Mattmatt303@cyberplace.social
Nov 2, 2026, 1:38 PMThe first question in cyber security should be "does this thing need to be smart?"
Replies
GaryWiteWulf@cyberplace.socialNov 2, 2026, 1:51 PM@matt303 well, I mean….define “smart”. There’s a clear difference between smart and “remote managed/monitored”, which is what I believe these are.
The problem here is mgmt interfaces exposed to the internet with default credentials.
- Mattmatt303@cyberplace.socialNov 2, 2026, 2:02 PM
@WiteWulf I mean with remote management, they could have made these so they send data back but any adjustments needed making locally, then your attack surface is down to a physical access attack. Does the cost saving of being able to turn your freezers off or adjust the temp remotely out weigh the cost of making sure they run on a secure private network that's constantly maintained. I imagine a lot of uses of this kit have pulled network cables out at the moment.
JdeBPJdeBPNov 2, 2026, 2:46 PMThey could have made them communicate securely. The previous incident, which was #Danfoss machines, this one being #Sabcobel machines, was apparently the supermarkets ignoring the manufacturer's instructions in this regard. When it hit Hacker News, people there went and dug up the instructions.
They're probably going to get that far again. They're already busy dissecting the use of consumer-grade routers/gateways and it has only been an hour.
- GaryWiteWulf@cyberplace.socialNov 2, 2026, 3:02 PM
@JdeBP @matt303 yes, the equipment could have been made more secure, but that involves dev time and, typically more powerful/expensive components. The vendors never expect these class of devices to be connected to adversarial networks, but the people who buy them often insist on doing so, because secure, segrated networks are complex and expensive.
It’s six of one and half a dozen of the other 🤷♂️