Bonjour/Bonsoir à tous,
Yes, another Easter egg: I have a degree in French! Yet this will be the extent of my linguistic use, not for lack of skill, but to keep the focus on the topic at hand.
France has been in the news for reasons that have little to do with Cybersecurity. News feeds are filled with images and clips of the riots taking place in Paris and multiple French cities. Whilst the instinct may be to stereotype the French as having been rioting since 1789, I am writing to draw attention to something else that has been comparatively buried in the news cycle.
Since launching this publication, I have wanted to dive deeper into cyberattacks: specifically into what happened, how and why it matters to you, me, and the company we keep that defines oui. (I couldn’t resist the pun!)
As an identity security practitioner, of course I will cover why it matters and its long-term importance. However, I also had to write about this for the sole reason of its impact on almost removing the association between the word refrigerator and this canonical moment in television:
And yes, I just used Nene Leakes as a segue to the cyberattacks on French supermarket fridges earlier this month.
What happened
Hackers gained unauthorised access to the software that controls temperatures across refrigeration units and went as far as turning up the temperature to 50 degrees Celsius, affecting over 400 stores, some reporting losses of €200,000.00 in a day and tonnes of food wasted.
How it happened
Whilst investigations are still ongoing by France’s cybersecurity agency ANSSI, the following information has emerged:
IoT - Internet of Things: think of any smart devices (fridges, Alexa, doorbell system, baby monitors, wearables) that connect to the internet. The supermarkets’ cold aisles in question were connected to the internet to allow remote maintenance and alerts for system failures. Unfortunately, that is a vulnerability vector when not adequately protected.
Weak credentials: A cybersecurity specialist identified that some of the freezers were running with default passwords; hackers are known to use brute force, a method of cracking passwords through trial and error. Hence, we should strive to use strong passwords and avoid 12345 or birthdays.
Vulnerability exploitation: System updates exist for a reason, and skipping them is the difference between a hacker being able to break in and failing in their attempts through additional layers to get through - namely, authentication.
What this means for the rest of us
An attack like this is fairly unheard of. Thus, the unprecedented descriptor is accurate. It also illustrates a broader point: cyberattacks are not just data breaches and ransomware; they can also have immediate tangible consequences in our physical world, from healthcare to infrastructure and the systems that keep our food safe.
I have deliberately skipped the Whodunnit question because who knows? What is known is that the economic scale of cybercrime is in the trillions with no signs of slowing down.
Because I am sure that in the workplace you are all up to date with security awareness training, my personal call to action is:
Secure your smart devices - change default passwords, make sure that they have the latest software security updates and disable any unnecessary remote access they don’t need.
Our devices are not only an extension of our identity, but an identity of their own, with access and privileges that need protecting.
Adieu for now!