upvote
I don't understand why these things aren't on their own (V)LAN. Why they are open to internet?!
reply
Brainstorming here; monitoring, logging, etc. The fact the store managers were called out of bed when there was an issue indicates it works. If a cooler broke down overnight or its temperature was too high for X amount of time, they have to discard the products. Without monitoring they likely wouldn't know until customers got sick.

I wish commenters (in general) would do a bit more "steelmanning" before asking questions about why something is (in this case) connected to the internet.

reply
All of this can be done without connecting edge devices directly to the internet (and potentially allowing inbound connections). The question is not why they have networking, but why the connectivity is such that an attack like this is even possible.
reply
given they turned off the refrigerators (instead of something evil like turning them down for just long enough to allow bacterial growth and then turning them back up) customers would probably have noticed their ice cream being liquid, the frozen meat not being frozen, etc
reply
>I wish commenters (in general) would do a bit more "steelmanning" before asking questions about why something is (in this case) connected to the internet.

People won't steelman because the answer to "why are the fridges slapdashedly networked?" is too often "because people of my ideological bent and demographics if not literally me previously demanded paper trails, audit-ability and regulatory compliance that was impossible for a low margin industry to pull off any other way."

reply
That seems like a pretty wild nonsequitur at first glance. How exactly do we get to “too much regulation” from “a subset of stores’ centrally managed equipment was left off the VPN”?
reply
My point, which will inevitably be straw manned to hell and back, is that a large part of the reason these systems all came about is to cheaply satisfy externally imposed requirements (save energy, facilitate audits, remove responsibility from store employees, etc, etc) that the peanut gallery (and more concerningly, real people doing real work deciding things) cheers for when examined in isolation.

Requirements in the food industry come not just from government rules and suggested best practices (that are more than suggestions in practice) but also indirectly as a result of requirements imposed by insurers, financiers and trade groups. In response to this companies that run supermarket chains or manufacture major brands of food have not quite the same verbosity but certainly comparable degrees of retention in their record keeping as medical and aviation.

This monitoring and control is increasingly centralized in response to all these requirements because it's most efficient that way. If you're gonna have one guy in an office deciding things you might as well automate away the middle man and have him set them too and let the people on the ground spend more time doing their core work.

If fifteen of the twenty thousand dozen systems (pulling that number out of my ass FYI) in an industry are being centrally controlled through computer systems it's inevitable that some of them wind up off the VPN and this happens. It's just a natural tradeoff or risk you run when doing that and it's completely foreseeable.

But the internet peanut gallery will not generally have any sort of adult discussion about these tradeoffs because "we saved X (maybe X is money, maybe energy, who knows, who cares) by operating the fridges more centrally" is a nice easy win for them and rather than have a discussion about subjective and hard to pin down long tail risks it's easier to just screech about "we should fine the people who did it wrong" or whatever when one of those long tail risks rears its ugly heads.

reply
I still don’t follow. You’ve said a lot of things about regulation and insurance requirements and all that, but I don’t see how any of it is necessary to get to “centralized management.” Let alone goofing up the centralized management.

I’m just a software person, not a supermarket expert, so maybe I’m being a bit simpleminded here, but for the entirety of my career I’ve participated in a constant trend toward centralizing and automating operations. That’s been the case regardless of how highly regulated the industry was. The motivating force has always been making things easier, cheaper and less error prone.

I suppose we could throw a rant about regulation into the mix, but, in the words of Laplace, I have no need of that hypothesis.

reply