Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I think the military commissary's freezers were hacked

signalandsilence.substack.com

Post reply on HN
Print view View original

151–160 of 252 posts

Re: I think the military commissary's freezers were hacked

#151

Post by fireflash38 »

lowbloodsugar wrote: post #146
lenerdenator wrote: post #85

Earlier quoted context omitted.

That someone can be brought into an office and shown a small diagram of the approved network topology. Then they can be shown a small diagram of the current network topology. Next, they can be asked if they're the same. If they're not, they can finally be asked if they're aware that deviating from the approved network topology without consulting infosec is grounds for termination of their employment.

We're talking about the military. Many years ago I heard a presentation by an IT guy in the marines. He stated that senior officers would regularly give him instructions that would violate some policy or other - such as giving their secure laptop direct access to the internet so they could check their personal email - as an order . That is, they could not refuse. I hope things have changed, but this fellow was dead s…

Report that shit to your security officer

Re: I think the military commissary's freezers were hacked

#152

Post by Prickle »

lenerdenator wrote: post #83
peterabbitcook wrote: post #29

A couple years ago I worked on a service that had to communicate with a Siemens S7-1500 PLC. Based on my experience with that project, none of what I’ve read recently about unsecured industrial PLCs is surprising. I opened Siemens TIA Portal and PLCSIM for the first time and thought “wow, I didn’t think the Windows 95 GUI library was still supported.” None of the PLC contractors we had hired knew how to enable TLS on…

> In all fairness, the people who are experts in the field of Siemens PLC programming are usually mechanical-ish engineers and security is not in their skill set or on their mind. Stuxnet was over a decade ago. There should be a simple rule that everyone with the ability to understand things like PLCs should be able to grasp: your equipment does not touch the internet or external storage, period. Those who can't gras…

Oh I wish that was possible.

Fact is if the customer wants to put their worksite management on AWS, you inevitably expose the OPC server and/or PLC to a Intranet. This is then inevitably connected to the internet in some way. The customer may or may not put barriers between them, but that's not up to us to decide.

This becomes especially a problem if they have multiple sites across a country or countries.

We have a customer that runs a factory on god forsaken WIFI, then dares to complain about a bad connection to said equipment. Thankfully, they have their own internal IT department.

Re: I think the military commissary's freezers were hacked

#153

Post by tgsovlerkhgsel »

nwallin wrote: post #125
nwatson wrote: post #94

Earlier quoted context omitted.

Did they airlift better supplies to a floating aircraft carrier somewhere in the northern Indian Ocean recently? No.

Aircraft carriers are not particularly well suited to be supplied by cargo aircraft. The largest cargo aircraft with the strengthened landing gear, arresting hook, and catapult attachment used to be the C-2 Greyhound. It had a range of approximately 1,500 miles with a 10,000 pound cargo. It was retired on July 28th, 2026. The C-2 has been replaced by the CMV-22B Osprey. It has a range of only 1,150 miles and a more l…

The Osprey is air refuelable though, isn't it? Each flight is roughly one pound per person on board.

It's also roughly 2800 nautical miles from Kuwait to Diego Garcia, so regardless of where the carrier group is, it should be at most a ~6 day round trip at 20 knots for a supply ship from the closest of the two.

That assumes there is no way to airdrop watertight pallets of food (e.g. steel drums loaded with cans and MREs) into the water, then retrieve it with RHIBs or helicopters.

Re: I think the military commissary's freezers were hacked

#154

Post by tgsovlerkhgsel »

sidewndr46 wrote: post #33
peterabbitcook wrote: post #29

A couple years ago I worked on a service that had to communicate with a Siemens S7-1500 PLC. Based on my experience with that project, none of what I’ve read recently about unsecured industrial PLCs is surprising. I opened Siemens TIA Portal and PLCSIM for the first time and thought “wow, I didn’t think the Windows 95 GUI library was still supported.” None of the PLC contractors we had hired knew how to enable TLS on…

Isn't this the industry expectation in that kind of equipment? If it was signed by a real CA the cert. could expire and render the equipment unable to communicate.

My guess would be something like the CA using some feature that was newer than what the equipment would support (e.g. ECC signatures but the equipment only supporting RSA), not an intentional "no real CAs" decision.

Re: I think the military commissary's freezers were hacked

#155

Post by tgsovlerkhgsel »

dylan604 wrote: post #61
peterabbitcook wrote: post #49

Earlier quoted context omitted.

