More than 800 UK supermarket fridges at heightened risk of hacking

Hackers commandeered the fridge and freezer systems at hundreds of French supermarkets

The “front doors” to the control systems of more than 800 UK retailer fridges are “reachable by anyone on the internet who knows where to look”, analysis by UK Cyber Defence shared with The Grocer has found.

It means the web login page to those fridges’ built in computers – known as controllers – which are used by engineers to check temperatures and tweak settings, can be readily found by hackers, rather than being hidden and reachable only via a private, protected connection.

The finding comes after hackers commandeered the fridge and freezer systems at hundreds of French supermarkets – including Carrefour , Intermarché, Netto, Coopérative U and Monoprix, according to AFP and Reuters reports – overnight on Sunday, remotely raising their temperature. This led to spoilt food and in some cases fires.

It is understood the hackers were able to raise their temperature to as high as 50ºC, by forcing the internet-connected fridges into a continuous defrost cycle.

The attacks targeted fridge units manufactured by Danish company Danfoss, and a security flaw in the controllers of some of its models, for which it has issued software updates – known as patches.

Present in thousands of stores in France, Danfoss units are less widespread in UK grocery. However, UK Cyber Defence found 15 Danfoss fridges in the UK accessible on the open internet and said it was “accurate to say it is highly unlikely that they have been patched”.

While having the web login pages discoverable on the internet doesn’t automatically give hackers access to the control system of the 800-plus fridges and freezers, it does expose them to “whoever finds the flaw or guesses a weak password”, UK Cyber Defence founder and chief information security officer Peter Bassill told The Grocer. As Bassill put it, it’s not a “broken lock” but it is like “having your front door on the street”.

In a statement to industry publication Cooling Post , Danfoss said the majority of affected units in the France attacks were legacy products or current products running outdated firmware. It is understood hackers found web login pages to the fridges by running scripts on the open internet.

Last year, Danfoss issued a software patch to repair a vulnerability that could “result in an authentication bypass”. A patch this September was issued to repair a vulnerability that “allows attackers to gain read/write access to internal values, upload and execute unsigned applications”.

Research presented by cybersecurity company Claroty’s Team82 at hacker convention DEF CON 34 in August demonstrated how a compromised Danfoss AK-SM 800A controller could be used by hackers to remotely “configure temperature thresholds” and “adjust operating schedules” as well as “perform maintenance activities”.

At least 300 Intermarché and Netto brands were targeted in Sunday night’s incident, along with more than 100 Coopérative U outlets, and several E.Leclerc stores, the retailers told AFP in separate statements.

“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is extremely serious and is unprecedented. It is unacceptable,” Coopérative U CEO Dominique Schelcher said in a statement.

Carrefour has said fridges in 80 of its 6,000 stores were hacked, while Monoprix said 5% of its 400-plus stores had been hit, Reuters reports.

Attack ‘didn’t need a genius’

According to Bassill, “France was not singled out because someone bore it a grudge; it was singled out because its refrigeration estate was, by a wide margin, the most reachable Danfoss population in the world”.

UK Cyber Defence’s analysis found France alone accounts for roughly 2,967 of the internet-exposed Danfoss controllers worldwide.

“The French attack didn’t need a genius, it needed a few hundred fridge controllers sitting on the open internet with a known, unpatched flaw, and France happened to have more of those than anywhere in the world,” Bassill told The Grocer.

“Britain has very few of that particular Danfoss model, but it has over 800 refrigeration and building controllers of one make or another reachable from the public internet, usually put there by a maintenance contractor so they can dial in from the van. The ingredients are the same here; only the brand on the box is different,” he added.

The majority of the 800 internet-exposed controllers – which cover manufacturers including Danfoss, Carel, Copeland and others – can be found on “consumer broadband, rural broadband and machine-to-machine cellular networks, not on corporate retail infrastructure” UK Cyber Defence said, indicating it is “the work of a refrigeration or building-services contractor who needed remote access and took the quickest route to it”.

“The retailer’s IT team frequently does not know the device exists,” Bassill said.

“The reassuring part is that this is housekeeping, not rocket science: know which controllers you have, make sure they’re patched, and take their management page off the open internet,” Bassill added. “Do that and you’ve shut the door the French attackers walked through.”