From our other sites
The story
On the overseas forum Lemmy’s c/europe community, a thread about commercial refrigerators used in roughly 100 French supermarkets being hacked over the internet sparked discussion. The cause was outdated firmware that left the units remotely accessible from the outside — a situation that brought up the EU’s Cyber Resilience Act as well. The thread split between critics who argued that exposing refrigerators to the internet in the first place was a design flaw, and others who countered that remote access for monitoring things like temperature has real value, sparking a broader debate over how to balance security with operational needs.
Not cool: who hacked France’s supermarket fridges?
It’s a solid article that covers a lot of ground — what technically happened, what software vulnerability was exploited, and how the fridges that got hit were the ones running outdated firmware. It also touches on the EU’s Cyber Resilience Act, which exists to prevent exactly this kind of thing.
Securing industrial systems is going to be a years-long job. A lot of these systems are decades old, and the software and protocols were never designed with security in mind in the first place. The same goes for consumer products like ‘smart home’ devices and ‘smart TVs’ — they’re often built in a way that doesn’t even support the updates they’d need.
Source: en.wikipedia.org / Original article here
What people said
My fellow self-hosting folks ask me every day, 'how do I set up secure remote access?' and the answer is basically always 'don't, if you can avoid it.'
Tell me more about that. I self-host a bunch of stuff myself, and being able to reach it from anywhere is half the fun. With proper encryption, and mTLS if you can manage it, I don't think it's that hard to keep secure and well-managed.
I was going to say 'it's for monitoring, so someone can catch rising temperatures or early signs of a breakdown' — but thinking about it more, you don't actually need remote access to the fridge itself for that. A local sensor just reporting back to a server would do the job just fine…
@elvith @bedwyr If the fridge itself has a bunch of sensors and you can read and aggregate that data, you might be able to catch problems before they turn into breakdowns. But leaving that exposed on the open internet is really, REALLY, REALLY dumb.
And this, right here, is exactly what 'IoT' delivers to all of us!!
Yeah, the 's' in 'IoT' stands for 'security' (sarcasm, obviously — the classic joke is that there's no 's' in the word 'IoT,' meaning there's no security either).
@001 @HaraldvonBlauzahn This is a commercial fridge though, so I doubt there's any dedicated app involved.
@HaraldvonBlauzahn The password wasn't literally 'today's date' — it was something generated based on the date.
Background and Key Points of the Discussion
This incident is a textbook example of the kind of risk the EU’s Cyber Resilience Act was designed to address. The law aims to require internet-connected devices to receive security updates and have vulnerabilities patched, but industrial systems that have been in use for decades — like the hacked fridges in this case — were often never designed with security in mind to begin with, and overhauling them takes a long time. What split opinion in the thread was whether remote access itself was even necessary: some argued that read-only remote access would be enough for monitoring things like temperature, while others emphasized the value of being able to remotely intervene when something breaks down. There’s also a correction worth noting — this is commercial equipment used in stores, not a home smart fridge, and there’s no dedicated app involved — a reminder not to conflate consumer IoT problems with commercial infrastructure issues. The point that the password wasn’t literally ‘the date itself’ but something generated from a rule based on the date is also an important clarification for accurately understanding the actual vulnerability.
*This article is excerpted and freely translated by our editorial team from the thread “Not cool: who hacked France’s supermarket fridges?” on the overseas forum Lemmy’s c/europe community. Our site takes responsibility for the translation.
Leave a Reply