That’s a tough question. If your PLC is on an airgapped LAN, admin/admin is not great security hygiene but you’ve reduced most of the risk by airgapping. On my project the service I wrote was doing bidirectional communication with the PLC over OPCUA. The server running this pod was connected to the internet, so it was critical to have proper TLS for the OPCUA client/server. Rotating LetsEncrypt certs on the system ev…

> Rotating LetsEncrypt certs on the system every 45 days is a lot of toil What is unique about your system using LetsEncrypt that you can't automate certbot to handle this task as it was designed and intended to be done?

Running certbot on your web server is easy.

Running certbot on a random PLC isn't happening.

Re: I think the military commissary's freezers were hacked

#156

Post by tgsovlerkhgsel »

alephnerd wrote: post #27
ckdarby wrote: post #20

Earlier quoted context omitted.

The article has a post that says this happened across 14 bases at the same time.

There are a couple hundred US armed forces bases each with commissaries that would be managed by DeCA. An attack like the author hypothesized would require a LOTL modus operandi, and doing so on 14 locations wouldn't justify completely blowing up an entire LOTL operation, because it exposes indicators, registers, and tradecraft that is then shared amongst all security vendors. The way it's framed is clickbait at its…

Or someone somehow got into one web interface (e.g. by popping a random workstation used to monitor all these sites) and clicked buttons.

Re: I think the military commissary's freezers were hacked

#157

Post by tgsovlerkhgsel »

meliz242 wrote: post #92

Howdy y’all, author here. Just discovered this thread after wondering why Hacker News was a linked views source to my silly little freezergate braindump. Wanted to offer a few clarifications: I’m not a cybersecurity expert; I’m an investigator (in a totally different field), and this was essentially me following a weird thought to see where it went. My background is in natsec so that’s where my mind goes. There have…

Even if it isn't an attack, you demonstrated how it could be one. The vulnerability is likely there and worth mitigating. Excellent investigation and write-up!

Re: I think the military commissary's freezers were hacked

#158

Post by phil21 »

gwbas1c wrote: post #43

To summarize for people who TLDR: 14 freezers failed at the same time. They are all internet-controlled, and failed at the same time as a disclosure about a vulnerability . They all failed by turning on the defrost cycle and heating food. Regardless if this was a hack or a bug, the bigger lesson is that overcomplicated systems fail in catastrophic ways. Why do military commissaries need remote-controlled freezers? It…

Could also just be a bunch of IoT devices running on synchronized time source that have what amounts to a defrost cronjob. And a latent bug that due to everything being synced and on the same schedule failed in the same manner (eg crashed the controller immediately after turning the heating element on and either didn’t boot back up or booted and some shitty programming forgot to check the heating element status). Saving state across boots or having a race condition of some sort like this gets my vote - since it’s a pretty common failure mode junior programmers are susceptible to.

I’ve seen similar too many times in my career - synchronized clocks are great until someone deploys a cronjob that fires at exactly the same time across the fleet and it breaks a certain OS or firmware revision. Which then exposes another bug that exists globally.

I definitely still subscribe to don’t attribute to malice what you can attribute to incompetence mindset.

Certainly all speculation though, real root cause will be interesting if it ever becomes public.

Re: I think the military commissary's freezers were hacked

#159

Post by Terr_ »

0xWTF wrote: post #130

This is eerily suggestive of a vulnerability Hank Paulson hinted at in his 2014 book "Dealing with China" "Every nonelectric cooler comes with 25 years of free real-time monitoring. On a visit to the company in the spring of 2012, I watched as technicians in Broad Air’s space-age control room checked on the performance of its units in locations as diverse as the Adolfo Suárez Madrid–Barajas Airport in Spain; Qualcomm…

America's tech-sector has a similar problem, which--until recently--was tempered by the idea that it was a dependable and predictable ally to most of its customers.

Not just in the sense of secretive kill-switches, but "US government commands you to turn over this encryption key and you're not allowed to say you did so" stuff.

Re: I think the military commissary's freezers were hacked

#160

Post by metaphor »

CobaltFire wrote: post #67

As someone who spent over 20 years active duty, and spent a ton of my career in the IT, security, etc. side of the house: Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly. That said, the timing of the disclosure and the issue are rather concerning. Regarding the highest value targets to hit with an attack like this, you would want to target Guam, Hawai'i, and other isolated overs…

[dead]
Post reply on HN