I'm reading posts around fedi saying that fridges have no need to be controllable from the internet, and with some caveats I quite disagree.
-
I'm reading posts around fedi saying that fridges have no need to be controllable from the internet, and with some caveats I quite disagree.
Aggregated data on how fridges run in real life is valuable, and could be used to let them run more efficiently, which is good both for the owner and for the environment.
Now, with home fridges such data could only be collected by the producer, and I wouldn't trust most fridge producers to use that power in favor of the owners, so my fridge is pretty much disconnected from anything, thanks.
But if you have a supermarket chain, you have enough fridges to be able to make good use of that data, and you do want to collect it. And similarly, being able to control all fridges from outside the individual supermarket gives you a lot more versatility in how to use it.
Mind you, “from outside the supermarket” shouldn't mean “easily found on shodan, with 12345 as the password”, it could be a well configured vpn, or some other secure method of access: I'd consider those to still count as “on the internet”; and you need to keep the system up to date, but then with that many fridges you do need to have a budget for maintenance, and that's part of it.
-
Sto leggendo post in giro sul fediverso che dicono che i frigoriferi non dovrebbero essere collegati ad internet, e con un po' di precisazioni non sono d'accordo.
I dati aggregati sul funzionamento reale dei frighi sono utili, e potrebbero essere usati per farli funzionare in modo più efficiente, a vantaggio sia di chi paga la bolletta che dell'ambiente.
Coi frigoriferi casalinghi la raccolta dati potrebbe essere fatta solo dai produttori, e non mi fido che i produttori li usino a favore dei proprietari del frigo, quindi il mio frigo è scollegato da qualunque cosa.
Ma se sei una catena di supermercati hai abbastanza frigoriferi da poter usare quei dati, e li vuoi raccoglierli. E poter controllare i frighi da remoto ti da molta più versatilità nell'usarli.
Ovviamente “da remoto” non dovrebbe voler dire “trovabile con facilità su shodan, con 12345 come password”, potrebbe essere una vpn ben configurata, o qualche altro sistema di accesso sicuro: li considero comunque “su internet”. E altrettanto ovviamente poi devi tenerli aggiornati, ma con così tanti frigoriferi devi avere un budget per la manutezione, e quella ne è una parte.
-
@valhalla hai ragione, il problema è che il software consentiva da remoto operazioni critiche come innalzare la temperatura a valori elevati e avviare operazioni di sbrinamento: queste dovrebbero essere consentite solo con operatore in presenza.
-
@valhalla tbh, there's no reason why each shop couldn't have its own WAN, with no connection to the internet, and someone come in regularly to download the information onto a company laptop to send to head office. Risk vector almost nil.
-
@UkeleleEric that wouldn't allow them to control the fridges remotely, which is also pretty useful.
And just using a well configured vpn would have reduced their risk to basically not worth attacking, as long as there are other places that just keep stuff online with 12345 as the password
-
@Gorneman beh, ma controllare in modo centralizzato quando fare la sbrinatura potrebbe essere utile.
Mentre in caso di temperature elevate ci dovrebbe essere un allarme ricevuto da qualcuno ben prima dei 50°C, ma quello a prescindere dalla causa, quello sì.
-
@valhalla Good that you can enable or disable it, but the info, as you say, may be useful to you and should be collectable on non-routable ip's on your LAN, so you have it. May be interesting, but it's a data point of one.
Years ago, I bought a house with an ancient, but working fridge. The compressor was a sealed unit. The fridge was old enough to have rounded corners and simply looked old at first glance.
There was a push at that time to reduce usage and update water heaters, refrigerators and so on.
I didn't really want to bring a new fridge into the world, since the old one still worked and I didn't know the cost of manufacturing a new one on the environment - nor disposing of the old, functioning fridge.
Instead, I saw a small 'bar' fridge on sale and I reasoned that, most often, we opened the fridge to get a beverage and then put it back, so I bought that instead, and that's where we stored the milk, cream, water and juices.
I still like to think it was the right thing to do, but I'll never know for sure. -
@valhalla
In theory... I'm not fully, fully convinced, but it makes at least some sense.In practice for household items, however, apps and Internet connection is a tool for manufacturer to brick or downgrade your device whenever they please. Or by accident. Or because internet is absent today. And... what can I say? That is huge problem, awful approach, nobody needs that, burn to the ground. And supermarkets also don't deserve that.
Basically two different "worlds", two different concerns.
-
@laumapret I believe that supermarkets, especially supermarket chains, are in a powerful enough position to be able to avoid those antifeatures when buying their appliances.
Now, it is possible that the fridges that were hacked weren't kept up to date because the producer wasn't providing a reasonable way to do it, but I also wouldn't be surprised if the supermarket management decided to skip on doing so to save money.
My experience with industrial hardware producers tells me that it was definitely somebody being cheap somewhere, but whether it was at the producer's side or the supermarket side is equally likely.
-
@gemlog yeah, our fridges (plural, two households) in the new house are pretty old, and we have plans to look for new ones in the near future, but we will carefully look for ones that have zero smart features, because the producers for consumer appliance can't definitely be trusted with those.
The only thing that we plan to do is to attach them to a carefully selected smart plug that will send power usage data to *our* network and measure which one is the one that needs to be changed first. But as soon as we have collected enough data the smart plug will go back to its box to be used elsewhere for similarly short periods of time as needed.
-
btw, I'm not sure whether the news has gone around the world, or just remained on european newspapers, this is mostly about the fact that a few French supermarket chains got their fridges hacked and all of their frozen and refrigerated food spoiled.
it had been known for years that that model of fridge was easily found on shodan, and could be accessed with username admin (iirc) and a trivial password.
-
Some 20 years ago, while writing a book about the Interne and its risks, I found the remote maintenance panel of a Caterpillar 797¹ somewhere in South America freely accessible after just a search on Google for some phrases contained in the interface.
I don't even try the usual passwords, but this means a script kiddie can heavily damage a $5,000,000 truck just for the lols.
-
@GustavinoBevilacqua on a few years ago people were easily able to find control panels for hydroelectric plants on shodan. with those you can probably also kill quite a few people, not just damage expensive machinery. -
G gustavinobevilacqua@mastodon.cisti.org shared this topic
-
@valhalla un termometro connesso al mio home assistant é considerato come "collegato a internet"?
-
@alorenzi dipende, il termometro ce l'hai messo tu o il produttore? e hai la certezza che i dati vadano solo al tuo home assistant e non anche al produttore del termometro?
(e al tuo home assistant si arriva da fuori la rete locale, anche tramite vpn?)
-
@valhalla
Ou, it feels that there is some new supermarket fridge hacking drama I didn't know about? Interesting. -
-
@valhalla I understand the need to monitor, but less so the need to control remotely. If something begins to go wrong with temperature outside opening hours, presumably most of the time someone needs to get to the location anyway to check what's up.
-
@JankaWessman being able to control the temperature for all supermarkets (or all supermarkets in the same region or something) from a single place can have value, if they need to finetune the precise temperature they are set at (and the times at which they are set at that temperature, depending on whether the shop is open and the fridges are being constantly opened and closed or not)
