Delphiza

Those were toasters, not fridges :)

Similar to the 'S' in VPN

The reason is because the optimisation and automation means that there are no staff in the stores qualified to 'turn the knob' (and it is more complicated than that). What is the store to do, employ full-time knob-turners? They won't even pay for the uniforms of shelf packers or give them two toilet breaks on a shift.

Supermarket freezers are a bit more complicated than that. They can run at different temperatures and can consume a lot of power, so are part of a bigger store HVAC and electrical system as they may load-balance. Stores do not have qualified engineers on site to do anything with refrigeration equipment and it is better to have minimum wage offsite monitoring than expect a minimum wage shelf packer who only gets one toilet break a day to care about the fridges.

The one good reason is that there is nobody skilled left in the office of the supermarket. The days of people with the skills to hit a supermarket HVAC system with a hammer are long gone. When the fridges are on the fritz, the minimum-wage shelf packer goes and packs shelves as far away from the fridge as possible.

Wait until the market matures enough for underpaid or disgruntled employees being able to sell data easily.

That is a shocking read! check_code_of_day WTAF! How did Danfoss not go around to all customers and hand-install a patch for this.

While the app is beeping at them to pack more shelves, and they have already used up their only toilet break of the day to trying to stop the resourcing AI chatbot from putting them on triple shifts for the rest of the week.

The trained and retained supermarket employees are gone. The refrigeration service engineer has been replaced by an AI chatbot. We can't scale to qualified people running complex systems on remote air-gapped networks.

Yes, that is likely. Although Danfoss seems to have their own controllers, I think that you are right, that the attack was not an 'Internet connected fridge', but an HVAC or FMS (Facilities Management System) that was connected to the fridges.

Look for "Danfoss AK-SM 720 user manual" and scroll through the pdf.

You'll find that these are quite complex control systems and their data may not be integrated into an operational or security control centre. So if they are not configured for, or resourced (in terms of operators), to handle anomalies, how do they notice and respond?

Without knowing anything about the attack it may be that the controllers were not connected directly to the public Internet, but an on-site VPN that became compromised some other way. Or with a compromised laptop of a technician that connected.

So while you are thinking about fridges today, think about how you would secure and operate control systems across tens of thousands of stores. Would that be easier without Internet connectivity? How do you get qualified and experienced technicians into each (air gapped) store? Another complexity is that many of these systems are part of facilities management systems (HVAC, lighting, security, fire control) and managed or owned by a completely different organisation that is not going to share their data.

IoT platforms provided all the required functionality. Device provisioning (it is not easy to do identity on 'things'). MQTT for service-assisted communication where devices don't need to accept incoming connections. Over-the-air software updates. Over-the-air kernel security updates.

The 'fridge company' and other product manufacturers decided to skip all that and run everything on a raspberry pi with apache, or an ESP32 soldered onto the control board, and call it finished. There are millions of these devices out there.