“Why are these systems even on a network? Just disconnect them!”
I see this after every OT attack, usually from smart IT people. As someone who responds to these incidents, I wish it were that easy. I wrote up how we got here, and why water utilities and refrigerators keep getting hit.
https://tisiphone.net/2026/11/08/lets-talk-about-why-all-this-ot-stuff-is-connected/
I hear you and I put mouse-over definitions on all the acronyms.
@hacks4pancakes that's a really interesting insight into the industries. Going from bespoke systems that were inherently expensive to /capitalism/ will make this efficient as a root cause. Add in nearly zero emphasis on IT/security.
Early on in my career, I was told never to blame a person for something negative that happens, instead blame the process that gave rise to it. It seems like that can be applied here too.
@fullywoolly Capitalism is basically the root of all the problems, yes
Nov 9, 2026, 4:06 AM@hacks4pancakes
I mean, "why don't we just" is usually a flag that whatever follows will be months of diligent work, for the whole team, minimum, if it's possible at all
@hacks4pancakes Seems perfectly reasonable for a lot of things to be on A network, or even a few networks. Fine to have them on REDACTED connected to a bigger REDACTED connected to a REDACTED in a REDACTED, routed to a REDACTED mounted to the wall in the REDACTED, connected to a pair of REDACTEDs under a REDACTED in the REDACTED. Would be nice if they didn't need to be on the internet, though.
@frobozz @hacks4pancakes Stuxnet, stuxnet and more stuxnet. An airgap won't save you.
@Heterokromia @hacks4pancakes Thankfully, that network is not my problem, but do you really think someone is going to bother with a stuxnet-style attack on a REDACTED?
@Heterokromia I mean, the only equipment that even slightly resembled centrifuges in that place was the big REDACTED, but those were manually operated. OK, granted, messing with the ladder logic for the REDACTED and REDACTED could probably cause some expensive problems. @hacks4pancakes
@Heterokromia Anyway, my involvement ended with crimping two REDACTED onto a replacement length of REDACTED. @hacks4pancakes
@Heterokromia @hacks4pancakes That's not to say I wouldn't be plenty miffed if my hookup for cheap REDACTED were disrupted.
@Heterokromia @hacks4pancakes Crap, at first, I could have been describing any of thousands of businesses, utilities, or other facilities. Mentioning that it was a REDACTED narrowed it down to maybe 20 REDACTED in the region, and how many of them REDACTED? I guess you get a gold star for social engineering, and I get an embarrassing reminder to shut the fuck up. I even told you what type of REDACTED they use, along with where the REDACTED is located.
@Heterokromia @hacks4pancakes If I were sober, I'd probably have just deleted all this crap, or maybe done the whole of the Fediverse a favor and deleted my account. Again. I'm very much not sober, so I'm leaving this mess in case somebody wants a cautionary tale's worth of screencaps for presentation slides at one of the less fun security conferences, maybe RSAC or Gartner, or something.
@hacks4pancakes Thanks!
@hacks4pancakes amazing explanation, thanks. I knew about the industrial side (my father was a safety lab leader and you couldn't alter *anything* in the factory without his signature and that signature didn't come easy), I didn't consider the same for refrigerators and it makes sense.
@hacks4pancakes I only understand like 30% of the words of this blog posts but I think nowhere in there does it say why a supermarket fridge needs internet. Sooooo
@shellsort "Everyone Wants Access"
@blogwash @shellsort to be specific, food regulations (in multiple) require temperature be maintained at a specific level at all times. I mean, beyond just ... food safety.
Most people with no staff do that via mobile apps.
@hacks4pancakes @blogwash @shellsort If a fire breaks out in a building, an alarm goes off that can be heard for some distance away.
What about a local temperature alarm?
Is there really NO LOCAL STAFF?
Nov 9, 2026, 10:25 AM@hacks4pancakes
The monitoring part is the one I get, and the majority of comments I read acknowledged that this is useful. But why is there no "read-only" mode? Only local staff know what's actually in those fridges so they still have to decide what temperature to set it to. Maybe corporate even dictates that, but if they were to make any changes remotely they'd still have to coordinate with the guys who actually stock the shelves. In cases like that blood bank, that should literally never even happen.
