Dushanba, 2-noyabrga o'tar kechasi hujumchilar Belgiya, Shvetsiya, Estoniya va boshqa Yevropa davlatlaridagi supermarketlarda sovutish nazorat tizimlarining sozlamalarini masofadan o'zgartirib, muzlatkich va sovutkichlarni isib yuborishdi.
Hech bir tarmoq bir necha o'nlab do'kondan ko'p ta'sirlanganini xabar qilmadi, ba'zilari sovutilgan va muzlatilgan oziq-ovqatni tashlab yuborish yoki javondan olib tashlashga majbur bo'ldi. Danfoss — Daniya sovutish nazorat tizimlari ishlab chiqaruvchisi — o'z mahsulotlari ishtirok etganini aytdi, xuddi uch hafta oldin Fransiyadagi yuzlab supermarketlarga hujum qilinganda bo'lgani kabi.
Dushanba kechasi hech kim hujumlarni o'z zimmasiga olmagan, va ular Fransiyadagi hujum bilan bog'liqmi-yo'qmi noma'lum edi.
Sovutish nazorat tizimlari — do'konning muzlatkich va sovutkichlarini boshqaradigan kompyuterlar. Ular internetga ulanishi mumkin, bu esa sovutish pudratchilariga ularni kuzatish va nosozliklarni masofadan tuzatish imkonini beradi.
Belgiya: hujumchilar sovutish bloklarini muzdan tozalash rejimiga o'tkazishdi, deb aytdi Sabcobel sovutish pudratchisi bosh direktori Stefan Moelans Belgiya ommaviy axborot vositalariga. Muzdan tozalash rejimi muzni tozalash uchun mo'ljallangan, ammo bu hujumlarda u oziq-ovqatni sovuq saqlash o'rniga isib yuborishiga sabab bo'ldi. Sabcobel Delhaize supermarket tarmog'i uchun sovutish tizimlarini boshqaradi.
Boshqa hollarda harorat sozlamasi oshirilgan. Janubiy Shvetsiyadagi Sjöbo shahridagi ICA do'koni muzlatkich va sovutkichlari 50°C ga o'rnatilganini va xodimlar ta'sirlangan tovarlarni tashlab yuborayotganini aytdi.
Estoniyadagi Selver supermarketida muzlatkich 50°C ga o'rnatilgan, deb aytdi Kitman Coldtech sovutish ta'minotchisi bosh direktori Jann Mutso. Uning harorati faqat taxminan 2-3°C ga ko'tarilgan, muammo taxminan 10 daqiqa ichida hal qilingan va hech qanday mahsulot zarar ko'rmagan.
Danfossning xavfsizlik ogohlantirishlari sahifasida The Hacker News 3-noyabrda tekshirganida hujumlar haqida hech qanday ogohlantirish yo'q edi. Operatorlar uchun eng batafsil qadamlar hali ham Fransiya milliy kiberxavfsizlik agentligi CERT-FRning oktyabr ogohlantirishida keltirilgan.
Qaysi kompaniyalar ta'sirlanganini aytishdi
Har bir kompaniya hodisani o'z so'zlari bilan tasvirladi va hammasi ham uni kiberhujum deb atamadi.
