<!–
–>
This week, supermarket refrigerators in at least 10 European countries were hit by a series of cyberattacks that led to spiking temperatures and ruined food, with losses running into hundreds of thousands of euros.
The attack came on the heels of one in France and the Netherlands in October, when several hundred stores were hit in similar fashion.
Together, the two attacks on internet-connected devices were a vivid sign that Europe’s not prepared for the rising levels of cyberattacks coming its way. But that doesn’t mean more regulation is the answer.
In an interview with The Parliament, Sven Herpig, lead cybersecurity and emerging threats advisor at the European tech think tank Interface, said that the attacks showed that the European Union and member states needed to double down on enforcing existing cybersecurity laws and to ensure that fundamental IT security steps were taken by companies and critical infrastructure providers across the bloc.
What vulnerability did the hackers exploit?
In simple terms, the main problem was that the refrigerators were connected directly to the internet. One of the main attack vectors was that the credentials, so the username and the password, were known to the attackers. It’s a standard username that is standardized across the devices. It was easily guessable, which means it was exploitable at scale over the internet remotely.
At the other end was sitting a device which interacts with the physical world, which of course caused physical impact. That is almost as bad as it gets when we are talking about these kinds of cyberattack operations.
Why was Europe not better prepared?
I think we have enough regulation covering cybersecurity in Europe right now. We should step forward in our implementation efforts, and that’s the problem we’re seeing here. Every best practice that you see and guideline for the protection of critical infrastructures was not followed by whoever was operating these refrigeration systems. These are basic security practices that we have known for 10 or 20 years.
For the second wave this month, I have absolutely zero understanding of why there are still these devices on the internet in a non-secured manner. Everyone who’s running or operating these devices in any supermarket should have asked after the first wave, ‘Are we running these systems? I’ve seen this in the news. Did we do something about it?’ I don’t think there’s any excuse for whoever got hit in the second wave.
Is AI supercharging these kinds of attacks?
Actually, no. This was a super easy attack vector. These devices are connected to the internet with a very weak security mechanism. There’s no need for AI tools to find them. The weakness was credentials and no multi-factor authentication. That’s not a crazy vulnerability or exploit that needs to be created by AI.
But this is still a huge impact story. Whoever operates the systems didn’t do the minimum in IT security. It’s actually the opposite of an AI doomsday story. This is basically an IT security story. Right now, we don’t even need AI to have bad attacks.
Is there similar infrastructure out there that could come under attack?
We’ve seen these kinds of operations targeting Internet of Things devices like smart TVs, refrigerators, ovens, you name it. Everything that you hook up to the internet without adequate security controls is at risk, and most probably has been compromised in the past. We are moving towards digitizing everything that we can digitize, but at the same time, we’re not significantly improving IT security of these devices.
What steps can individuals take to protect Internet of Things devices?
You have to work with the cards that you’re dealt. The only thing individuals can do is run timely updates on these things and replace the devices when they are not updatable anymore. We did change EU regulation in a way with, for example, the Cyber Resilience Act, which will lead to us having better support and more security from the vendors over time. That’s a good step.
Are there policy changes that need to be made here?
We have enough regulation on the EU level. It’s really a matter of enforcing cybersecurity laws and making sure that critical entities, very critical entities, critical infrastructures, everyone subsumed under the existing legislation is actually doing their job in implementing proper IT security standards, and if they fail to do so, that they’re getting fined and punished so that next time they will do it.
Follow the developments shaping Europe
Subscribe to The Continental to receive The Parliament’s latest reporting, analysis and opinion to your inbox, delivered every weekday morning. Sign up for free here.
——————————————————-
Click Here For The Original Source.
