Hacker attacks on European supermarket refrigerators have also reached Sicily. Cybersecurity expert Marco Schiaffino explains how they work, who could be behind it, such as activist groups, and what risks companies and home devices run.
The hacker attacks on supermarket refrigerators which have affected several countries in Europe have also arrived in Italy. After the cases registered in France and, more recently, in Belgium, Sweden, Luxembourg and Estonia, on 2 November cyber attacks were also reported in Sicilywhere some Coop stores – at least four – between Palermo and Catania have suffered tampering with their refrigeration systems, resulting in increased temperatures and deterioration of food. The identity of the perpetrators and any connections with other European episodes are still being investigated by the Postal Police and France has not yet identified those responsible for the attacks of 11 and 12 October.
Meanwhile, theNational Cybersecurity Agency (ACN) called on food supply chain operators to adopt urgent measures to protect plants and remote access. But how do hackers take control of these devices? Who could be behind the attacks and what other sectors are at risk? We talked about it with Marco Schiaffino, journalist specialized in new technologies and cybersecurity, author and host of the Doppio Click program on Radio Popolare and of the podcast Welcome to the Cyber Jungle.
Attacks on European supermarket refrigerators appear to follow a similar pattern. Can we talk about a coordinated operation or are these separate episodes?
At the moment there is no evidence to support that the two waves of attacks are coordinated. What happened, from a technical point of view, is not particularly surprising. Industrial refrigeration systems use remote controls to manage maintenance: when IT vulnerabilities are identified, these are corrected and subsequently technical details are published online. At that point, however, cybercriminals may also know about the vulnerability and know how to exploit it.
If whoever manages the device does not update the software or adequately secure the connection, the system remains vulnerable. There are services that allow you to identify devices of a specific brand connected to the Internet: a criminal can search for them and try to attack them. We are therefore not necessarily talking about a particularly sophisticated cyber attack: medium-low skills are sufficient.
Who could be behind these attacks? Can we hypothesize a sabotage operation with geopolitical purposes?
The doubt is whether it is single individuals or of a group of activists. Traditional cybercriminals, in fact, generally act for economic reasons and often use extortion techniques: for example, they could ask a supermarket chain to pay a certain sum of money, otherwise threatening to block all refrigerators. In this case, however, nothing of the sort appears to have happened.
There are also precedents for so-called state-sponsored attacks state-sponsored attacks. For example, attacks against wastewater treatment plants in the United States have been attributed to Iranian groups, while Russia has conducted operations against Ukrainian energy infrastructure. However, these are attacks of a very different scope and complexity compared to those against supermarket refrigerators.
These episodes highlight a broader problem, that ofOperational Technology (OT)that is, technologies that control and manage industrial plants. Over the last twenty years, Internet connections have been introduced to remotely manage factories, energy plants and other infrastructure. The problem is that these plants are designed to last decades, while digital technology has much shorter life cycles: a hydroelectric power plant, for example, can be designed to operate for 60 or 70 years, while a computer system can become obsolete in a matter of a few years. There is therefore a risk of having systems that still use operating systems such as Windows XP or Windows 7, for which normal security updates are no longer available.
This creates enormous difficulties in ensuring the IT protection of infrastructures. The European Union is intervening with the Cyber Resilience Actwhich introduces security obligations for manufacturers of digital devices and systems. However, these provisions mainly concern new products: solving the problem of existing industrial systems will take much longer.
The National Cybersecurity Agency has released measures to protect the facilities. How effective can they be and how prepared is Italy?
In recent years, a lot of work has been done on this topic in Italy, also thanks to European regulations: an example is the directive NIS2which has changed the way we approach cybersecurity.
In the past we thought above all in terms of obligations: once certain measures were adopted, we believed we were safe. With NIS2, however, we switch to one logic based on risk assessment: protecting a small business is very different from protecting a large city’s water management system; it is therefore necessary to provide measures proportionate to the actual risks.
The indications from the ACN are certainly useful. In essence, they recommend not leaving services and control systems exposed on the Internet without adequate protection. The problem is understanding how many operators actually apply these measures. There is still one mentality of the type: “Why would anyone attack me?” Yet, in this second wave of attacks, not only large supermarket chains were hit, but also small food businesses and butchers.
Besides supermarkets, what other sectors might be particularly vulnerable?
It is necessary to distinguish traditional cybercrime attacks, which generally have economic motivations, from those with possible geopolitical purposes.
In the first case, one of the most exposed sectors is that manufacturing. If a criminal manages to block the production of a factory, he can use the blockade as a tool of extortion, demanding a ransom to restore the functioning of the plants.
From a geopolitical point of view, however, the infrastructures linked to it are particularly sensitive water and energy managementsuch as aqueducts, dams and power plants. Another strategic sector is that of telecommunications: Compromising a country’s communications can cause very serious consequences.
Added to these are cyber attacks aimed at stealing information, which however do not necessarily have direct consequences on the physical functioning of the systems.
But can these attacks also reach our homes, through connected devices such as air conditioners, thermostats or home automation systems?
In reality they have already arrived some time ago. The problem mainly concerns theInternet of Things (IoT)that is, the set of devices connected to the Internet. In the first phase of diffusion of these technologies, cybersecurity was often underestimated. Devices such as robot vacuum cleaners, thermostats or surveillance cameras were designed without sufficient attention to possible vulnerabilities.
A famous example is Miraia botnet that emerged in 2016 that used default credentials to take control of hundreds of thousands of connected devices, especially surveillance cameras. Once compromised, these devices could be used by criminals to conduct cyberattacks against other targets, for example overloading a site with requests until it becomes unattainable, or for hide the real IP address of the attackers.
It is not necessarily the case, therefore, that whoever takes control of a thermostat wants to change the temperature of the house: they could use it for completely different purposes, without the owner realizing it.
Newer devices have generally improved in terms of security, but it remains a problem related to user behavior. Often, for example, the default credentials from the manufacturer are not changed, and this can represent a significant risk.
Where, then, should the responsibility for IT security start? And what can we do to protect ourselves?
There are two fundamental aspects. The first is the so-called security by designthat is, the need to design systems and devices with cybersecurity in mind from the beginning, rather than intervening only after problems emerge. The second concerns the cybersecurity culture: one of the big problems with cybersecurity is that it is still considered a subject reserved for a few specialists. In reality this is not the case: if things are explained well, anyone can understand what the fundamental precautions are to protect themselvesincluding the “housewife from Voghera”.
Much more work should be done on this aspect, rendering IT security is a topic accessible and understandable to everyone.
