Google’s Botnet Takedown Reveals a Bigger Threat to Business APIs

Posted in Commentary with tags on November 4, 2026 by itnerd

Google’s takedown of the XCPE botnet, which reportedly infected more than 1.3 million Android devices, highlights a growing concern beyond compromised consumer devices: how cybercriminals are turning those devices into infrastructure for attacks on businesses.

Google has a blog post here: https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet

Mark Mazur, Field CTO, Approov:

“This takedown really highlights the dangerous incentives of monetization behind malware and backdoor exploits. By turning 1.3 million devices into residential proxies, threat actors fuel the exact infrastructure used to attack high-value API endpoints. Because these attacks originate from legitimate consumer IP addresses, standard geo-blocking, ASN blocking and IP reputation filters are practically useless against them.

They are creating infrastructure, largely based on IoT devices, that can power sophisticated credential stuffing and API abuse campaigns.”

Takedowns are nice. But there needs to be sustained action to make sure that these stick. Otherwise they are meaningless.

Leave a comment »

35 business groups urge Congress to renew CISA 2015 for 10 years

Posted in Commentary with tags on November 4, 2026 by itnerd

A coalition of 35 major business and industry associations has urged Congress to extend the Cybersecurity Information Sharing Act of 2015 (CISA 2015) for another 10 years through the fiscal year 2027 National Defense Authorization Act (NDAA).

The November 1 letter, organized by Business Roundtable, was signed by organizations representing banking, healthcare, energy, telecommunications, manufacturing and other critical infrastructure sectors.

CISA 2015 provides legal protections that encourage companies to voluntarily share cyber threat intelligence with one another and the federal government. The law’s current temporary extension expires December 11.

The coalition warned that AI-enabled cyberattacks are accelerating vulnerability discovery and exploitation, making rapid threat intelligence sharing increasingly important.ㅤ

Industry groups argue that allowing the law to lapse could discourage companies from sharing critical cybersecurity information.

ㅤDarin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security

“I’ve often seen organizations where fraud teams are investigating losses measured in the millions, while other teams within the same company understand threats such as subdomain takeovers, digital impersonation, and synthetic identity abuse. Both groups have valuable knowledge, but they speak different languages. One sees financial losses and suspicious transactions; the other sees technical indicators, infrastructure, and attack paths. Sometimes the intelligence needed to understand a larger problem is already inside the organization. We simply haven’t connected it.

“That brings me to artificial intelligence and the wisdom of crowds. Independent perspectives can produce better judgments than isolated observations, particularly when those perspectives contribute different expertise. AI gives us an opportunity to translate between disciplines, correlate observations, and recognize patterns at a scale we could never manage manually.

“But collective intelligence is not automatically collective wisdom. Ten systems repeating the same incorrect assumption do not constitute ten independent confirmations. We need diversity of information, evidence, context, and independent verification.

“Now imagine extending that cooperation across financial institutions, healthcare organizations, critical infrastructure, and government. The discussion surrounding CISA 2015 is about more than legal protections. It raises a larger question about how we share intelligence responsibly and turn fragmented observations into actionable defense.

“NIST SP 800-150 provides useful guidance for building those relationships. Technical mechanisms such as STIX, TAXII, MISP, and TLP help address different aspects of information exchange, but standards alone cannot resolve differences in understanding. AI may help us connect the dots. Good governance, privacy safeguards, and independent validation help ensure we’re connecting the right ones.

“And that is where bringing together different domains of expertise can uncover hidden knowledge, revealing connections and patterns that no single discipline could recognize on its own.

“The greatest intelligence failure may not be what we don’t know, but what we collectively known and fail to understand together.”

ㅤ

John Strand, Owner, Black Hills Information Security

“The only way we survive in computer security is by sharing information. This program gives us a way to do exactly that. I’m absolutely ecstatic that it’s being renewed and moving forward. Information sharing is key.”

ㅤWhile it would be very nice to have the CISA renewed, organizations need to chart their own course. Because you cannot depend on a third party to defend you.

Leave a comment »

UK warns AI-powered ransomware will likely target critical infrastructure by 2028

Posted in Commentary with tags on November 4, 2026 by itnerd

The UK’s National Cyber Security Centre (NCSC) has warned that AI-powered malware is highly likely to be used in a ransomware attack against the country’s critical national infrastructure by 2028.

