Hacked refrigerators, a false nuclear alert and a $6 billion theft

Refrigeration systems hacked in European stores, a false nuclear strike alert in Kyiv and the theft of $6.3 billion from the Binance crypto exchange: three major incidents happened within days of each other. Richard Horne, head of the UK’s National Cyber Security Centre, warns that AI helps find vulnerabilities in computer systems and could increase the number of attacks. But so far, the vulnerabilities found have not led to a comparable rise in successful hacks: some problems stem from outdated devices and passwords that could be found in public manuals.

Hacked refrigerators and a false alert: cyberattacks are becoming more visible

Alex Pearce noticed a malfunction in the refrigeration systems at his London wholesale business on Monday last week. Defrost indicators were lit on two units, and their panels showed 150 °C. When the same indicator came on for the largest unit, Pearce unplugged the cable connecting the equipment to the internet. That same day, stores in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported similar problems: the temperature in some refrigerators and freezers had risen to 50 °C. Pearce worried that if it had happened on a Saturday morning, when he is usually away, the equipment could have caught fire.

Three attacks in a matter of days

The problems affected more than just stores and refrigeration units. French blood banks were also hit. On October 30, $6.3 billion (£4.7 billion) was stolen from Binance, the world’s largest cryptocurrency exchange — the theft was the biggest in history. On November 1, hackers attacked Ukraine’s emergency alert app and sent Kyiv residents a false message about a nuclear strike.

After the refrigeration systems were hacked, officials urged people to prepare for further disruptions. Richard Horne, head of the UK’s National Cyber Security Centre, called the current period the “foothills” of a new phase of cyber threats. In his view, computer systems have so many vulnerabilities that some seem to be waiting to be exploited. In the near term, Horne believes, the main danger is a sharp increase in incidents; he says recent months already point to that trend.

Last month, websites around the world were temporarily taken offline as a precaution after OpenAI’s AI technology helped uncover a vulnerability in PHP, the programming language used to build a significant portion of the World Wide Web. The attack on a French supermarket’s refrigeration systems last month may have been a test run for a larger hack this week.

Technology entrepreneur and commentator Azeem Azhar compared AI models’ ability to find vulnerabilities to the start of the COVID-19 pandemic in China, calling what is happening a “Wuhan moment.” In a Substack post, he quoted Matthew Prince, head of a cybersecurity company, who warned that for several years, every week could feel as though the situation were spiralling out of control. Soon after that, the defrost indicators at Pearce’s business lit up.

Hackers targeted Ukraine’s emergency alert app this month to send warnings to people in Kyiv. Photograph: Roman Pilipey/AFP/Getty Images

AI speeds up the search for vulnerabilities

The UK National Cyber Security Centre’s warnings are linked to two factors: geopolitics and the development of AI. One expert saw signs characteristic of Russian operations in the attacks on refrigeration systems. The Binance hack has been linked to North Korean authorities, while Russia is considered a possible participant in the attack on the Ukrainian app.

Last week, the centre said that by 2028, AI-powered malware would be “highly likely” to be used in attacks on British power stations, airports and hospitals. The agency believes AI could help attackers choose targets, find vulnerabilities in computer networks and write malicious code.

However, the hackers who targeted the refrigeration systems may not have needed AI. Paul Chichester, the centre’s director of operations, noted that the vulnerabilities were already known: default passwords, for example, had been published in manuals by one refrigeration equipment manufacturer. Sophos said it had not seen major incidents affecting its customers that were linked to the PHP vulnerability, although it had recorded many attempts to exploit it.

Ciaran Martin, a former head of the UK National Cyber Security Centre, disagreed with comparing what is happening to a “Wuhan moment.” The world has already experienced major waves of cyberattacks, he said: NotPetya and WannaCry, in 2017, were attributed to Russia and North Korea respectively, and ransomware attacks surged in 2021. North Korea, constrained by sanctions and short of money, has long been known for hacking cryptocurrency services. Martin considers the current series serious, but not unprecedented: similar waves occur every few years.

Why are fridges being hacked and what could be next? - The Latest

AI does help uncover vulnerabilities. A vulnerability is a flaw in a computer system that a hacker can exploit — like an unlocked door that the owner has overlooked or left unattended. After Anthropic released its Mythos model in April, which can find such flaws, the number of vulnerabilities identified by leading technology companies increased eightfold.

Ciaran Martin, the founding chief executive of the NCSC, has played down the gravity of the moment. Photograph: Wolfgang Rattay/Reuters

But the number of attacks has not risen by the same proportion. Cybersecurity expert Tal Be’ery suggested that criminals are still struggling to profit from the vulnerabilities they find. Recent declines in ransomware revenue show, he said, that a rise in the number of vulnerabilities has not yet led to a corresponding increase in successful hacks.

Outdated devices remain vulnerable

Hackers attacked companies that supply operating systems for industrial refrigeration units. Connecting these systems to the internet gave attackers remote access to the equipment. Danish company Danfoss, whose systems were affected, said most of the devices involved were old and no longer received security updates. The company had long advised customers to update their software or replace outdated versions.