| Mamlakat | Kompaniya | Ta'sirlangan do'konlar | Kompaniya yoki ta'minotchisi aytganlari |
|---|---|---|---|
| Belgiya, Lyuksemburg | Delhaize | Bir necha o'nlab, asosan Belgiya va Lyuksemburgda bir nechta | Sovutishga "IT hodisasi" ta'sir qilgan. Yangi va muzlatilgan oziq-ovqat assortimenti vaqtincha cheklangan. |
| Belgiya | Carrefour | 700 dan ortiqdan 15 | Sovutish tizimiga kiberhujum, juda cheklangan ta'sir. |
| Belgiya | Intermarché | 10 dan 15 gacha | Muzlatkichlari bilan muammolar. |
| Belgiya | Spar, Colruyt Group ostida | 5, mustaqil egalari tomonidan boshqariladi | Ularning muzlatkich tizimlari hujumga uchragan. |
| Belgiya | IKEA | 1, Mons shahrida | Kiber hodisa do'konning muzlatkich va sovutkichlariga ta'sir qilgan. Belgiya boshqa IKEA do'konlari ta'sirlanmagan. |
| Shvetsiya | ICA | Cheklangan son. Hisob berilmagan | Sovutish va muzlatkich tizimlariga hodisa ta'sir qilgan. ICA kiberhujumni tasdiqlamagan. |
| Shvetsiya | Coop | 6 (TT va AFP ga) yoki 7 (Reuters va Bloomberg ga), taxminan 800 dan | Kiber hodisa, unda kimdir ruxsatsiz sovutish tizimiga aralashgan. |
| Irlandiya | Musgrave, SuperValu egasi | 223 dan 13 | "Kiber hodisa", faqat bitta sovutish modeliga cheklangan. |
| Estoniya | Selver, Kitman Coldtech ta'minotchisi orqali | 1 | Eski Danfoss tizimiga hujum. |
| Niderlandiya | Nomi aytilmagan bizneslar | Kamida 17 biznes, jumladan qassoblar va kichik mahalliy do'konlar | Danfoss ma'lumotiga ko'ra hujumga uchragan. |
| Finlandiya | Kesko | Bir nechta kichik do'konlar | G'ayrioddiy haroratlar. Sababi tekshirilmoqda. Do'konlar uskunalari Kesko markaziy himoyalaridan tashqarida. |
| Portugaliya | Intermarché, Mosqueteiros guruhi | 7 | AFP ma'lumotiga ko'ra, sovutishni boshqaradigan tashqi kompaniyaga qaratilgan kiberhujum. |
| Italiya | Radenza Group tomonidan boshqariladigan Coop supermarketlari | Kamida 4, Sitsiliyada | AFP ma'lumotiga ko'ra, muzlatilgan oziq-ovqat bo'limlari uchun masofaviy nazorat tizimiga hujum. |
Antverpen janubidagi Hove shahridagi De Laet & Van Haver qassob do'konida muzlatkichlar 18°C gacha ko'tarilgan, deb aytdi egasi Lyuk De Laet Reutersga. U taxminan €15 000 qiymatidagi go'sht buzilganini hisoblab chiqdi.
13 SuperValu do'konida Musgrave sovutilgan va muzlatilgan mahsulotlarni ehtiyot chorasi sifatida sotuvdan olib tashladi. Kompaniya dushanba tushdan keyin hodisa hal qilinganini va qayta to'ldirish ishlari boshlanganini aytdi.
Kompaniyalar uskunalar va kirish yo'li haqida nima deyishdi
Ta'sirlangan tizimlarning bir nechtasi Danfoss tomonidan ishlab chiqarilgan. ICAning ta'sirlangan barcha do'konlari Danfoss tomonidan ta'minlangan tashqi sovutish nazorat tizimiga ulangan, deb aytdi ICA vakili AFPga. Estoniyada hujumchilar eski Danfoss tizimining nazorat kompyuteriga yetib borgan, deb aytdi Mutso.
Danfoss har bir holatda nomlanmagan. Musgravening bayonotida ta'sirlangan model ishlab chiqaruvchisi nomlanmagan.
Ta'sirlangan Belgiya qassobi Niderlandiya NOS telekanaliga ikkinchi ishlab chiqaruvchi — Copeland uskunalari ham Belgiya hujumga uchraganini aytdi. Copeland NOSga hujumlar haqida aniq javob bermadi.
Ta'sirlangan Niderlandiya tizimlari xavfsiz tarmoqda emas va hali ham standart parollardan foydalanardi, deb aytdi Danfoss vakili NOSga. U yerdagi ko'pchilik do'konlar Fransiya hujumidan keyin choralar ko'rgan, ammo bir nechtasi ko'rmagan va aynan ular hujumga uchragan.
Danfoss shuningdek Belgiya VTM telekanaliga zaiflik asosan eskirgan dasturiy ta'minotda ekanligini va yangilamagan mijozlar ta'sirlanganini aytdi, deb xabar berdi Euronews.
Sabcobel Belgiya bo'ylab boshqaradigan yuzlab tizimlar orasida taxminan 20 ta ta'sirlangan blokni biladi. Belgiya hollarda hujumchilar sovutish pudratchilarining tizimlariga emas, balki alohida supermarket tizimlariga kirgan, deb aytdi Moelans Belgiya ommaviy axborot vositalariga. Sabcobel do'konlarga internet ulanishlarini himoyalashni maslahat bergan va ko'pchilik, ammo hammasi emas, buni qilgan.