The assessment, published in its 2026 Annual Review, identifies growing risks to essential services as cybercriminals and state-backed attackers increasingly incorporate artificial intelligence into their operations.

The NCSC said AI is accelerating reconnaissance, social engineering, vulnerability discovery and exploit development, allowing attackers to operate at greater speed and scale. It warned that AI-assisted vulnerability discovery could enable attackers to exploit weaknesses before organizations deploy patches.

The annual review recorded 1,831 reported cyberattacks between September 2025 and August 2026, including 337 incidents requiring NCSC assistance and 80 classified as nationally significant.

The agency emphasized that most successful compromises still exploit familiar weaknesses, including unpatched vulnerabilities, stolen credentials and social engineering, while AI is making those existing techniques more efficient.

ㅤDarin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security

“The NCSC’s warning isn’t that ransomware has suddenly developed a mind of its own. It’s that AI is making familiar attack methods faster, more scalable, and potentially more accessible. An attacker doesn’t need to invent a new vulnerability when existing weaknesses, stolen credentials, and poorly understood trust relationships still provide opportunities.

“For critical infrastructure, the concern goes beyond compromised systems. It’s the potential disruption of services that communities depend on every day. I’ve spent much of my career examining the difference between controls organizations believe are protecting them and what those controls withstand when tested. AI could make that gap increasingly consequential.

“We should be careful not to confuse AI-assisted attacks with fully autonomous threats. We should also recognize that AI offers defenders opportunities to discover vulnerabilities, correlate evidence, and prioritize remediation. But capability is different from verification. An AI system reporting that a vulnerability has been fixed is not proof that the attack path has been eliminated.

“The challenge is to use automation to continuously test our assumptions, independently validate outcomes, and strengthen our ability to contain and recover from disruption.

“The question isn’t whether attackers will get faster. It’s whether we can make verified resilience move faster than the threats we’re preparing to face.”

ㅤ

John Strand, Owner, Black Hills Information Security

“More and more organizations are sounding the alarm about AI-powered attacks, and I cannot help but feel we’re being caught flat-footed. A lot of organizations have discussed these attacks as some nebulous problem for the future. For many governments and organizations, that problem is here right now. And it’s only escalating.

“We have no time to waste. Every organization needs to reduce its external attack surface and use deception wherever possible to create tripwires for attackers. Those steps need to happen now as we prepare for the next wave of AI-powered attacks.”

ㅤ

Jacob Krell, Senior Director, Secure AI Solutions & Cybersecurity, Suzu Labs

“The UK’s National Cyber Security Centre (NCSC) put a date on it. Its 2026 Annual Review assesses it as highly likely that AI-powered malware will feature in a ransomware attack on UK critical national infrastructure (CNI) by 2028. Last week’s funding announcement, £60 million for Cyber Shield and £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre, points at discovery. Discovery was never the hard part.

“CNI runs under-patched and under-tested for a rational reason, a patch that bricks a controller at a water treatment works is a service outage, so operators defer. Every operational technology (OT) engineer I’ve met wants to patch. AI-assisted discovery is compressing the window between a published bug and a working exploit, and the people who can safely test those systems, the ones who know which pumps tolerate a five-minute stop, rarely come at public sector pay.

“The same availability fear is what ransomware monetizes. Immutable backups, copies an attacker cannot alter or delete, turn a total-loss event into a recovery exercise. The Cyber Security and Resilience Bill should make them a requirement for CNI operators.”

ㅤ

Joshua Marpet, Senior Product Security Consultant, Finite State

“While much critical infrastructure is primarily a nation-state target, much of it is also a target for commercial cybercrime.

“As AI tokens are still fairly inexpensive, and even a small inference infrastructure can create phishing emails that pluck heartstrings or push a false sense of urgency, it’s relatively trivial to build that route into a company or agency. Once you build the way in, getting someone to click a malicious link is pretty easy.

“This is not “huge ai writes incredibly complex formerly unseen zero-day vulnerability!!!”. This is “tiny AI writes an email to elicit an emotional reaction of sorrow, pity, or urgency”.

