法国约700家超市制冷系统遭黑客攻击，致食品腐败与起火
Fridge hack costing millions and sparking fires stemmed from poor security
法国约700家超市的联网制冷控制器遭黑客攻击，攻击者远程开启除霜模式使冷柜温度升至50°C，造成大量食品腐败，部分电气系统起火。报道称涉事控制器来自丹麦Danfoss及美国Dixell与母公司Copeland，均存在可让攻击者以管理员权限远程登录的严重漏洞；Danfoss控制器此前使用由公开固件按日期生成的每日密码，同一密码在数百至数千家门店的同型号设备上通用，未及时更新的设备可被同样方式破解。
Earlier this week, a mass hack of refrigeration systems at an estimated 700 supermarkets throughout France caused them to suddenly malfunction, causing spoilage of untold tons of perishables and, in some cases, fires. As is now the norm, basic cybersecurity would have prevented it.
French authorities say the systems, made up of entire fleets of refrigerators and freezers throughout a store, were hacked. More specifically, Internet-connected controllers that allow technicians to remotely administer the store-wide systems were compromised. The unknown attackers responsible then activated defrosters long enough for the fridges to reach temperatures as high as 50° Celsius (122° Fahrenheit). By the time the mass compromise was discovered, food was spoiled, and in some cases their electrical systems caught fire.
The hacks that didn't have to happen
Multiple security advisories and public research reports show that all three of the controller models reportedly hacked in the incident—sold by Danfoss of Denmark and Dixell and its parent company Copeland in the US—contained critical vulnerabilities that allow attackers to remotely log in to the devices with the same system rights as administrators. Until recently, Danfoss controllers, for instance, used a credential that changes each day. The password is generated by the publicly available firmware based on the date. A hacker who takes the time to analyze the code can do the same thing on any device that hasn’t received a recent update. Daily passwords are identical across models located in hundreds or thousands of stores.
来源：Ars Technica · arstechnica.com