Mutso yangilanmagan eski nazoratchilar nishonga olinayotganini aytdi. Selver hujumga uchragan do'kon yangi tizimga hali o'tkazilmagan oxirgi do'kon ekanini aytdi. ICA NBC Newsga o'z tizimlari ta'sirlanmaganini va ta'sirlangan do'konlar tashqi ta'minotchidan foydalanganini va ICA markaziy tarmog'idan tashqaridagi tarmoqqa ulanganini aytdi.
Belgiya Kiberxavfsizlik markazi dushanba kuni jurnalistlarga qo'shimcha ma'lumot yo'qligini aytdi. Shvetsiya Milliy Kiberxavfsizlik markazi o'z ogohlantirishida hujumchilar qanday kirganini aytmadi.
Operatorlar nima qilishi mumkin
CERT-FR ogohlantirishi Danfoss AK-SM va AK-SC seriyali nazoratchilarini, shuningdek Copeland xweb va Dixell xwebni qamrab oladi. U bu qurilmalarga qarshi hujum kampaniyalari ehtimol hali ham davom etayotganini aytadi. The Hacker News 3-noyabrda tekshirganida ogohlantirish oxirgi marta 16-oktyabrda yangilangan edi.
Ta'sirlanmagan qurilmalar uchun qadamlar:
- Qurilmalar internetdan, jumladan har qanday jamoat IP manzilidagi qurilma orqali, yetib bo'lmasligiga ishonch hosil qiling. Sovutish pudratchisiga ma'lumot oqimini uzishdan oldin sug'urta shartnomasini tekshiring.
- Butun konfiguratsiyani, ayniqsa muzdan tozalash jadvallarini tekshiring.
- Faqat xavfsiz VPN yoki himoyalangan tarmoq orqali kirishni tiklang. Favqulodda holatda pudratchilarning IP manzillarini xavfsizlik devorida filtrlay olasiz, ammo bu doimiy yechim bo'lmasligi kerak.
- Ishlab chiqaruvchining yaxshi amaliyotlariga rioya qiling, masalan, dasturiy ta'minotni yangilash. Danfoss qurilmalari uchun xavfsizlik darajasini Qattiq (Strict) qilib o'rnating va standart parollar o'zgartirilganiga ishonch hosil qiling.
Ta'sirlangan qurilma uchun yana ikki qadam qo'shiladi: Danfoss qurilmasini qayta ishga tushiring yoki zavod sozlamalariga qaytaring, so'ngra uni qayta xizmatga qo'yishdan oldin qayta sozlang.
Xavfsizlik yangilanishlarini olmagan eskirgan qurilmalar internetda qolsa, juda ehtimol ta'sirlanadi, deb ogohlantiradi CERT-FR. Zavod sozlamalariga qaytarish ularni yana hujumga ochiq qoldiradi. Oktyabrda Danfoss Fransiyada ta'sirlangan birliklarning aksariyati eski, endi yangilanmaydigan AK-SM 800 va AK-SC 355 modellari ekanini aytdi.
Danfoss 13-oktyabrda Niderlandiya mijozlariga tizimlarini internetdan uzib, faqat xavfsiz tarmoq orqali qayta ulashni maslahat berdi. Shuningdek, u mijozlar bilan tuzatish choralarini joriy etish ustida ishlagan.
Shvetsiya Milliy Kiberxavfsizlik markazi tashkilotlarga internetga ulangan qurilmalarni ro'yxatga olishni, har birining ulanishi kerakmi-yo'qmi hal qilishni va ulanishda qolganlarini yangilab, bir necha qatlamli xavfsizlik bilan himoyalashni maslahat berdi.
Moelans faqat dasturiy ta'minot yangilanishi yetarli emasligini, chunki o'rnatishlar pul talab qiladigan jismoniy o'zgarishlarga muhtoj ekanini aytdi. Eng oddiy javob — muzlatkichlarni boshqarish uchun xavfsiz internet ulanishi, bu Sabcobel mijozlarining aksariyati Fransiya hujumidan keyin qabul qilgan.