“So rather than spending $10k to build a new zero day, I can spend 20 minutes to write an email and some shell code. For free. From hugging face or evilgpt.

“But if you feel the need to build some revolutionary malware, you can always spend about 120k and build your own high end ai infrastructure, with a free Chinese model such as Kimi, Qwen, or deepseek. 120k?!?? One or two good hits on the ransomware, and you’ll make your money back.

“Either way, it’s relatively simple to use AI to find vulnerabilities, or to build phishing emails to deploy malware.

AI is going to be a big problem for you right now. The question is will you answer the call and defend your organization against AI?

ㅤ

“So a warning it may happen? No, I’m sorry. It’s already happening. The horse has left the barn.”

ㅤ

Leave a comment »

Report finds billions of IoT security threats across 10.4 million homes

Posted in Commentary with tags , on November 4, 2026 by itnerd

A new 2026 IoT Security Landscape Report from Bitdefender and NETGEAR analyzed 5.4 billion security events across approximately 10.4 million connected homes, finding that smart TVs, smart plugs and network storage devices account for 67.1% of observed device vulnerabilities.

The average household now has 24 connected devices, up from 22 last year.

Researchers found that 90.1% of detected attack activity involved reconnaissance, as automated tools scanned networks for vulnerable devices. Smart TVs accounted for 22.7% of vulnerability observations, followed by smart plugs (22.4%) and network-attached storage (22%).

The report also found that 99.97% of observed device vulnerabilities involved publicly documented CVEs.

Researchers warned that compromised IoT devices can serve as proxies for malicious traffic, collect sensitive information or provide attackers with access to other devices on home networks.

Denis Calderone, Principal / CTO, Suzu Labs:

“I like how the Bitdefender report reframes devices as proxies, sensors, and footholds, and not just targets. The old question was whether your smart TV could get hacked. The better question is what an attacker can do with the trust, bandwidth, and sensors attached to it. Your television is always on, always connected, and holds a trusted residential IP address, that helps to support an underground economy that is increasingly renting out residential infrastructure for a fee.

“The enterprise CISO has to rethink the network perimeter now. When employees work from home, corporate devices and traffic are now on the same network as the smart plug that no one has, or ever will, patch and a TV that’s already in the business of watching you. Automatic content recognition software samples what you watch and feeds it to advertisers, and researchers this year found proxy SDKs bundled into free TV apps that rent out your home IP address to third parties. The average home now has 24 connected devices, most with little device update support, if any. Smart TVs alone accounted for 270 million vulnerability observations in this report.

“If you’re reading this, the prescription is straightforward enough. Update your router firmware, change default admin credentials, turn off UPnP, enable whatever built-in security features your edge device offers, and put IoT devices on a guest network. But let’s be honest. Most home users are never going to do any of that. They’re not reading cybersecurity trade press, and they’re not logging into a router admin panel on a Saturday afternoon. The burden has to shift to two places. First, the ISPs. They manage the edge device in most deployments, and they should be shipping routers with security enabled by default, auto-updating firmware, and alerting customers when a device on their network starts behaving like a proxy node. Second, enterprise security training. This is a threat that many users and CISOs have not yet aligned on, and if your awareness program doesn’t cover home network hygiene for remote workers, you’re leaving the perimeter undefended. The consumer shouldn’t have to be the security operations center for their own house, but right now nobody else is doing it for them.”

ㅤ

John Strand, Owner, Black Hills Information Security:

“This article looks at the attack surface for home IoT devices. I really feel like we need a similar study for small to medium sized businesses. I think we’d see much the same spread of vulnerabilities across those devices.

“One thing that concerns me is the immense variety of IP cameras and security systems in these businesses. They get installed, almost become part of the building, and then they’re there forever.

“This is definitely eye opening. But I think the broader context matters. Home IoT is just one slice of the problem, and I suspect a similar study of business devices would tell a very familiar story.”

I am getting ready to do an inventory of all my smart devices and lock down anything and everything from speaking to the outside world unless they have a pressing need to do so.

