> I spent years trying to convince people to build more secure IoT systems, but they always preferred cheap and easy solutions.

For me this has always been true of systems in general all across the decades that I've worked with technology. It's like pulling teeth to convince anyone in charge that backups or security are even a little bit important until after there's been a costly disaster, then it's all about "Why didn't you warn me this could happen?" - Umm... You mean like every single day for many months until you told me to shut up about it because my paranoia doesn't justify the tiny expense of ensuring you don't lose many tens of thousands of dollars or years of irreplaceable work or important records?

I went through a manual you mentioned in another comment. It listed "High level of security against undesired user access" as one of the features but it wasn't expanded upon. So I did more searching and found cybersecurity best practices from Danfoss.

https://www.danfoss.com/en/service-and-support/fix-and-troub...

They highlight connection through a firewall, mention secure remote access methods, monitoring for data breaches, strong access controls, etc. Reasonable, but these are just recommendations, so the stores could have followed all of them or none at all.

An article about Danfoss vulnerabilities mentioned in a different comment (https://claroty.com/team82/research/freeze-the-controller-de...) says

> we searched publicly available internet-wide scanning platforms, including Shodan and Censys, for signatures associated with its management interface. It didn't take long to find what we were looking for. Numerous controllers [2765] were directly accessible from the public Internet.

So none at all is a possibility.

I would have said let them be doomed. But due to late stage capitalism so much has been centralized that everybody is doomed in many cases...

The people who should be held liable never will be. Their money is like an impenetrable shield to any sort of accountability. They'll just scapegoat the guy that warned them about the risk repeatedly for not doing more to prevent it.

> Russia will never attack NATO

You think about a frontal attack like in Ukraine, and maybe you're right. But Russia is already waging a much more subtle war against NATO. Look at who's leading the US. Look at Brexit. Or look at who could soon lead France or Germany... Their conventional army may be weak, but they don't need to fire a bullet either.

Drones run on diesel?

I have read some Asian country's (who are friendly with Russians) government foreign affairs required readings that is like 2 year old by now. Those materials say Russia is being cornered. They had no other option to but to invade Ukraine. But with sanctions they are more cornered and are desparate. They thought China would ally would them but China's selective neutrality is making them desparate. Those documents say that Russia never actually deployed their main regiments and only worked with mercenaries and allied country armies.

No body knows how much petro product Russia is producing or who is buying them. Those diplomatic documents suggest treating simultaneously as a black box and a cornered animal. The financial sanctions actually was a double edged sword considering UK essentially blocked all foreign transactions even for international infrastructure investments Russia made to foreign countries and at the same time from a global perspective UK was not seen as a reliable financial partner. So, Russia is desparate, EU is desparate but they are not allowed to sit in a table to negotiate... Because US will not allow that. If a war happens across EU every party invovled will see this is to be positive thing because for the last decade economies has slowed down and political views has become extremely polarizing. A war at a massive scale brings everyone together for their country and economy jumpstarts.

To be fair, that they are struggling to take over a couple of villages in Ukraine is in large parts due to the intensified arms and ammunition production of the entire EU (and in the past that of the US). And that's only enough for a standstill

Large scale invasion is not likely, but they could try some limited operation to test NATO's unity. Most likely location would be somewhere in the Baltics.

Not Europe but a few Baltic states are feasible. No one says they can hold it, but Putin has his own reasons so we should not think we can conclude on future Russian actions based on what we consider reasonable - e.g. no one predicted that a war on Ukraine was likely as it seemed to be completely irrational and self-defeating.

If nothing else, war has been many times convenient to keep regimes in power (see Bush post 9/11 for an obvious example). Putin might want to strengthen his case. See absurd discussions / push for a "Republic of Narva" as an example cause belli.

Never underestimate the stupidity and irrationality of autocratic governments. Putin also decided to invade Ukraine after all even though he should have known better.

Europe is rearming on the lines of the 1930s, because Russia is struggling to take a couple of villages.

They can't take Kiev but they're threatening Paris.

They cannot win, but they can invade. We're already in a hybrid war. The threat is real and Europe needs to be prepared and be able to stand on its own, especially now that also the US is not only directly threatening EU countries, but is acting against EU security both globally and internally by supporting separatist neo-Nazi pro-Putin parties.

I moved to a new apartment with all this stuff installed.

At first I thought exactly that - just why.

