This weekly roundup thread is intended for all culture war posts. 'Culture war' is vaguely defined, but it basically means controversial issues that fall along set tribal lines. Arguments over culture war issues generate a lot of heat and little light, and few deeply entrenched people ever change their minds. This thread is for voicing opinions and analyzing the state of the discussion while trying to optimize for light over heat.
Optimistically, we think that engaging with people you disagree with is worth your time, and so is being nice! Pessimistically, there are many dynamics that can lead discussions on Culture War topics to become unproductive. There's a human tendency to divide along tribal lines, praising your ingroup and vilifying your outgroup - and if you think you find it easy to criticize your ingroup, then it may be that your outgroup is not who you think it is. Extremists with opposing positions can feed off each other, highlighting each other's worst points to justify their own angry rhetoric, which becomes in turn a new example of bad behavior for the other side to highlight.
We would like to avoid these negative dynamics. Accordingly, we ask that you do not use this thread for waging the Culture War. Examples of waging the Culture War:
-
Shaming.
-
Attempting to 'build consensus' or enforce ideological conformity.
-
Making sweeping generalizations to vilify a group you dislike.
-
Recruiting for a cause.
-
Posting links that could be summarized as 'Boo outgroup!' Basically, if your content is 'Can you believe what Those People did this week?' then you should either refrain from posting, or do some very patient work to contextualize and/or steel-man the relevant viewpoint.
In general, you should argue to understand, not to win. This thread is not territory to be claimed by one group or another; indeed, the aim is to have many different viewpoints represented here. Thus, we also ask that you follow some guidelines:
-
Speak plainly. Avoid sarcasm and mockery. When disagreeing with someone, state your objections explicitly.
-
Be as precise and charitable as you can. Don't paraphrase unflatteringly.
-
Don't imply that someone said something they did not say, even if you think it follows from what they said.
-
Write like everyone is reading and you want them to be included in the discussion.
On an ad hoc basis, the mods will try to compile a list of the best posts/comments from the previous week, posted in Quality Contribution threads and archived at /r/TheThread. You may nominate a comment for this list by clicking on 'report' at the bottom of the post and typing 'Actually a quality contribution' as the report reason.
Jump in the discussion.
No email address required.
Notes -
Yes but that does require more infrastructure. It's also very possible that the units connect to a manufacturer cloud controller on the Internet only on outbound connections, which is typically reasonably secure so long as you use SSL pinning etc, or even on an IPSEC tunnel, but that the cloud controller was itself compromised in some way.
The manual for one of the affected models is available online, see page 11. The idea of a web host running on the hardware controller is... not the worst thing I've ever done, but :
Definitely worse. I was building web-accessible hardware in 2013. This was, to be fair, a couple years pre-Let's Encrypt, and SSL wouldn't have solved this specific problem.
But I still knew better than that.
Early descriptions of the attack have claimed that there was a master password for the device exposed on the same interface (unclear if it's the HTTP or XML), which allowed the control commands through in bulk.
Geez, page 60 has a default admin password of 12345... There's a decent chance they just used that and then clicked the defrost button. It's fortunate that the attackers appear to have been unsophisticated, apparently you can also remotely upload new firmware and they don't describe any verification or signature validation.
Or maybe half a step more sophisticated they got VPN creds for the grocery store from a data breach or something, I doubt they were just sitting accessible on the internet. That's the sort of thing Shodan would have flagged years ago.
Yes, all of that stuff is absolutely industry standard- because most of these freezers are worked on by contractors with an end user who don’t know nothing about nothing and they need a default admin password.
Their main competitor is even worse.
The default admin password would be common in normal IT world until 2020: it took a combination of California law (2018's SB-327) and NIST's mandate, along with some questionably-authorized-by-statute contracting pressures, that really made it universal for routers. I'll still see it (or password) on internal-only equipment, including some still-being-sold-as-new Unifi devices.
It's not even necessarily wrong in an environment where you'd expect some intrusion detection, or where the device requires a change on first login. It's just bizarre to do it, and then recommend people forward a WAN directly. This particular attack seems to have depending on another, different 'master' password, so I guess it doesn't even matter, but that's another thing that on its own points to 'reasonable if you're not that concerned about horizontal movement' (common in 2013) and really bad if you have any reason to worry about being the first hop in an infection.
Like, I'd hope they have fail2ban or equivalent set up? But I wouldn't be optimistic.
The competitor being worse makes me really concerned.
You are aware these are freezers, right? Like they're important but they're not holding onto private data or whatever.
Emerson writes the password on the device for technicians to have access to, and Ke2therm uses all fives(no, it can't be changed).
The IT-world argument is that once you compromise any system on a subnet, you can at least listen to everything else on the subnet, and often attack everything else, too. While it's not entirely true in a modern world, it's pretty close. Conficker is the historical example of a wakeup call here. I get that HVAC techs don't really think that way (and, hell, some IT people don't, a la the 'air-gapped' networks that are really just bad firewall configs), though.
The HVAC argument is that a freezer failure is easily five digit cost of damage, even in the optimistic case where the food is just unsaleable rather than inedible, I can't imagine an expert working that job hasn't seen it. The defrost attack here might not be foreseeable for the average HVAC tech, who might reasonably expect it to 'just have a max timer', but in turn I don't think it's the only or even worst option. I don't have a good model of industrial freezers, but from what happens to consumer air conditioners or freezers when they're stuck short-cycling, I'm guessing that would be Bad, and the sort of failure that requires long technician hours and longer lead times on parts.
The former's actually pretty reasonable, at least if it isn't something stupid like 'password', and NIST recommends it for a lot of devices initial configuration. The latter, I'd like to just have a talk. Holy shit. That's literally worse than the 'some idiot has on his luggage' option.
A stuck in defrost wouldn't necessarily cause short cycling(although depending on the control setup there might be some). It would just keep the freezer off. They could replace the controllers with mechanical versions pretty quickly if they can get skilled labor onsite in time, but they wouldn't expect to have a controller programmed to stay in defrost indefinitely- no one would do that on purpose.
Well, about that...
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link