Leave a comment »

Why Canadians Carry the Cost of Fraud

Posted in Commentary with tags on November 3, 2026 by itnerd

Canada’s biggest banks and telecom companies recently launched the Cross-Sector Anti-Fraud Exchange (CSAFE), a coalition to share confirmed fraud intelligence and reduce repeat scams. The same week, a UK scam victim recovered nearly $21,000 from her bank, while a Toronto resident hit by a nearly identical phone-and-courier scam received nothing. The article notes Canadian banks have no obligation to reimburse clients.

Together, the two stories raise a question for Canadian readers: if the money is rarely recovered after a scam, how well is fraud being stopped before it happens?

  • The coalition is a step forward in how banks and telcos work together, but it shares intelligence after fraud is confirmed. It does not by itself change how a customer’s identity, card or device is verified at the moment a scammer calls.
  • The Canadian Anti-Fraud Centre reports that Canadians lost about $351 million to fraud in the first half of 2026, and it estimates only 5% to 10% of fraud is reported. Bank investigator fraud, where scammers pose as bank staff, is among the top five categories by reported loss. It is the same scam pattern described in the UK-Canada comparison.
  • Banks and customers in Canada carry the risk differently from the UK. Prevention at the card, device and authentication layer therefore matters more, including stronger verification, fraud detection and secure payment technology.

Fraud prevention is a personal passion of mine. Therefore I encourage you all to read this and take action with your friends and family.

Leave a comment »

Fake LinkedIn Job Interview Leads to Binance Hack

Posted in Commentary with tags on November 3, 2026 by itnerd

Binance just confirmed attackers used LinkedIn to pose as recruiters, conduct fake interviews and send a malicious coding assignment to a Binance engineer’s work laptop – ultimately gaining access to systems tied to the company’s wallets. Commentary from Fortra cybersecurity experts below on the risks of using corporate devices for external assessments, controls around downloads, execution and permissions, and how one compromised developer environment can expose sensitive financial infrastructure.

.Gina Cardelli, Director of Platform and Threat Intelligence at Fortra

“My questions would be around the security controls surrounding that employee’s environments. An engineer seeking a new job downloaded a malicious coding assignment, giving attackers a foothold in a campaign that ultimately gained access to the company’s wallets. While using a work computer for an external coding assessment warrants its own scrutiny, the larger concern is how that compromise enabled access to other systems and sensitive financial infrastructure.”

Tyler Reguly, Associate Director, Security R&D at Fortra

“It has long been said that the cost of hiring a new employee is significantly higher than paying to retain an existing employee. It seems to for Binance, that cost was astronomically higher. In a world where quiet quitting exists, it should come as no surprise that employees are interviewing on company time. Organizations need to counter this with adequate controls in place. Particularly, controls around what can be downloaded and executed on a corporate laptop, as well as the permissions granted to the user. At the end of the day, Developer laptops are among the hardest devices in an organization to look down safely without being detrimental… organizations need to find the balance point.”

Rohan Gupta, CEO & Co-founder, Diopter

“Binance deserves credit for publishing a detailed timeline this quickly. The key moment came in Sep, when an engineer met on video with the CEO of a company that didn’t exist, trusted what he saw, and ran the code he was given. Everything technical that followed depended on that one conversation going the attacker’s way.

When Binance caught a tampered AI tool in Jun, it replaced the device and changed credentials, but new credentials couldn’t erase what the attacker had already learned about who was on the wallet team. Once attackers know who holds the keys, they often go after those people directly, and a recruiter’s pitch is one of the few approaches a target is likely to welcome without suspicion.

Expect more fake hiring processes aimed at engineers with privileged access, complete with fake executives on video calls. Security teams should treat recruiting outreach to those engineers as part of the attack surface and keep interview code off any machine near production. They should also confirm who’s on the other end of a video call before anyone acts on what was said. Binance says it’s increasing its investment in AI-enabled detection, and that detection has to run during the live conversation, before anything gets downloaded.”

The more that is learned about the Binance hack, the scarier it is. This should be required reading as clearly there’s lessons for everyone.

Leave a comment »

Critical Linux Flaw Exposes a Bigger Blind Spot in Connected Device Security

Posted in Commentary with tags on November 3, 2026 by itnerd

If you run Linux, you might want to pay attention to CVE-2026-98432. This is a critical Linux vulnerability that could allow remote attackers to take control of affected systems, is raising an important question for manufacturers of connected devices and industrial equipment: How do you protect products when you don’t necessarily know what’s running inside them?