Kim orqada turibdi
Danfoss Niderlandiya hujumlari Fransiyadagi bilan bir xil turdagi ekanini aytdi, Sabcobel Belgiya hujumlarida ham xuddi shu usul ishlatilganini aytdi va Kitman Estoniyadagi usul o'xshash ekanini aytdi. Umumiy usul bir xil odamlar har ikkala hujumni amalga oshirganini ko'rsatmaydi.
Belgiya Kiberxavfsizlik markazi dushanba kuni hujumlar ortida kim turganini noma'lum ekanini va "bu hech qachon aniqlanmasligi mumkin"ligini aytdi.
Belgiya federal prokuratura idorasi jinoiy tergov ochganini VRTga tasdiqladi. Shvetsiya Milliy Kiberxavfsizlik markazi dushanba kuni hodisalarni kuzatayotganini va boshqa Shimoliy va Yevropa davlatlari agentliklari bilan ma'lumot almashayotganini aytdi.
Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers.
No chain reported more than several dozen affected stores, and some had to throw away chilled and frozen food or take it off the shelf. Danfoss, a Danish maker of refrigeration controls, said its products were involved, as they were three weeks earlier when attackers hit hundreds of French supermarkets.
No one had claimed the attacks by Monday night, and it was not known whether they were linked to the attack in France.
Refrigeration controls are computers that run a store's fridges and freezers. They can be connected to the internet, allowing refrigeration contractors to monitor them and fix faults remotely.
In Belgium, attackers switched cooling units into defrost mode, Stephan Moelans, chief executive of the refrigeration contractor Sabcobel, told Belgian media. Defrost mode is meant to clear ice, but in these attacks it made the units heat up instead of keeping food cold. Sabcobel manages refrigeration systems for the Delhaize supermarket chain.
In other cases, the temperature setting was raised. An ICA store in Sjöbo, in southern Sweden, said its fridges and freezers had been set to 50°C and that staff were throwing out the affected goods.
At a Selver supermarket in Estonia, a freezer was set to 50°C, said Jann Mutso, chief executive of the refrigeration supplier Kitman Coldtech. Its temperature rose by only about 2-3°C, and the problem was resolved within about 10 minutes, with no products damaged.
Danfoss's security advisories page listed no advisory about the attacks when The Hacker News checked on November 3. The most detailed steps for operators are still those in an October alert from CERT-FR, part of France's national cybersecurity agency.
Which Companies Say They Were Hit
Each company described the incident in its own words, and not all of them called it a cyberattack.
| Country | Company | Stores affected | What the company or its supplier said |
|---|---|---|---|
| Belgium, Luxembourg | Delhaize | Several dozen, mostly in Belgium and a few in Luxembourg | An "IT incident" affected refrigeration. The range of fresh and frozen food was temporarily limited. |
| Belgium | Carrefour | 15 of more than 700 | A cyberattack on its refrigeration, with very limited impact. |
| Belgium | Intermarché | 10 to 15 | Problems with its fridges. |
| Belgium | Spar, under Colruyt Group | 5, run by independent owners | Their fridge systems were attacked. |
| Belgium | IKEA | 1, in Mons | A cyber incident hit the store's fridges and freezers. No other IKEA store in Belgium was affected. |
| Sweden | ICA | A limited number. No count given | An incident affected refrigeration and freezer systems. ICA did not confirm a cyberattack. |
| Sweden | Coop | 6 (to TT and AFP) or 7 (to Reuters and Bloomberg), of about 800 | A cyber incident in which someone tampered with its refrigeration without permission. |
| Ireland | Musgrave, owner of SuperValu | 13 of 223 | A "cyber incident" limited to one refrigeration model. |
| Estonia | Selver, through supplier Kitman Coldtech | 1 | An attack on an older Danfoss system. |
| Netherlands | Businesses not named | At least 17 businesses, including butchers and small local shops | Attacked, according to Danfoss. |
| Finland | Kesko | A few smaller stores | Unusual temperatures. The cause was under investigation. The stores' equipment is outside Kesko's central protections. |
| Portugal | Intermarché, Mosqueteiros group | 7 | A cyberattack that appears to have targeted an outside company managing the refrigeration, according to AFP. |
| Italy | Coop supermarkets run by Radenza Group | At least 4, in Sicily | An attack on its remote control system for frozen food sections, according to AFP. |
At a De Laet & Van Haver butcher shop in Hove, south of Antwerp, the fridges were turned up as high as 18°C, owner Luc De Laet told Reuters. He estimated that about €15,000 worth of meat was ruined.
