Abstract:
According to the "Guardian" report, supermarket refrigerators and freezers in many European countries have recently suffered suspected cyber attacks, and the temperature of some equipment was remotely raised to 50°C. Almost at the same time, Binance, the world's largest cryptocurrency exchange, suffered a $6.3 billion theft, and the Ukrainian emergency alert app was also hacked, sending false nuclear strike warnings to residents of Kiev.
Richard Horne, head of the British National Cyber Security Center (NCSC), warned that AI technology is accelerating the exposure of security vulnerabilities in IT systems, and cyberattacks may enter a new stage that is more frequent.
Last Monday, Alex Pearce, a London fruit and vegetable wholesaler, discovered an abnormality while inspecting the warehouse: the defrost indicator light of No. 2 refrigerated cabinet came on, abnormal readings appeared on the control panel, and the same situation occurred in No. 4 refrigerated cabinet. As he approached the largest refrigerator, its defrost light began to flash.
Pierce unplugged the network cable after discovering abnormal temperature in the refrigerator
Pierce suspected that the equipment had been attacked by a network, so he immediately found the control box connecting the refrigerator to the Internet and unplugged the network cable. Later it was proved that his judgment was correct.
Freezers in a Swedish supermarket were emptied after temperatures reached 50 degrees Celsius
On the same day, retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden also reported similar problems, with the temperature of refrigerators and freezers rising to 50°C (122°F) in some stores. Pierce said if the attack had happened on Saturday morning and he hadn't been there, it could have even ended up causing a fire.
It’s not just retailers who are affected, either. French blood banks have also suffered cyber attacks before.
Three major cyber attacks occurred within a few days
The Guardian pointed out that the attack on European refrigeration equipment was only one of three major cybersecurity incidents that occurred within a few days.
On October 30, $6.3 billion (approximately 4.7 billion pounds) was stolen from Binance, the world’s largest cryptocurrency exchange, setting a record for major thefts in the cryptocurrency field. On November 1, hackers targeted the Ukrainian emergency alert application and sent false nuclear strike warnings to residents of Kiev.
Hackers targeted Ukraine’s emergency alert app this month, sending alerts to people in Kiev
Horn, head of the British National Cyber Security Center, said that the world is currently in the "foothills" stage of a new round of cyber attacks. He believes that AI technology is exposing long-standing flaws in a large number of IT systems, and these vulnerabilities may be exploited by attackers at any time.
He pointed out that the most serious risk in the short term is a significant increase in the number of cybersecurity incidents. Judging from the events of the past few months, this trend is already beginning to emerge.
Last month, OpenAI’s AI technology helped discover a vulnerability in the computer language PHP. Due to concerns about the vulnerability being exploited, some websites around the world took precautionary measures and temporarily went offline. Previously, French supermarket refrigeration equipment was also attacked. The Guardian believes that this may be a preview of this round of larger-scale attacks.
AI accelerates the exposure of vulnerabilities, and the risk of network attacks increases
Tech entrepreneur and commentator Azeem Azhar believes that the ability of AI models to find cybersecurity vulnerabilities is changing the risks faced by the industry. Matthew Prince, CEO of cybersecurity company Cloudflare, also warned last month that worrying new incidents may occur frequently in the cybersecurity field in the next few years.
However, industry insiders have different views on the severity of the current threat.
Ciaran Martin, the first CEO of the British National Cyber Security Center, believes that although the current network security situation is severe, it is not without precedent. He mentioned the NotPetya and WannaCry cyberattacks in 2017, as well as the surge in the number of ransomware attacks in 2021.
“This is a bad time, but it’s not unprecedented. What we’re experiencing is a wave of events that happens every few years,” Martin said.
AI is indeed changing the offensive and defensive capabilities in the field of network security. The Guardian reported that since the release of the Mythos model by AI startup Anthropic in April this year, the number of IT system vulnerabilities discovered by leading technology companies has increased eight times. AI models can help researchers identify software flaws faster, and may also make it easier for attackers to find breakthroughs.
However, the surge in the number of discovered vulnerabilities does not mean that actual attacks are increasing simultaneously.
Cybersecurity expert Tal Be’ery pointed out that the surge in the number of vulnerabilities has not yet been observed to directly translate into a significant increase in intrusions. He believes it may still be difficult for criminals to profit from these newly discovered vulnerabilities, and the recent decline in revenue from ransomware attacks also provides some evidence.
In fact, this reefer attack did not require particularly advanced AI technology. Paul Chichester, director of operations at the UK's National Cyber Security Center, said attackers "simply don't need" to use AI to find these vulnerabilities because problems with some equipment have long been publicized, including default access passwords published by some cold storage equipment operators in product manuals.