Joshua Marpet, Sr. Product Security Consultant, Finite State:

“This is a significantly bad problem. This is a problem effectively anybody could take control of a Linux system that’s affected by this. And of course, that’s horribly bad.

“Assume a system which is taking readings from a power plant. Now you can’t trust those readings. And you may not even know that.

“Assume a system that controls a power plant. Now that system could be under hostile control. And you may not even know that you’re vulnerable.

“Because unless a manufacturer is tracking all of the code that they’ve ever written, and all of the versions of the firmware that they’ve ever written, with proper software bills of materials (SBOMs), and proper cryptographic bills of materials (CBOMs), and they’re tracking all of the potential threats and vulnerabilities (threat intelligence), they may never hear about the vulnerability, and they may never be able to tie the vulnerability to an older version of firmware that 100s of clients may still be running.

“And remember a manufacturer doesn’t really get paid to do all of these things with SBOMs and CBOMs and threat intelligence. They get paid to sell devices.

“So a lot of manufacturers never set these systems up to alert them to these problems.

“And realize there’s also a scale issue here. There’s a lot of manufacturers that have 50 people 100 people 150 people. There’s a lot of manufacturers that are still effectively small to medium business.  They may not even understand that they need to have threat intelligence, SBOMs, CBOMs. They may have no way to track which version of firmware clients are using to make sure that they’re updated properly.

“That’s just one side of this.

“Now let’s talk about the Linux side. Since this is a networking bug, Ubuntu hasn’t even decided to fix it. Last I checked, they hadn’t planned to.

“So now you’ve got something that is a bug in an underlying piece of software, the operating system. This isn’t in the application that company XYZ wrote to run on top of it. Are they even tracking that?

“This is a huge bug and vulnerability that’s falling through the cracks. This is a monstrous threat in an industry where threat in intelligence is not universally deployed. Or even close.

“Whose responsibility is it? If this was a cloud environment, there’s a shared responsibility model that clearly lays that out.  With connected devices oftentimes that’s not elucidated properly.

This is one where some people can patch their way out of this. But other people who run Linux who do not know that they run Linux, this is a real problem. And one that relies on the vendors to do the right thing. If they care.

Leave a comment »

Outpost24 Research Finds Infostealer Malware Affected 72% of Organizations With Exposed Credentials

Posted in Commentary with tags on November 3, 2026 by itnerd

Outpost24 today released its 2026 Credential Exposure Benchmark Report. Its researchers analyzed 31.5 million unique exposed credentials linked to 4,824 organizations across five industries in the United States and Europe, first detected between September 1, 2025, and September 1, 2026. The report finds that 72% of those organizations had staff or customer credentials identified in infostealer malware logs during that period.

Around 30.7 million of the credentials, roughly 97%, came from breach dumps and combolists, large collections of leaked logins that criminals compile and share. The remaining 844,000, under 3%, were stolen from infected devices by infostealer malware and are far more likely to reflect recent theft. Of the organizations analyzed, 41% had at least one infostealer-sourced credential on a staff email address, suggesting malware on a device used for work. A further 31% had malware-stolen credentials only on customer accounts.

The research found that exposure varies far more by industry than by location. Consumer Goods and Services had the most exposed credentials, 498 at the typical organization, almost all belonging to customers. Business Services ranked fourth on total credentials but first on staff exposure, with 47% of organizations holding a malware-stolen staff credential. Financial Services had the highest share of organizations with at least one infostealer-sourced credential, at 77%.

The typical European organization had 22% more exposed credentials than its US counterpart, 224 compared with 184. The share stolen by malware was similar in both.

Of the six European regions, the Nordics had the highest exposure, with 358 credentials at the typical organization, and the most credentials stolen by infostealers. The UK and Ireland had the highest share stolen by malware, at 2.7%. Spain had the lowest exposure, at 133 credentials at the typical organization. The highest combination of industry and region in Europe was Consumer Goods and Services in Benelux, at 1,285 credentials for the typical organization.

