Hackers thaw the freezers: today the fridges, tomorrow what?

Today I talk about cybersecurity and home automation, two things that intersect and that both need to be handled well.

Freezers from -18 to +50 degrees

You’ve probably heard it on the news: hackers got into the private networks of supermarkets in Italy and across half of Europe, reached the system that controls the temperature of freezers and fridges, and pushed it from -18 to +50 degrees. Everything melted, all the frozen food thrown away.

I said so

I talked about it a few days ago, when it happened in France. Close the network, update the firmware, and if a device can’t be updated or secured, turn off its remote features or replace it.

It didn’t help. In my opinion that’s how humans learn: only once they bang their head hard against a wall.

Carelessness in companies

The security consultants at these companies surely said something to their managers, and someone must have pushed the information up. And I already know the typical answers: “it hasn’t happened to us, let’s wait”. Or, worse, the information never got there. Or, even worse, whoever was in charge of security hadn’t realized what was going on.

I’ve lived similar stories on various platforms and at various companies: a great, great carelessness.

Budget: where to stop

Mind you, I’m not saying you should spend endlessly. It’s one thing to say “I know the problem, I’m preparing and I’ll get this far, because I can’t do more”. Sun Tzu’s Art of War already makes it clear that you need to reach a level of defense you can afford.

A practical example: if protecting the fridges costs as much as losing all the frozen food, you might as well not do it. It’s a sensible way to think about a security budget.

In Italy we’re getting lucky

The problem is that, talking with colleagues and former colleagues, in many Italian environments, even very critical ones, the culture of cybersecurity tied to physical security is almost absent or totally insufficient. As I wrote on LinkedIn quoting a colleague: so far we’ve been lucky. But we can’t rely on that.

AI in the attackers’ hands

Today there are automated tools that, in the wrong hands, are very powerful. Even a hacker with few resources can do a lot with AI models. Not so much cloud ones like Claude or ChatGPT, which have guardrails and refuse, but “unlocked” models that run locally and have no qualms.

Although, side note, about a year ago an attack carried out with Claude itself was documented, split into lots of small subtasks so it wouldn’t look like an attack. It reminds me of the film Cube: many people each make a harmless little piece, but put together they become a weapon.

Fuel, trains, power grids

Fridges are a small example. Small in a manner of speaking, since thrown-away food is still serious damage. But imagine if it happened to fuel pumps, and not that they stop working, but that fuel starts pouring out. I hope there are plenty of mechanical safeguards preventing it, but I know of things that don’t let me sleep easy. And then airports, trains, power grids.

We depend enormously on computer systems. Would their security hold up against these new tools? I don’t know. Let’s think about it, work on it and get ready.

I feel a bit of fear, a bit of discontent, a bit of astonishment. If you work in these fields and want to tell me about your experience, even anonymously, write to me privately or in the comments on the video (it’s in Italian).