alt Hacker NewsAs I mentioned in the thread regarding the previous attacks, I worked in a closely related field back in 2008-2009.
One thing I see repeatedly brought up here in this discussion is "Why can't we just set the refrigerator temperature with a knob and walk away?"
The problem is that these refrigerator cases are not as simple as your refrigerator at home. As a simple example, many systems allow you have control over the deadband: the exact low temperature at which the compressor turns off and the high temperature at which the compressor turns back on. You also have control over defrost cycles, compressor pressure and many other things (I worked with this a long while ago, and I don't remember all the details).
Take a look at some of these manuals, for example: https://www.hillphoenix.com/resource/installation-manuals-2/... As far as I can tell, those manuals just cover the refrigerator cases, and not the outside compressors and heat exchangers, which are another layer to deal with.
This is not something that a non-expert supermarket employee would be able to handle well. The purpose of all these settings is optimize around energy usage, maintenance costs, customer experience, etc. Even if you only save $500/store/year, you can see that it really adds up over a chain of 1000 stores.
That's why this equipment is remotely accessible: it's not like your fridge at home and requires a lot more knowledge to get the most out of it. Of course, that does not excuse poor security implementations.
Replies
> “That's why this equipment is remotely accessible”
Complicated things don’t have to be connected to the internet. Most environment control systems in small buildings (typically with hundreds of sensors and actuators) aren’t. There is smart, deterministic, software involved but most of the time, no cloud.
> Even if you only save $500/store/year, you can see that it really adds up over a chain of 1000 stores.
People always say stuff like this, but it never tracks for me. If you’re a chain with 1,000 stores, $500,000 is barely a blip on your budget sheet in exactly the same way that $500 is barely a blip on the budget of a single store.
Plus there’s no way this remote management stuff doesn’t cost at least $500/store in operating costs.
And how much money the shop looses from the attack? It sounds it wiped out all the saving remote automation brought.
If only 50$ of those savings were invested in Tailscale.
I don't see why saving $500 per store a year is better than exposing your systems to cyber attacks.
And yet... if they had instead invested in making the equipment operable locally we wouldn't be here today. This is the problem with thinking of your users as "nontechnical" lesser beings. The engineering problem becomes remove control and ownership from the user instead of make the product usable. In this case by removing control from the user they simply gave it to an attacker. Great job, guys.
> The problem is that these refrigerator cases are not as simple as your refrigerator at home. As a simple example, many systems allow you have control over the deadband: the exact low temperature at which the compressor turns off and the high temperature at which the compressor turns back on. You also have control over defrost cycles, compressor pressure and many other things (I worked with this a long while ago, and I don't remember all the details). … This is not something that a non-expert supermarket employee would be able to handle well.
I still don't see why the expert has to be remote, or why an integrated computer can't do the optimization. Or why it needs to be fiddled with at any significant frequency.