So they saw the first freezer attacks and said 'nah' to doing anything to secure them
this post was submitted on 02 Nov 2026
99 points (99.0% liked)
Technology
89409 readers
4179 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
Freezers as a service is apparently a common way for supermarkets to buy freezers.
Basically the company selling them gives them support if they can remotely access the freezers. Now usually there is not much todo since the company selling the freezers handles everything.
However once the freezer is "out of support" they won't update it anymore and it is still reachable from the internet even if the company doesn't access it anymore.
Now usually a supermarket has no IT department that locks that shit behind a vpn and/or firewall.
So there are many freezers out there available in the open Internet with no security patches available.
Until the freezer stops freezing probably nobody is paid enough to care.
Maybe they should just disconnect them from the internet. But I guess that's too much to ask.
And on episode 48,942 of "Don't Put Things on the Internet for No Reason":
which once again begs the question. why the fuck is your freezer connected to the internet
Supermarkets allow their freezers to connect to the internet so that maintenance and monitoring can occur remotely.
Yeah. And VPN connections exist so maintenance and monitoring can take place without direct exposure. But alas...
Yeah but that’s expensive to set up and C-Suites need more bonuses so
I know you're being sarcastic. But for anyone coming here with a damaged irony sensor: no. Setting up a VPN comes at zero software costs (it's all open source software, unless you're keen on getting ripped off by some proprietary product) and a reasonably low cost in man hours for setting it up (we're talking single-digit to low double-digit hours here).
Expensive? I bet it's less expensive than losing all your frozen inventory.
That requires forethought though, you're giving c-suites too much credit.
Setup expenses look bad on the quarterly report. Losses later, if they happen at all (who knows if the engineers are so into their tools they forget the real world and I, the genius CEO, need to bring them back to reality), are problem for later.
Yeah, but you would think they would have gotten them off the Internet after the first time this happened, even if it means having to hire an extra person to keep an eye on them.
Nit: it doesn't beg the question (a logical fallacy also known as tautology), it raises it.
But yeah, is it really that helpful to network something you only want to set one time?
Actually, "beg the question" is a linguistic fossil from a time when "beg" didn't mean quite the same thing it does today.
You want to monitor and perhaps automatically fix temp fluctuations? Maybe these things are smart enough to report parts about to fail? 🤷🏼♂️ But in any case it would be child's play to make these things bulletproof.
One example: Set the local firewall to block all WAN traffic, all ports, to the freezer group (VLAN) except where the origin packet is the monitoring IP. I suck at networking and could work this out in an afternoon. Give me a week and I'll have a deployment script for all the local firewalls, tested and ready to push the button. And again, I suck.
You don't need an Internet connection to have a control system keep temperature around a setpoint, though. That's usually handled by a lower level circuit that will continue to operate in the case that the high level interface is not responding.
Observability is nice, but you don't need to expose controls to do this, you could just have a Prometheus endpoint.
I suspect it's because the manufacturer is trying to sell RaaS (refrigeration as a service) and to ensure they get their monthly dues, they "offer remote maintenance and monitoring" or something.
I suspect your suspicion is accurate. Scanning with BLE or a flipper shows the coolers at my local grocery also. It's like the cars, they won't secure it until someone makes it and even then they'll secure it against their customers freedom, not hackers.
Really, this is worth just 5 minutes of research. This is not like the stupid Samsung fridge you keep in your home. In commercial settings you may have hundreds of refrigeration units to track and manage in order to keep food safe. And it’s quite plainly very efficient to do this with remote management software, and yes this can be deployed locally with a local server to manage everything but it can also be done over the internet to cloud services and that can be much more feasible for someone who is trying to run a grocery and isn’t a network engineer or experienced server administrator.
I know someone will just say come on, it’s not that hard. To which I say fine, but the question here was why would anyone ever do this. There is actually an answer.
Exactly! It should have a single non-internet connected computer per supermarket controlling the temps.
once again begs the question
Nope. Just raises it.
Why the hell freezers able to heat up to 50°C and connected to internet?
Regarding the heat up thing, usually the devices sold are dual purpose and can be used to keep things warm (Since they're just a insulated container with a temperature coil), but the connected to the internet part is just stupidity.
50c isn't really a safe temperature for food, but I guess some places do it.
The Swedish media reported it as "de-icing mode". If you have a large freezer in a store, you can't defrost it quickly enough with passive airing, especially with the top-loading freezers.
Nothing wrong with connecting to the internet for centralized monitoring and control! But the lack of simple network security was absurd, especially after this happened once already.
My last job had all AWS resources firewalled off for every source but our inhouse VPN's IP and the home IPs of the DevOps team. You couldn't hit those resources from inside the office without the VPN. Easy money. Setup a similar deal at my previous job. Yeah, RDP was open, but only from my home IP. That port might as well not exist from the outside.
The coils need to defrost, so they are able to heat up to do so. Typically this happens for a very short period of time. Bit if the defrost cycle stays on for an extended period of time then the whole thing heats up.
And on episode 48,942 of "Don't Put Things on the Internet for No Reason":
And on episode 48,942 of "Don't Put Things on the Internet for No Reason":
And on episode 48,942 of "Don't Put Things on the Internet for No Reason":
This is the oldest of four duplicate comments.
It's almost as if the longer we don't riot and push the corrupt officials off a cliff, consequences for their actions always seems to fall onto us. Huh... weird...