If hackers can take control of a supermarket freezer, how vulnerable is other tech?

Supermarkets in several European countries experienced a suspected cyber-attack impacting their fridges and freezers, sparking concerns about the security of internet-connected devices ranging from industrial machinery to household appliances. Smart gadgets, including fridges, heating systems, and washing machines, offer remote control advantages but could also be exploited by malicious actors.

While controls are theoretically possible, big brands typically invest heavily in securing their technology. In 2015, researchers showcased a vulnerability in a Samsung smart fridge that could intercept internet traffic, but no evidence indicates domestic appliances were targeted in recent supermarket attacks.

Ciaran Martin, former head of the UK National Cyber Security Centre, emphasized the need for manufacturers to enhance the security of connected devices, urging consumers to update their devices and enable multi-factor authentication whenever possible. Since April 2024, UK law mandates minimum cyber security standards for certain smart devices, encompassing password requirements and software updates.

The NCSC is collaborating with international partners and industry to investigate the supermarket incidents, though it hasn't reported any impact on the UK.

UK Cyber Defence researchers identified over 800 refrigeration and building-control interfaces accessible via the public internet, belonging to British retailers. While this does not necessarily imply these systems are vulnerable, they could be susceptible to attacks leveraging weak passwords or software weaknesses. The government has engaged with major food retailers to discuss cyber resilience following earlier cyber-attacks.

Helen Dickinson, CEO of the British Retail Consortium, highlighted cyber incidents as a significant concern for retailers, with companies collaborating with the NCSC to share intelligence and bolster defenses.

Tom Hegel, a researcher at SentinelOne, stressed that retailers must clarify their responsibility for protecting connected equipment, rather than merely addressing repair issues. Internet connectivity enhances convenience but necessitates corresponding security measures. Should an attacker gain control over these systems, routine functions like defrosting could be weaponized against physical stock, disrupting operations beyond just halting computer systems.

Outside homes, internet-connected technology manages industrial machinery and vehicles, with Ken Munro, a cybersecurity expert, noting a 2015 demonstration where researchers remotely hacked a Jeep through its internet-connected entertainment system. This prompted improvements in vehicle security. Munro also expressed concern over smaller, less funded utility companies that may still utilize outdated, vulnerable equipment, potentially exposing them to similar risks if not adequately protected.

Olivier Daloy, a cybersecurity expert at Zscaler, cautioned that any factory or equipment connected to the internet—spanning from car manufacturers to electricity or transport infrastructure—could face comparable risks if proper safeguards are not in place.