The attack that hit supermarkets in Italy has different characteristics from what we have usually seen. No requests for money, no stolen data, just an action that seems demonstrative. We talked about it with Paolo Dal Checco.
The effect is physical. Some code strip that is tampered with, settings that are changed on the fly. Supermarket freezers starting to heat up. Whole loads of food that end up straight in the garbage. The hacker attack becomes physical. In Italy there have been few cases but reports have continued to arrive in the rest of Europe for months. Palazzo Chigi, after a meeting, issued a note to clarify its position: “Most of the distribution chain is equipped with updated protection systems, capable of repelling malicious intrusions. There is therefore no alarm, but maximum attention remains on the part of all the competent institutional subjects”.
The ways that led to this action they are not clear. We talked about it with Paolo Dal Checcocybersecurity expert and computer forensic consultant. He formulated three hypotheses: “They may have used a password found elsewhere, just as they may have carried out a phishing campaign: instead of finding the credentials, they had them delivered. The third scenario concerns updates: it is possible that the software used to control the freezers was not updated.” This is it most likely scenario: “Often people or companies don’t update due to lack of space on their devices, for fear that an update will slow down the system or compromise its functioning, or due to lack of time and staff.”
The effect was limited. Just a few case registered around Italy. The problem, however, remains. Also because it is not yet clear what the motivations that led to this attack were. From what we know no money was asked And no data was stolen. Again Dal Checco: “Generally those who carry out an attack want money. It is unusual not to find an economic issue, unless it is a demonstrative action, the work of someone who does it for fun or a warning for something worse”. The scenarios he talks about in these hours move on two fronts. The first of one or more lone wolves. Let’s talk about isolated hackerswhich act independently, without following orders from more complex structures. The second is that of an attack organized by structures close to foreign governments.
The scheme though it can happen again. Supermarket freezers are not the only system exposed to this type of attack. There are also other sectors where the flaws are simple to find: “A vulnerability with similar characteristics concerns video surveillance systems. They are tools that have access from the outside and a firmware that almost no one ever updates. In the past, unresolved vulnerabilities have been exploited to break tens of thousands of cameras.” The only way to prepare is to verify IT security of the devices, check the firmware and access passwords. All it takes is a hole to enter the net.