So is it that people just leave their devices at the insecure default of "can do everything, even though we're not using it" or that the manufacturers don't even implement such a thing as "monitoring-only, can only be changed on the local control panel"?
@blogwash @shellsort
@shellsort @hacks4pancakes
Because it is cheaper than to have people roaming the supermarket regularly to check the temperatures.
And they don't want to pay anyone to do it in case they would disconnect the fridges. So they stay connected.
And get owned. Which costs more than to have a bunch of people manually checking the numbers.
#capitalism
@gunstick @hacks4pancakes Why does anyone need to check? Or whats complicated about any of this? I mean maybe I'm oversimplifying, but at home I buy a fridge, plug it in and its consistently cool for 40 years or so. Even if I really wanted to do this I would never think of adding grafana to my fridge.
@hacks4pancakes and it's for exactly this reason that "just" and "simply" have been removed from my technical vocabulary, because it's never simple, nor just.
@hacks4pancakes Not just OT. AD DC backups on accessible storage (to DC) is a huge security screwup but no one is willing to entertain the question that if the person we trust to run the DC put it there, there's probably a good reason, probably something boring about mean time to recover being impossibly tight because you can't do a restore without a functional DC
@hacks4pancakes It seems the situation won’t improve until the cost of NOT improving security outweighs the cost OF improving security. I’m not sure of the mechanism to get there, but I’d think it would start with insurance companies, audits, and board of directors being held responsible for catastrophic situations.
@hacks4pancakes @rubenerd Abusing the people involved in working with this stuff obviously isn't helpful, but I read the post and I didn't see any *good* reasons. I see reasons the situation has become the way it is. But at every step, security has been disregarded. People have spent a long time fucking around, due to the interests of profit, and now they're finding out why all along security experts will have said this is a bad idea. That there are reasons doesn't mean they are good reasons that balance risk and benefit responsibly.
Okay, I read the whole thing and I still don't get what value adding remote (networked) defrost or other cycle settings adds to a refrigerator. Something more complex, okay maybe there's a value in setting a centralized command and control, but fridges were designed to compete with "put on or next a block of ice" and the obvious improvements since then are lighting and a temperature knob
@elithebearded @hacks4pancakes
😬
Actually there is nothing not-remote
Even if you are standing directly in front of the fridge and configure it with your laptop (or another device) it's "remote"
The only way to get "real" local control would be to integrate the control interface (buttons, screens, keyboards) into each fridge.
Apart from being expensive (hardware wise) it would also make support expensive (you need to walk to every fridge), possibly error probe AND add the problem how to (physical) secure the interface
I like buttons and supermarkets have people walking the floor anyway
@elithebearded
Most of which are customers 😬
And the others are not trained to configure fridges either
Customers do shitty things in stores, yes? They can take a gallon of ice cream out and leave it with rotisserie chicken heater and take a hot chicken and put it back with the ice cream.
Most of them don't though
But it still happens regularly enough.
@SuperMoosie @elithebearded
Yes. And following this argument, most people don't attack your systems on the internet neither
15 year old fridges and only just become a problem
@hacks4pancakes folks never really think about OT
Nov 9, 2026, 5:45 AM@hacks4pancakes I have to ask, has food waste dropped in the countries where online fridges became the norm?
Because I suspect the answer is "No".
@hacks4pancakes I’d be interested in where contractual responsibilities lie for these kind of security breaches.
@hacks4pancakes thanks for sharing- valuable insights
@hacks4pancakes an analogy:
Why aren't the admin and monitoring parts of servers and datacenters not air-gapped? Just turn off all ssh access. If you need to monitor or admin your server do it locally from the server room. That would prevent a lot of attack vectors.
@hacks4pancakes I'm really trying to read your probably very insightful article, but it's full of unexplained acronyms I don't know. Would it be possible for you to spell out reach acronym the first time it's mentioned? 🙏🏻
@hacks4pancakes it's strange to see that even experienced people seem to assume that the fridges were directly connected to the Internet....