At the 13 SuperValu stores, Musgrave took chilled and frozen products off sale as a precaution. The company said on Monday afternoon that the incident had been resolved and restocking was under way.
What Companies Say About the Equipment and the Way In
Several of the systems that were hit were made by Danfoss. All of ICA's affected stores were connected to an outside refrigeration control system supplied by Danfoss, an ICA spokesperson told AFP. In Estonia, attackers reached the control computer of an older Danfoss system, Mutso said.
Danfoss is not named in every case. Musgrave's statement did not name the maker of the affected model.
An affected Belgian butcher told Dutch broadcaster NOS that equipment from a second maker, Copeland, was also attacked in Belgium. Copeland gave NOS no clear answer to questions about the attacks.
The Dutch systems that were hit were not on a secure network and still used default passwords, a Danfoss spokesperson told NOS. Most shops there had taken measures after the French attack, but a few had not, and those were the ones hit.
Danfoss also told Belgian broadcaster VTM that the weakness lies mainly in outdated software and that customers who had not updated were affected, Euronews reported.
Sabcobel knows of about 20 affected units among the hundreds it manages in Belgium. In the Belgian cases, attackers got into individual supermarkets' systems, not those of refrigeration contractors, Moelans told Belgian media. Sabcobel had advised stores to secure their internet connections, and many but not all had done so.
Mutso said old controllers that had not been updated were being targeted. Selver said the store that was hit was the last one it had not yet moved to a new system. ICA told NBC News that its own systems were not affected and that the affected stores used an outside supplier and were connected to a network outside ICA's central network.
Belgium's Centre for Cybersecurity told reporters on Monday that it had no further information. Sweden's National Cybersecurity Centre did not say in its notice how attackers got in.
What Operators Can Do
CERT-FR's alert covers Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb. It says attack campaigns against these devices are probably still underway. When The Hacker News checked on November 3, the alert had last been updated on October 16.
For devices that have not been compromised, the steps are:
- Make sure the devices cannot be reached from the internet, including any device on a public IP address. Check your insurance contract before cutting the data feed to your refrigeration contractor.
- Check the whole configuration, especially the defrost schedules.
- Restore access only through a secure VPN or a protected network. In an emergency, you can filter the contractors' IP addresses at a firewall, but this should not be a lasting fix.
- Follow the maker's good practices, such as updating firmware. For Danfoss devices, set the security level to Strict and make sure default passwords have been changed.
For a device that has been compromised, two more steps follow: restart the Danfoss device or reset it to factory settings, then reconfigure it before putting it back into service.
End-of-life devices that no longer get security fixes are very likely to be compromised if they stay on the internet, CERT-FR warns. A factory reset alone leaves them open to attack again. In October, Danfoss said most of the units hit in France were older models it no longer updates, the AK-SM 800 and AK-SC 355.
Danfoss advised Dutch customers on October 13 to disconnect their systems from the internet and reconnect them only through a secure network. It had also been working with customers to put fixes in place.
Sweden's National Cybersecurity Center advised organizations to list which devices are connected to the internet, decide whether each one needs to be connected, and keep any that remain connected updated and protected with multiple layers of security.
Moelans said a software update alone is not enough, because the installations need physical changes that cost money. The simplest answer is a secure internet connection for managing the fridges, which most of Sabcobel's customers adopted after the French attack.
Who Is Behind It
Danfoss said the Dutch attacks were the same kind as the one in France, Sabcobel said the same method was used in Belgium, and Kitman said the method in Estonia was similar. A shared method does not show that the same people carried out both attacks.
Belgium's Centre for Cybersecurity said on Monday that it was not known who was behind the attacks and that "it may never be determined".
Belgium's federal prosecutor's office has opened a criminal investigation, it confirmed to VRT. Sweden's National Cybersecurity Centre said on Monday that it was following the incidents and sharing information with agencies in other Nordic and European countries.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.