Security through obscurity is not a good cyber defence

The writer is an information security researcher and chief security officer at TPO Group

On the evening of October 11, supermarket refrigeration units across France warmed up to as much as 50C overnight. The following day, bewildered workers were greeted with aisles full of spoiled food. In several stores, fires also broke out in overheated units. Most of the supermarkets used a Danfoss central unit that controlled the freezer and refrigerator units for an entire store. That central controller was accessible remotely. Cybercriminals appear to have found a single hack that would leave every unit vulnerable.

In total, over 150 Intermarché and Netto stores, 80 Coopérative U stores, and about 80 Carrefour stores with some scattered Monoprix and E Leclerc stores were hit. At least one vulnerability researcher reported that stores in Spain, Portugal, Germany, Poland and Belgium had also been affected.

A year and a half earlier, Danfoss had deemed one line of its refrigeration controller products vulnerable to unauthorised remote login and had made software updates available. The morning after the attack, Cert-FR, the cyber security emergency response team for France, issued a public alert warning that Danfoss remote controllers of refrigeration systems were actively being targeted in an ongoing security incident.

A few days after the attack on French supermarkets, millions of websites around the world went dark. The takedown was a precautionary measure after a vulnerability was found in PHP, a web programming language that has been used for decades in business, academia, science and government. Its well-known problems with memory safety, a flaw that makes it easy to exploit, were highlighted by researchers testing cyber defences using AI tools, and patches were issued.

Both the refrigerator hack and the PHP exploit are about familiar problems with old software. Information security experts are seeing many more low-level old vulnerabilities being exploited at a high cost to those hacked.

In the case of the French fridges, Intermarché’s CEO has said the attack will cost tens of millions of euros. Other hacks may do even more damage. But if they do not make the news, there is little to no incentive for those victimised to publicise how they were taken advantage of.

This is a problem because knowing the details can help cyber security experts prevent future attacks elsewhere.

Investigators at France’s cyber security agency ANSSI have not confirmed how attackers got into the supermarket refrigeration units, although researchers at information security research firm Claroty found several vulnerabilities in the code for a Danfoss refrigeration model months before.

We cannot verify the path the attackers took. But there is another possibility. The day’s date was being used to seemingly purposefully create a hidden administrator bypass which ignored any password the owner had set on the device and permitted full device access.

This is not a normal method of providing secure remote access to devices. In information security, we call something that is hidden like this “security through obscurity”. The affected devices had not been updated. Some older devices had no patches available at all.

Industrial and commercial suppliers of devices that can start fires can no longer pretend that security through obscurity is a sufficient defence when failing to implement the most basic security practices. Consumer product safety commissions have been warning for decades that internet-connected devices that manage temperatures are likely to be in the first wave of human-harming hacks, and this is the first major hack that has caused fires in multiple locations.

Outdated, insecure software has been a problem for decades. Finding those exploits is being made easier by AI. While there is no evidence that the French refrigerator hacks used AI, PHP shows how quickly AI can put together a string of exploits that use software with well-known vulnerabilities.

The time between finding a weakness and watching as it is turned into an active exploit is collapsing from years to days. Without aggressive patching and taking security hygiene more seriously, the next 18-24 months will see more attacks against industrial and commercial equipment — and the risk of more fires.