@hacks4pancakes This nicely explains why I have never wanted a smart home. What it doesn't quite explain is why somebody wanted a smart factory…
Cc @mvidner
Nov 9, 2026, 7:01 AM@hacks4pancakes
I'm a public sector water utility civil engineer and supervisor. I work closely with and rely on my colleagues who maintain our SCADA system (and they rely on me).
This article was useful. Thank you.
Nov 9, 2026, 7:21 AM@hacks4pancakes this article reminds me of those HR emails that say a lot, too much jargon in fact, but they don't ever explain anything.
@hacks4pancakes
"So clever engineers and businesspeople looked at the IT landscape and had an idea. Using Windows computers as human-machine interfaces, and commercial Ethernet to encapsulate serial traffic, would be much cheaper to buy, replace, and train technicians to support. "
And that's were the horror started. 😬
... and still doesn't explain why a system which only has to be monitored, also has remote controls to defrost.
You always need people on site to handle to unload them in such cases. It should at least be confirmed by a button on the refrigerator.
@hacks4pancakes thank u for writing this, it's given me a much better understanding of this issue 💜
Nov 9, 2026, 8:01 AM@hacks4pancakes Honestly, I'm more enraged about the recent MS Paint issue with Paint being exploitable zero-click over network rather than OT connected to the Internet. Yes, the latter has terrible impact, but as you said... there are reasons (despite most of them not being purely technical but "just" monetary/staffing). Unlike with Paint.
@ljrk @hacks4pancakes
What was the paint exploit in the end? The report wasn't super specific and lead me to believe they counted a .bmp on a network share to be what they meant by "over the network"
Nov 9, 2026, 10:41 AM@EndlessMason @hacks4pancakes I mean if the mere existence of the bmp would already result in RCE I'd consider that quite fatal and I doubt MS would've played up that issue, that wouldn't be in their interest. They called it zero click too so I think it's quite severe although I don't know the details. Whatever the case, this kind of vuln should just not exist in Paint, no matter how bad – simply because paint should have this kind of access.
@ljrk @hacks4pancakes
Nearly the whole thing is murky - Is it a packet or a file? Which version has the fix? How do you get the fix? Is this just an ad for an AI vuln fuzzer? How do you get to code execution from an out of bounds read? Who even reported it?
Maybe I'm just not paying the right vuln enrichment group, but the report isn't much more than "CWE-125 out of bounds read, mspaint.exe, CVSS 7.0"
Nov 10, 2026, 5:41 PM@EndlessMason @hacks4pancakes Oh absolutely! I just think, given MS' response history, that they'd take every opportunity to downrate the vuln. So while I'm weary about all that CVE marketing bs r/n, if MS is, themselves, saying that this is *bad* then I tend to believe them ^^'
@ljrk @hacks4pancakes
Yeah! They say it's "bad but hard to reproduce", which seems like both of those things at once
@hacks4pancakes The answer to “why is XYZ a clusterfuck?” is always “because doing it properly would have cost money”.
@hacks4pancakes
What does OT stand for again?
@hacks4pancakes @mitexleo An excellent description of how over-optimisation (to maximise extractive value) leads to extreme fragility.
The cost of replacing mountains of stock will not be accounted for as a consequence of the poor decision-making.
@hacks4pancakes It was a really good read, and I learned a lot. Thank you :)
@hacks4pancakes Thank you for this. As someone with years of experience in IT security and only the most minimal view of OT security, this is an enormously helpful article.
Nov 9, 2026, 9:10 AM@hacks4pancakes cool, thanks. It's a great article, this makes it more accessible.
@hacks4pancakes I am guessing OT is not occupational therapy, in this context :)
@hacks4pancakes Oof, I hope “OT” dies a fast death. It expands to something long-winded that seems to just imply “ops”. But then the expansion is also misleading because what you’re really trying to say is telemetry. I think enough people generally understand “telemetry”, so why not stick with that?