When days started getting warm in the beginning of the summer I started investigating and thought that it might actually be a good idea - you could turn AC an hour before you come home to find cool room.

When summer hit I actually found out that you just leave AC on all the time and it just keeps temperature at 22C or so and there is really no need for it to be connected. You don't want to turn that off as it is more economical to keep the room cool than letting it to get hot and then trying to cool it fast. It barely even showed up on my electricity bill at the end.

So all in all - really not needed.

What regulations would help with this? companies that actually host the models themselves can be regulated but open models can e abliterated or otherwise modified to stop them from refusing tasks. I'd be very wary of any regulations that prevent people from hosting or making their own models and weights.

I didn't expect to spend so much time today thinking about fridges. I have so many questions. If it's all so connected and monitored and notifies of issues, couldn't it notify anyone that the settings are weird, like continuous 50 degree Celsius defrosting? How much access did the hackers have, apart from temperature controls? Could nobody intervene quickly before the damage was done? Was there a way to "unplug" the fridges or they would just keep frying, so they had to get people across all the stores doing manual resets?

And your SIL would just be as likely excited too about a MOEN wifi connected voice controlled kitchen faucet. Ain't it cool!

She will not be as excited however when the water bill comes and cannot pin point where the additional water they claim to have not used has gone.

Then we move on to even more serious potential life changing appliances that are wifi connected of which your SIL would certainly just be as excited about. Wifi connected hot water tanks of which some here know how they work and what this remote ability allows. Ain't it cool!

She will not be as excited however when the medical bills come nor every single passing day when she sees the visible scars she must carry for the remainder of her living days for being 'cool' - ironic huh?

Reality hits hard as most humans are reactive and those that have been in this game for many decades grossly understand the dark side of insecurely connecting devices that have life changing implications. Medical devices companies have already shadowed their software mistakes yet such information only stays in the shadows for so long.

"What you cannot see matters most!" and many tech illiterates are currently learning this in most unfortunate ways. Some of that learning will scar both mentally and physically for life. Ain't it cool!

Many people here reading this are a lot smarter than I and such can therefore extrapolate and add to what is unfolding in the world. It shows little sign of stopping as more and more devices are connected daily under the guise of 'easy'.

Thus the underlying absolute reason to "Stay Healthy!"

> Authentication is hard.

Authentication is easy, getting people (esp. leadership) to give a shit is hard.

Control loop is obviously local and performed by dedicated controller hardware. If you only need remote monitoring then don't expose any management functionality.

If you want remote management, then define an envelope of allowable system parameters that can be controlled remotely. Allowing defrost to be initiated remotely has obvious risks and known solutions - add a hardware interlock, like a physical button or a key switch.

Even if you ignore all other precautions and allow all parameters to be controlled without limitations, strong authentication is still easy to implement, if anyone cares enough to do it.

Well, if we start counting from Morris worm, without liability in place, plenty more.

Because it is cool! (pun intended)

For the same reason, we hardly have heating meters in Germany that aren't wireless connected to the maintenance company.

To save costs doing maintenance trips to check their state.

So they can monitor if something goes wrong, have a tech troubleshoot and deploy with the right parts.

Modern HVAC and fire control b systems for buildings are often connected now as well

the sort of people doing this security posture definitely are not up to date on the latest security news...

It would take something truly monumental to make a local supermarket owner even consider the potential for their fridges to be an attack vector.

Somebody wrote the software that is the interface between the fridge and the internet. And while it would be nice if HVAC technicians would remember to only make this software accessible via VPN, it is in fact possible to write software that is reachable from the internet while still being secure

Given that we agree that HVAC technicians can't be relied on for network security, this is 100% on the fridge company for having insecure software. If it's a bad password or an unchanged default password that's still on the fridge company for not enforcing something better

In the 2013 Target attack, the attackers used the HVAC contractors' credentials to gain access to Target's systems. The point of sale credit card terminals (what customers swiped cards and enter PINs) had no real security so the attackers were able to make those get "updates" from their own servers and download malware enabling them to get the magnetic stripe information as well as PIN (for debit cards). That year, I (like about 150,000,000 other people) got a brand new credit card with a new credit card number.

https://krebsonsecurity.com/2015/09/inside-target-corp-days-...

Newer PCI standards require much more secure customer-facing terminals and much more secure back-end systems so that much of this attack could not happen again.

https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec...

> Grocer w/ 2% margins

You have clearly never stepped foot inside an Albert Heijn store.