The report recommends prioritizing credentials stolen by infostealers and investigating the wider compromise, rather than simply resetting the affected password. For staff credentials, security teams should investigate the associated user and device, including whether other passwords or session cookies were stolen, and revoke active sessions. For customer credentials, organizations should secure affected accounts through password resets, additional verification and fraud monitoring.

The report revisits the 2024 campaign against Snowflake customers, in which attackers used stolen credentials to log in to accounts without multi-factor authentication. It also points to Meta, which disclosed in October 2026 that attackers had reached some of its GitHub repositories using a single employee’s stolen credentials.

The full report is available at http://outpost24.com/resources/2026-credential-exposure-benchmark-report/.

Leave a comment »

Hackers use agentic AI to target more than 200 organizations in 11 days

Posted in Commentary with tags on November 3, 2026 by itnerd

Hacking group Vapor Panda used an agentic AI penetration-testing framework called ARTEX to target more than 200 organizations across at least 14 countries in just 11 days, according to new CrowdStrike research.

The campaign began October 17 and targeted government ministries, defense agencies, semiconductor manufacturers, pharmaceutical companies, financial institutions and telecommunications providers.

CrowdStrike confirmed post-exploitation activity at nine organizations and said approximately 70% of targets were confirmed compromised or showed evidence supporting a successful intrusion.

The attackers combined ARTEX with DeepSeek and another commercial large language model to automate reconnaissance, exploit vulnerabilities, steal credentials and move laterally across networks.

CrowdStrike observed activity occurring as frequently as every 10 seconds, with the framework capable of exceeding 1,500 commands per hour compared with approximately 40 commands per hour during traditional human-operated intrusions. Human operators continued directing the AI agents, including instructing them to identify systems without endpoint security software.

John Strand, Owner, Black Hills Information Security

“This is the future. I strongly believe that within the next three months, the type of attack documented by CrowdStrike is going to become the new normal.

“OpenAI models and attack frameworks are readily available. What a lot of people don’t understand is that you can carry out these types of attacks with commodity hardware. You don’t need a massive data center. It might be slower, but it can still be done. And I think threat actors have absolutely started recognizing that.

“Everybody needs to be prepared. Reduce your external attack surface as much as possible, and use deception throughout your environment to establish tripwires. Give yourself a way to detect attackers when they get past your other defenses.”

ㅤ

Ryan McCurdy, Vice President of Marketing, Liquibase

“The speed and scale at which attackers can now operate is unlike anything we’ve seen before.

“A single operator can direct AI agents to execute more than 1,500 commands an hour, targeting multiple organizations at once. That’s a very different threat environment than what most security teams were built to handle.

“Companies have spent years building security processes that depend on people reviewing activity, identifying risks, and intervening when something goes wrong. Those processes weren’t designed for machines operating at this speed.

“And the challenge isn’t limited to attackers. As companies give AI agents more responsibility across software development and IT operations, they need to rethink where and how controls are enforced.

“Human oversight will still be important, but it can’t be the only line of defense. Organizations need policies that are enforced automatically, before an agent can make a change that puts critical systems at risk.”

ㅤI don’t know how many times I will say this. But if you aren’t defending against AI, you are screwed.

Leave a comment »

More Fridges Pwned In Cybereattack

Posted in Commentary with tags on November 3, 2026 by itnerd

I recently posted this story on French commercial fridges being hacked. Consider that your two minute warning because if you didn’t heed it, it’s now going to get worse for you. A lot worse:

A hacking attack on European supermarkets spread across the continent on Monday, hitting fridges and freezers from Sweden to Belgium and forcing stores to throw away food in an incident that echoed a similar ‌attack in France last month.

The attack, which raised temperatures in refrigerator and freezer units at dozens of stores, hit supermarket groups Ahold Delhaize and Colruyt in Belgium and Luxembourg, as well as Swedish grocers ICA and Coop. Furniture-to-meatballs retailer Ikea also saw at least one store affected.

“Everything is destroyed,” Engla Ingwall, sales manager at an ICA franchise store in Stockholm, told Reuters during a visit to the store on Monday, adding the attack occurred at 2 a.m., but was only noticed hours later.

“There has been a cyberattack and all our freezers reached 50 degrees [Celsius].”