The UK National Cyber Security Centre, part of the intelligence agency GCHQ, pointed out that ordinary internet-connected devices are also at risk, from smart speakers to home routers. The centre’s technical director, Ollie Whitehouse, said such devices could become targets for hackers. In his view, manufacturers need to invest more in product security, while buyers should be prepared to pay for more secure devices and update them regularly.

A common problem is devices for which manufacturers have stopped providing updates and support. Whitehouse urged people to pay closer attention to the risks posed by connected household appliances, though he considered the word “worry” too strong.

Pearce realised that the refrigeration control system made by US company Copeland and installed in 2018 needed an update. He acknowledged that he should have taken its vulnerability into account sooner, but the consequences for his business were not serious.

The hacks are a reminder of the vulnerability of everday objects with internet access, experts say. Photograph: Fred Tanneau/AFP/Getty Images

Boxes of perished goods outside an Intermarché in Paris last month after a cyber-attack that could have been a trial run for this week’s foray. Photograph: Lucien Libert/Reuters

Alex Pearce says he now realises his fridge monitoring system will need updating. Photograph: Martin Godwin/The Guardian

Geopolitics expands the threat landscape

Cyber threats come not only from criminal groups that encrypt victims’ files and demand cryptocurrency to unlock them. States are also active on the cyber front. Russia’s hybrid campaign against Europe is a particular source of concern.

Last month, the UK government launched the Be Ready campaign, urging citizens to stock up on three days’ worth of food and up to nine litres of bottled water in case of a serious weather-related, cyber or other emergency. Defence Secretary Wes Streeting said the country needed to prepare for the threat of “state-backed terrorism” targeting everyday infrastructure.

Geopolitics, exemplified by Russia’s hybrid warfare campaign against Europe, have made the cyber frontline a particular source of concern. Photograph: AP

Xavier Bellekens, head of cybersecurity company Lupovis, believes the attacks on refrigeration systems show signs of Russian operations, though he is not certain. His startup set up “honeypots” — traps for hackers — that imitated the same refrigerator controllers targeted in Europe. Among the methods used by the attackers was connecting through internet service providers that tolerated malicious activity. Bellekens said the same approach had been used in operations linked to Russia.

In Finland, the recent attacks came as no surprise: specialists and officials see them as part of a trend that has been intensifying for several years. The country shares a 1,340 km (832 mile) border with Russia. The number of various cyberattacks rose after Russia invaded Ukraine in 2022. Last year, Finland’s National Cyber Security Centre recorded nearly 21,000 incidents in a country with a population of under 6 million. In 2022, the figure was about 13,000.

Freezers at a supermarket in Sweden are emptied after temperatures reached 50C. Photograph: Johan Nilsson/TT/Shutterstock

This year, hackers gained access to 50,000 Finnish government mobile phones. The year before, they took the country’s Ministry of Defence website offline. Cyber threats are rising across Europe and NATO countries, but the increase is especially noticeable in states bordering Russia.

Samuli Bergström, vice president of Helsinki-based WithSecure, links the increase in attacks not only to Russia but also to the development of AI. He also pointed to internet-connected devices: attackers often target anything they can see online. Any such device, he said, should be considered a potential target.

Bergström and other experts stressed that Russian state hackers are not the only participants in these attacks, nor necessarily the most technically sophisticated. A vast, hidden economy of hacking operates around the world: some hackers act for political reasons, others for money. Many have ties to states, including Russia and Iran, but these ties may be informal, making it difficult for officials to establish the precise motive behind a particular attack.

Recovery options

Cybercriminals are becoming better prepared and better resourced: they can find vulnerabilities and exploit them more easily. This raises fears that an entire country’s power grid could fail in the middle of winter or that trade could grind to a halt.

Finland and most European countries have plans for disruptions to payment systems or attacks on power grids. But cyberattacks work differently from physical attacks. A strike on a power station could leave the grid without electricity for months or longer: replacing transformers can take years. Software can usually be fixed with an update, and a device can be disconnected from the internet.

The fridge control panel at Alex Pearce’s London warehouse. He has not reattached the internet cable but said his business is otherwise unaffected. Photograph: Martin Godwin/The Guardian

Some officials say state hackers may care less about physical damage than about the psychological effect. Refrigerators turned into ovens or a hacked blood bank leave a lasting impression. At the same time, the vulnerabilities exploited in such attacks have probably already been fixed, and criminals may not be able to repeat exactly the same attack. But other weaknesses and outdated systems remain. Bergström stresses that attacks are happening more often and are continuing.

Pearce has not yet plugged the internet cable back in. He said, however, that his business, Langridge Organic, was otherwise unaffected. Even after refrigeration systems were hacked in France last month, he had not expected his company to be the next target.

Dataist’s take: The rise in the number of vulnerabilities found does not yet mean a similar rise in successful attacks: some weaknesses are in outdated systems that can be updated or disconnected from the network. But the refrigeration systems show how an internet connection can turn ordinary equipment into a remotely accessible target, with disruptions that can affect not only data but also business operations.

Source

Daily AI news

Every day we pick what actually matters in AI and explain it plainly — no hype, no filler. Subscribe if you want to follow where the industry is going.

Only what matters — every day

Follow on X