The hacker attacks on supermarket refrigerators that hit several countries in Europe have also reached Italy. After the cases recorded in France and, more recently, in Belgium, Sweden, Luxembourg and Estonia, on 2 November cyber attacks were also reported in Sicily, where some Coop stores – at least four – between Palermo and Catania suffered tampering with their refrigeration systems, resulting in increased temperatures and deterioration of food. The identity of the perpetrators and any connections with other European episodes are still being investigated by the Postal Police and France has not yet identified those responsible for the attacks of 11 and 12 October.
Meanwhile, the National Cybersecurity Agency (ACN) has called on food supply chain operators to take urgent measures to protect plants and remote access. But how do hackers take control of these devices? Who could be behind the attacks and what other sectors are at risk? We talked about it with Marco Schiaffino, journalist specializing in new technologies and cybersecurity, author and host of the program Doppio Click on Radio Popolare and of the podcast Welcome to the Cyber Jungle.
Attacks on European supermarket refrigerators appear to follow a similar pattern. Can we talk about a coordinated operation or are these separate episodes?
At the moment there is no evidence to support that the two waves of attacks are coordinated. What happened, from a technical point of view, is not particularly surprising. Industrial refrigeration systems use remote controls to manage maintenance: when IT vulnerabilities are identified, they are corrected and the technical details are subsequently published online. At that point, however, cybercriminals may also know about the vulnerability and know how to exploit it.
If whoever manages the device does not update the software or adequately secure the connection, the system remains vulnerable. There are services that allow you to identify devices of a specific brand connected to the Internet: a criminal can search for them and try to attack them. We are therefore not necessarily talking about a particularly sophisticated cyber attack: medium-low skills are sufficient.
Who could be behind these attacks? Can we hypothesize a sabotage operation with geopolitical purposes?
The doubt is whether they are individuals or a group of activists. Traditional cybercriminals, in fact, generally act for economic reasons and often use extortion techniques: for example, they could ask a supermarket chain to pay a certain sum of money, otherwise threatening to block all refrigerators. In this case, however, nothing of the sort appears to have happened.
There are also precedents for so-called state-sponsored attacks state-sponsored attacks. For example, attacks against wastewater treatment plants in the United States have been attributed to Iranian groups, while Russia has conducted operations against Ukrainian energy infrastructure. However, these are attacks of a very different scope and complexity compared to those against supermarket refrigerators.
These episodes highlight a broader problem, that of Operational Technology (OT), i.e. the technologies that control and manage industrial plants. Over the last twenty years, Internet connections have been introduced to remotely manage factories, energy plants and other infrastructure. The problem is that these plants are designed to last decades, while digital technology has much shorter life cycles: a hydroelectric power plant, for example, can be designed to operate for 60 or 70 years, while a computer system can become obsolete in a matter of a few years. There is therefore a risk of having systems that still use operating systems such as Windows XP or Windows 7, for which normal security updates are no longer available.
This creates enormous difficulties in ensuring the IT protection of infrastructures. The European Union is intervening with the Cyber Resilience Act, which introduces security obligations for manufacturers of digital devices and systems. However, these provisions mainly concern new products: solving the problem of existing industrial systems will take much longer.
The National Cybersecurity Agency has released measures to protect the facilities. How effective can they be and how prepared is Italy?
In recent years, a lot of work has been done on this topic in Italy, also thanks to European regulations: an example is the NIS2 directive, which has changed the way of dealing with cybersecurity.
In the past we thought above all in terms of obligations: once certain measures were adopted, we believed we were safe. With NIS2, however, we move to a logic based on risk assessment: protecting a small commercial business is very different from protecting the water management system of a large city; it is therefore necessary to provide measures proportionate to the actual risks.
The indications from the ACN are certainly useful. In essence, they recommend not leaving services and control systems exposed on the Internet without adequate protection. The problem is understanding how many operators actually apply these measures. There’s still a mentality of, “Why would anyone attack me?” Yet, in this second wave of attacks, not only large supermarket chains were hit, but also small food businesses and butchers.
Besides supermarkets, what other sectors might be particularly vulnerable?
It is necessary to distinguish traditional cybercrime attacks, which generally have economic motivations, from those with possible geopolitical purposes.
In the first case, one of the most exposed sectors is the manufacturing sector. If a criminal manages to block the production of a factory, he can use the blockade as a tool of extortion, demanding a ransom to restore the functioning of the plants.
From a geopolitical point of view, however, infrastructures linked to the management of water and energy, such as aqueducts, dams and power plants, are particularly sensitive. Another strategic sector is telecommunications: compromising a country’s communications can cause very serious consequences.
Added to these are cyber attacks aimed at stealing information, which however do not necessarily have direct consequences on the physical functioning of the systems.
But can these attacks also reach our homes, through connected devices such as air conditioners, thermostats or home automation systems?
In reality they have already arrived some time ago. The problem mainly concerns the Internet of Things (IoT), i.e. the set of devices connected to the Internet. In the first phase of diffusion of these technologies, cybersecurity was often underestimated. Devices such as robot vacuum cleaners, thermostats or surveillance cameras were designed without sufficient attention to possible vulnerabilities.
A famous example is Mirai, a botnet that emerged in 2016 that used default credentials to take control of hundreds of thousands of connected devices, especially surveillance cameras. Once compromised, these devices could be used by criminals to conduct cyberattacks against other targets, for example by overloading a site with requests until it becomes unreachable, or to hide the attackers’ real IP address.
It is not necessarily the case, therefore, that whoever takes control of a thermostat wants to change the temperature of the house: they could use it for completely different purposes, without the owner realizing it.
Newer devices have generally improved in terms of security, but a problem related to user behavior remains. Often, for example, the default credentials from the manufacturer are not changed, and this can represent a significant risk.
Where, then, should the responsibility for IT security start? And what can we do to protect ourselves?
There are two fundamental aspects. The first is the so-called security by design, i.e. the need to design systems and devices taking cybersecurity into account from the beginning, rather than intervening only after problems emerge. The second concerns the culture of cybersecurity: one of the big problems of cybersecurity is that it is still considered a subject reserved for a few specialists. In reality this is not the case: if things are explained well, anyone can understand what the fundamental precautions are to protect themselves, including the “housewife from Voghera”.
Much more work should be done on this aspect, making cybersecurity an accessible and understandable topic for everyone.