Network security company Sophos also stated that although it has observed a large number of attempts to exploit PHP vulnerabilities, it has not yet discovered any major security incidents caused by this among its customers.
From supermarket freezers to home routers, Internet-connected devices may become entry points
Another problem exposed by this attack is the long-term lack of security maintenance on a large number of networked devices.
The Guardian stated that hackers mainly target companies that provide operating systems for commercial refrigeration equipment. They use the characteristics of these systems to connect to the Internet to remotely enter end-user devices.
One of the affected system suppliers, the Danish company Danfoss, said that most of the affected equipment is older and no longer receives security updates. The company has long advised customers to install software updates or replace outdated systems.
NCSC pointed out that these incidents remind people that everyday Internet-connected devices, from smart speakers to broadband routers, can become entry points for cyber attacks.
NCSC chief technology officer Ollie Whitehouse said there was a clear risk of attacks on such devices. Manufacturers need to invest more resources in product security, and consumers need to be willing to pay for more secure products and install software updates in a timely manner.
One of the prominent issues is security maintenance after the product life cycle. Although some devices are still in normal use, manufacturers have stopped production and no longer provide software updates to fix vulnerabilities, resulting in long-term security risks.
Pearce said he now realizes that the refrigerated cabinet monitoring system he installed in 2018, supplied by US company Copeland, also needs to be updated.
"Have we learned our lesson? Yes. There is a vulnerability here that we probably should have been aware of, but fortunately, the impact on us was not severe," he said.
The gray area of geopolitics and cyberattacks
In addition to technical vulnerabilities, geopolitical factors have also made European countries more worried about cybersecurity risks.
The Guardian pointed out that there may be different types of actors behind several recent attacks: the Binance theft was attributed to North Korea, and the attack on the Ukrainian alert application made Russia the subject of suspicion. As for the European refrigeration equipment attack, there is no clear conclusion yet.
Xavier Bellekens, CEO of cybersecurity company Lupovis, said that his team had set up "honeypot" traps that simulated the controllers of refrigerated equipment and observed that some attackers used Internet service providers with looser regulations on malicious activities. This tactic bears similarities to some previous malicious cyber activity thought to be linked to Russia.
"Are we sure they are a Russian organization? No. But there are some signs pointing in that direction," he said.
The situation in Finland also reflects the cybersecurity pressures facing Europe.
The border between Finland and Russia is 1,340 kilometers long. Since the outbreak of the Russia-Ukraine conflict in 2022, the country has experienced an increasing number of cyber attacks. Finland’s National Cyber Security Center recorded nearly 21,000 cybersecurity incidents last year, while the number will be around 13,000 in 2022. According to reports, hackers also invaded as many as 50,000 Finnish government mobile phones this year, and last year paralyzed the website of the Finnish Ministry of Defense.
However, cybersecurity experts also caution that all cyber attacks should not be attributed to state actors. There is a huge cybercrime ecosystem around the world. Some hackers act for financial gain, some for political purposes, and some have varying degrees of connections with countries such as Russia and Iran. This relationship is often unclear, which also increases the difficulty of tracing the source of the attack.
Faced with increasing cyber threats, the British government launched the "Be Ready" campaign last month, recommending that people stock up on enough food for three days and up to 9 liters of bottled water to deal with weather, network or other major emergencies. British Defense Secretary Wes Streeting said the country needed to prepare for the threat of "state-sponsored terrorism" targeting everyday infrastructure.
But cyberattacks don’t necessarily mean long-term damage to infrastructure.
The Guardian pointed out that unlike physical attacks such as bombing power stations, some of the damage caused by cyber attacks can be resolved through software updates, patching vulnerabilities, or directly disconnecting equipment from the network. While a physical attack can knock out a power grid for months or longer, a cyber attack may not have the same level of lasting impact.
Some officials believe that for state actors, the purpose of cyber attacks may be more to create social panic. Turning a supermarket freezer into a heating device or hacking into a blood bank may not cause long-term damage, but it is enough to raise public concerns about the security of everyday infrastructure.
At present, the relevant vulnerabilities may have been patched, but there are still a large number of old equipment and legacy systems with security risks.
Pierce said he has not yet reconnected the Internet connection to the refrigeration unit, but his business has not been otherwise affected. Even though similar attacks had occurred in French supermarkets before, he did not expect that his company would become the next target.
“Hacking to cause chaos is a difficult concept for most people to understand,” he said.
Comments