Hackers reportedly changed temperature settings on refrigeration equipment used by the French Blood Establishment, EFS, from around −30°C to 110°C after targeting its cooling service provider, Coolworld.
It gets worse once you realize that in most cases you heard of in the last weeks there was no actual hack to speak of involved (although a lot of them were unpatched EOL devices, too), but just accessing them with the default password.
So having remotely controllable freezers in the first place isn’t even the beginning of the stupidity involved. They are also often completely unsecured and nobody cares.
Default password kind of indicates that they have not changed the password of the device they put on the internet. Whats actually going on is that someone reverse engineered the firmware, and figured out that the manufaturer has added an extra hidden password that can be calculated from todays date.
I was speaking more broadly about “most cases you heard of in the last weeks”… Yes, in some case it might have been actual hacks involved because basic security was adequate, which also included noticing the issue in time to prevent actual consequences in this specific case.
It gets worse once you realize that in most cases you heard of in the last weeks there was no actual hack to speak of involved (although a lot of them were unpatched EOL devices, too), but just accessing them with the default password.
So having remotely controllable freezers in the first place isn’t even the beginning of the stupidity involved. They are also often completely unsecured and nobody cares.
Default password kind of indicates that they have not changed the password of the device they put on the internet. Whats actually going on is that someone reverse engineered the firmware, and figured out that the manufaturer has added an extra hidden password that can be calculated from todays date.
What we really need to do is legislate this into our banking apps.
I was speaking more broadly about “most cases you heard of in the last weeks”… Yes, in some case it might have been actual hacks involved because basic security was adequate, which also included noticing the issue in time to prevent actual consequences in this specific case.
You’d think people would have more care for critical stuff like blood supply.