A ​spokesperson for privately held ICA said the company was aware that a “limited number of stores were affected by ​an incident overnight, which impacted their refrigeration and freezer systems.”

Face it. Commercial fridges are critical infrastructure. Thus they need to be treated as such. Because clearly they are targets of threat actors. Now this could be teens, or they could be nation states. Who knows? Who cares? The fact is that these devices should not be Internet exposed. Which would make them inaccessible to threat actors. And there is a limited amount of time to fix this because clearly this problem is getting worse and not better.

UPDATE: Commentary has come in. Starting with Waseem Ahmed, Head of Engineering, Secure.com

“If these are cyber-attacks, as suspected, the common thread looks like remotely reachable controllers, not a fridge fault. French authorities named specific refrigeration controllers, researchers found thousands reachable from the internet, and one expert said many ran default passwords. Some older models no longer get security updates. The latest wave is still being confirmed, so I wouldn’t point at one vendor or one flaw today.

“Three checks to run before the week ends. #1 – List every controller your stores run, with model and firmware. #2 – Pull the management screens off the public internet and put remote access behind a VPN. #3 – Change every shared password, including the ones your refrigeration contractor uses.

“Then add temperature alarms that don’t depend on the controller being alarmed, because attackers in France reportedly lengthened defrost cycles and delayed the warnings.

“Food safety now sits on gap that nobody on the security team owns. That gap is the real story, and it is fixable.”

ㅤ

Joshua Marpet, Senior Product Security Consultant, Finite State

“In the wake of at least two waves of successful attacks against the infrastructure supporting food distribution, we have to assume that there will be others.

“That being said, this is not a moment to panic. This is a moment to reassess. And a moment to prepare. This is the moment we examine all of the devices in our infrastructure and determine which we prioritize as essential or not. This is the moment we insist that the suppliers of those essential connected devices supply us with software bills of materials, and cryptographic bills of materials at the very least.

“If you’re in a critical infrastructure industry, this is the moment that determines whether you’re on the front page of the Wall Street Journal for all the wrong reasons.

“How are you validating and verifying that every connected device in your infrastructure has been made as safe as you can get it? I’m not saying 100% safe. There’s no such thing. But after the French attack on refrigeration cases, why didn’t the parent companies of the supermarkets in Sweden in Belgium and everywhere else, not examine their systems?

“Putting our heads in the sand is no longer a viable strategy.

“Either follow the European Union cyber resilience act and get the manufacturer of your devices to handle the testing and the assurance, or contract with a third-party to make sure the devices you’re using are the right ones.”

ㅤ

Damon Small, Board Member, Xcape, Inc.

“Supermarkets across several European countries are experiencing widespread refrigeration system disruptions following another wave of suspected cyberattacks. Stores in Sweden, Belgium, Luxembourg and Ireland have reported sudden increases in refrigerator and freezer temperatures, resulting in significant food losses and temporary closures.

“These incidents highlight a fundamental cybersecurity principle: just because something can be connected to the Internet doesn’t mean it should be. Commercial refrigeration systems must be protected with the same diligence as any other operational technology (OT). Remote access, where necessary, should be restricted to secure connections such as VPNs and protected by strong identification and authentication mechanisms.

“More importantly, this is not the first wave of these attacks, and it certainly won’t be the last. Manufacturers and operators of these systems should act immediately to review their security configurations, restrict unnecessary Internet exposure and strengthen access controls. Waiting for another incident is not an acceptable security strategy. There will be another round, and the consequences could be even more significant.”

ㅤ

John Strand, Owner, Black Hills Information Security

“When we look back at 2026 years from now, we’re going to remember it as the year the refrigerator was on fire instead of the dumpster.

“Do we really need refrigerators connected to the internet at all times? Sometimes I think that maybe, just possibly, and I’m just throwing this out there, things might be a little too connected.

“But the real security issue is what happens when you combine IoT and embedded devices with a SaaS provider and centralized management. You have devices that often don’t have EDR or a patching plan, and then you tie them into a portal that can control a whole bunch of them.

“Attackers can go after the individual device, or they can compromise one SaaS portal and potentially gain access to multiple devices. That’s how a problem with one system can turn into widespread disruption.”

Leave a comment »

« Older Entries