After cyber attacks targeting refrigeration systems at hundreds of supermarkets in France and many European countries, three plasma storage facilities in France continue to be targeted.

According to the Associated Press on November 4, hackers changed the temperature parameters of the cold storage, from the standard level of about -30°C up to 110°C. However, no products or blood units were damaged thanks to the warning system and staff promptly handling it.

On the same day, French bank Crédit Mutuel Arkéa confirmed that it was attacked by hackers, causing about 100 million euros (about 112.7 million USD) to be illegally transferred to other banks, before being converted into cryptocurrency.

The two attacks are currently under investigation and there is no evidence that they are related.

Taking control, silently sabotaging

It is worth noting that hackers do not need to come directly to the facility or damage equipment to cause problems. Instead, they sought to infiltrate the remote control system, which is used to monitor and adjust the operation of refrigeration equipment.

These are systems belonging to the operational technology (OT) group, with connection characteristics of the Internet of Things (IoT).

The danger of attacks targeting OT systems is that the device does not necessarily have to stop working to cause damage. Hackers can silently change control parameters, causing machines to still run but no longer perform their original functions. For example, the cooling system still works but the temperature has been pushed to an inappropriate level, or the defrosting cycle is prolonged, causing the food preservation process to be affected.

Unlike attacks that encrypt data or paralyze servers, this form of intervention can be more difficult to detect if businesses do not regularly check operating parameters.

According to the US National Institute of Standards and Technology (NIST), OT systems have the ability to directly monitor and impact the physical environment, so cybersecurity incidents not only affect data but can also threaten the operation of equipment, production processes and the supply chain.

One reason these systems are easy targets is that many industrial devices were designed before Internet connectivity became widespread.

When businesses deploy remote monitoring and control, devices that only operate within the internal network are connected to external networks.

Without proper controls, the remote management interface can become an entry point for hackers. Some older devices also use outdated software, default passwords, or are no longer provided with security patches by the manufacturer.

In previous supermarket attacks, hackers increased the temperature of the refrigeration system to about 50°C, while also extending the defrosting time from one hour to eight hours. These changes cause the cooling system to operate abnormally, while detecting problems also becomes more difficult and delayed.

Europe tightens protection of Internet connection systems

Before the wave of attacks, the French National Computer Emergency Response Team (CERT-FR) - French National Cyber ​​Security Agency (ANSSI) advised operators not to let cooling controllers come into direct contact with the Internet. Remote access requires a virtual private network (VPN) or protected network.

The agency also recommends that businesses check device configuration, change default passwords, update control software and review operating parameters, especially defrost cycles.

Notably, restoring the device to factory settings does not eliminate the risk. If the security vulnerability persists and the device continues to connect directly to the Internet, hackers can infiltrate again.

At the regional level, the European Union is strengthening coordination between cybersecurity agencies and law enforcement. The European Union Cyber ​​Security Agency (ENISA), the European Commission and Europol jointly monitor the situation, exchange information and support countries in responding to incidents.

Organizations covered by the NIS2 Directive must also implement cybersecurity risk management measures and report serious incidents to competent authorities.

Maximum:

1500 characters There are currently no comments. Be the first to comment