Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I think the military commissary's freezers were hacked

signalandsilence.substack.com

Post reply on HN
Print view View original

61–70 of 252 posts

Re: I think the military commissary's freezers were hacked

#61

Post by dylan604 »

peterabbitcook wrote: post #49
sidewndr46 wrote: post #33

Earlier quoted context omitted.

Isn't this the industry expectation in that kind of equipment? If it was signed by a real CA the cert. could expire and render the equipment unable to communicate.

That’s a tough question. If your PLC is on an airgapped LAN, admin/admin is not great security hygiene but you’ve reduced most of the risk by airgapping. On my project the service I wrote was doing bidirectional communication with the PLC over OPCUA. The server running this pod was connected to the internet, so it was critical to have proper TLS for the OPCUA client/server. Rotating LetsEncrypt certs on the system ev…

> Rotating LetsEncrypt certs on the system every 45 days is a lot of toil

What is unique about your system using LetsEncrypt that you can't automate certbot to handle this task as it was designed and intended to be done?

Re: I think the military commissary's freezers were hacked

#62

Post by Joker_vD »

jordanb wrote: post #46
peterabbitcook wrote: post #29

A couple years ago I worked on a service that had to communicate with a Siemens S7-1500 PLC. Based on my experience with that project, none of what I’ve read recently about unsecured industrial PLCs is surprising. I opened Siemens TIA Portal and PLCSIM for the first time and thought “wow, I didn’t think the Windows 95 GUI library was still supported.” None of the PLC contractors we had hired knew how to enable TLS on…

My mind was blown when I realized that the way tftp works is that as the machine is booting it asks the network if anyone has some software for it to run.

Well, what else can it do, really? It has to boot with pretty much zero knowledge about the external world (maybe except asking the user for the current date and time). Sure, you can hardcode an outdated list of CAs (it's always outdated because the system can be booted 10/20/100 years after it was made) in but that just opens you to unexpected obsolescence, and you usually can't put too much stuff in the bootloader anyway.

Not really dissimilar from the human upbringing: leave a baby with "bad" guardians, and it will grow up corrupted. That's a feature, not a bug: if you knew what behaviour exactly you wanted (other than "whatever Simon says"), you would just bake it in in the first place, right?

Re: I think the military commissary's freezers were hacked

#64

Post by sidewndr46 »

peterabbitcook wrote: post #49
sidewndr46 wrote: post #33

Earlier quoted context omitted.

Isn't this the industry expectation in that kind of equipment? If it was signed by a real CA the cert. could expire and render the equipment unable to communicate.

That’s a tough question. If your PLC is on an airgapped LAN, admin/admin is not great security hygiene but you’ve reduced most of the risk by airgapping. On my project the service I wrote was doing bidirectional communication with the PLC over OPCUA. The server running this pod was connected to the internet, so it was critical to have proper TLS for the OPCUA client/server. Rotating LetsEncrypt certs on the system ev…

I'm not sure if you're speaking from personal experience, but most I've interacted with don't have to worry about the self-signed vs. LetsEncrypt debate. They just don't do it. Also there would be no way to do LetsEncrypt as the system is air gapped.

Re: I think the military commissary's freezers were hacked

#65

Post by stackghost »

gwbas1c wrote: post #43

To summarize for people who TLDR: 14 freezers failed at the same time. They are all internet-controlled, and failed at the same time as a disclosure about a vulnerability . They all failed by turning on the defrost cycle and heating food. Regardless if this was a hack or a bug, the bigger lesson is that overcomplicated systems fail in catastrophic ways. Why do military commissaries need remote-controlled freezers? It…

>Generally, when a state actor has hacked something, they don't want the victim to know

Could be the Iranians, or someone aligned, conducting anti-morale operations. Could be the start of a series of small but annoying failures.

Re: I think the military commissary's freezers were hacked

#66

Post by [deleted] »

Joker_vD wrote: post #62
jordanb wrote: post #46

Earlier quoted context omitted.

My mind was blown when I realized that the way tftp works is that as the machine is booting it asks the network if anyone has some software for it to run.

Well, what else can it do, really? It has to boot with pretty much zero knowledge about the external world (maybe except asking the user for the current date and time). Sure, you can hardcode an outdated list of CAs (it's always outdated because the system can be booted 10/20/100 years after it was made) in but that just opens you to unexpected obsolescence, and you usually can't put too much stuff in the bootloader…

[deleted]

Re: I think the military commissary's freezers were hacked

#67

Post by CobaltFire »

As someone who spent over 20 years active duty, and spent a ton of my career in the IT, security, etc. side of the house:

Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly.

That said, the timing of the disclosure and the issue are rather concerning.

Regarding the highest value targets to hit with an attack like this, you would want to target Guam, Hawai'i, and other isolated overseas locations where this would have ripple effects in the local economy. Guam specifically would cause catastrophic supply shortages, since DeCA probably supplies around 50% of the groceries on that island (that's a WAG based on my time there).

Re: I think the military commissary's freezers were hacked

#68

Post by TeMPOraL »

stackghost wrote: post #65
gwbas1c wrote: post #43

To summarize for people who TLDR: 14 freezers failed at the same time. They are all internet-controlled, and failed at the same time as a disclosure about a vulnerability . They all failed by turning on the defrost cycle and heating food. Regardless if this was a hack or a bug, the bigger lesson is that overcomplicated systems fail in catastrophic ways. Why do military commissaries need remote-controlled freezers? It…

>Generally, when a state actor has hacked something, they don't want the victim to know Could be the Iranians, or someone aligned, conducting anti-morale operations. Could be the start of a series of small but annoying failures.

Or could be a rouge LLM in one of the big labs, that accidentally self-prompt-injected itself with the title of that vulnerability research paper.

Re: I think the military commissary's freezers were hacked

#69

Post by TeMPOraL »

the_real_cher wrote: post #47

Would be hilarious if this was a runaway AI that someone was using to control their own IoT fridge. > "I'm sorry I'm familiar with that function. Let me research enabling defrost for you."

The vulnerability research paper article mentions has a title that I could imagine an LLM take as an instruction - or a challenge.

Re: I think the military commissary's freezers were hacked

#70

Post by ericmay »

CobaltFire wrote: post #67

As someone who spent over 20 years active duty, and spent a ton of my career in the IT, security, etc. side of the house: Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly. That said, the timing of the disclosure and the issue are rather concerning. Regarding the highest value targets to hit with an attack like this, you would want to target Guam, Hawai'i, and other isolated overs…

Generally agree with your assessment, but in the case of Guam or other more remote installations if there were catastrophic issues we'd just airlift food in. Costly but certainly manageable.

Hawaii I'm not sure why that would be an issue unless the whole island was attacked or shut down. Even if the on-base shops were hacked you could just go shop at Wal-Mart or Costco or any number of other locations on the islands. If there was an extended issue then the commander could authorize meal stipends as they do for some units today and then you would just go buy food off-base. Ideal? No. Manageable? Very much.

Post reply on HN