically means controversial issues that fall along set tribal lines. Arguments over culture war issues generate a lot of heat and little light, and few deeply entrenched people ever change their minds. This thread is for voicing opinions and analyzing the state of the discussion while trying to optimize for light over heat.
Optimistically, we think that engaging with people you disagree with is worth your time, and so is being nice! Pessimistically, there are many dynamics that can lead discussions on Culture War topics to become unproductive. There's a human tendency to divide along tribal lines, praising your ingroup and vilifying your outgroup - and if you think you find it easy to criticize your ingroup, then it may be that your outgroup is not who you think it is. Extremists with opposing positions can feed off each other, highlighting each other's worst points to justify their own angry rhetoric, which becomes in turn a new example of bad behavior for the other side to highlight.
We would like to avoid these negative dynamics. Accordingly, we ask that you do not use this thread for waging the Culture War. Examples of waging the Culture War:
-
Shaming.
-
Attempting to 'build consensus' or enforce ideological conformity.
-
Making sweeping generalizations to vilify a group you dislike.
-
Recruiting for a cause.
-
Posting links that could be summarized as 'Boo outgroup!' Basically, if your content is 'Can you believe what Those People did this week?' then you should either refrain from posting, or do some very patient work to contextualize and/or steel-man the relevant viewpoint.
In general, you should argue to understand, not to win. This thread is not territory to be claimed by one group or another; indeed, the aim is to have many different viewpoints represented here. Thus, we also ask that you follow some guidelines:
-
Speak plainly. Avoid sarcasm and mockery. When disagreeing with someone, state your objections explicitly.
-
Be as precise and charitable as you can. Don't paraphrase unflatteringly.
-
Don't imply that someone said something they did not say, even if you think it follows from what they said.
-
Write like everyone is reading and you want them to be included in the discussion.
On an ad hoc basis, the mods will try to compile a list of the best posts/comments from the previous week, posted in Quality Contribution threads and archived at /r/TheThread. You may nominate a comment for this list by clicking on 'report' at the bottom of the post and typing 'Actually a quality contribution' as the report reason.
Jump in the discussion.
No email address required.
Notes -
https://uk.finance.yahoo.com/news/french-supermarket-chains-cyberattack-forced-115141288.html
This is a poetry of stupid and the hackers are the least guilty party here. Lets start with the obvious. Why freezers needs to be visible, why do they need to be remotely managed, why is not this done on dedicated internal network, why do they need firmware updates. How did we get to the point where a device that should be pid controller, compressor and alarm can be hacked.
To make you feel better - all of your nice EVs are also permanently connected and I doubt that there is air gap between the infotainment and the firmware of the battery pack. Someday someone will be able to accelerate or set on fire EV remotely. And probably soon.
Having worked as a refrigeration tech before, I may have some insight- this was almost certainly done for management and monitoring. Defrost cycles are very important to keep freezers from bricking themselves, and danfoss controllers are very common as an alternative to a mechanical time clock- because they’re fully programmable to the conditions of the specific box.
Why they were connected to the internet is probably because corporate wanted to be able to mess with it without sending someone in person. The stated reason was probably so they could set passwords but in reality it was to make in house maintenance personnel’s lives easier.
There's a lot of value in things like alerts, too. Being able to send someone an text message or even call someone when a glycol loop herps the derp can be a 10k-100k dollar value proposition, and pulling good logging data about current draw can give you warning months before actual death about a failing motor or compressor.
That said, the idea of inbound open ports for management is mind-boggling, even for hardware in the 2000s era. Even before you get to the security ramifications, it's just an absolute nightmare trying to get fifty sites to stick with static IP addresses, inform you when changing ISPs or modifying firewall configurations, or your DDNS provider changes literally anything. I know OT has worse practices than IT, but this one is pretty mind-boggling.
Forget setting up VPNs. Buy and configure a single main operational server, have the hardware send regular updates there, move all the heavy lifting and the UI somewhere you can control if and limit firmware updates to message protocols, certificates, and fundamentals. Allow big customers to buy, run, and redirect to their own server if they really need to own everything. Done. Two or three months work for an intern. I hate Everything Is The Cloud, but this is a tailormade situation for just putting things on the cloud.
They had inbound open ports to allow their maintenance managers to change settings store managers were messing with, probably. But why they didn’t take security precautions to prevent that I don’t know. Probably because they’re career hvac techs and it doesn’t occur to them that someone would want a freezer to stop working.
What were the hackers after? Ransom ware?
Seems like pure destruction to me, most likely from a nation state (who else would have motive, means, and opportunity?). Maybe it's retaliation for that Russian bot farm that got blown up?
Destruction and/or criminality. Next time someone in corporate HQ gets an email about "set up a crypto account to pay us $$$$ or else we shut your stores down", they'll know this isn't a spam email or pointless threat.
More options
Context Copy link
A practice run for the Chinese hackers who've already infiltrated much of American infrastructure.
MO seems more Russian than Chinese, Iranian is also technically possible. But I agree that hostile nation-state is the most likely motive.
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
It's still weird that the guy building the web interface would do it, even if he was a career HVAC tech that had gotten pushed into software dev. But it's plausible.
That's a fun thought. Ransomware naively feels a little weird for me. Telling the people they need to pay you gives them a window to replace the controllers (or just turn off internet access and hope you didn't leave a time bomb). But I may be missing an attack vector there, or they might have been working toward the timebomb and just noticed enough devices they got interrupted.
There's some more esoteric options, though. Hitting food supplies is famously one a target for causing political unrest. Just shorting a few of the supermarkets would potentially be a very remunerative option, though it'd be a hilarious way for the hackers to get caught (or lose money). Burning Danfoss itself might be a thing, especially for the more ideological actors -- even if the threat genuinely doesn't exist for their newer products (not a given), there's no way its buyers avoid a security audit, and no way Danfoss avoids a ton of support costs downstream of that, on top of lost goodwill. Political or nationalist drives are always an option, if a goofy one. "Hey, Look At Me" or a personal grudge turned public is just plain dumb, but if any attack could be executed by a script kiddy, this one could.
Not sure some other options.
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link