Cyber ​​attack on cooling systems: Refrigerators at the French blood bank have now also been hacked

After supermarkets, hackers also sabotaged refrigerators belonging to the French blood donation service. On Wednesday, the broadcaster BFM reported that the attackers had adjusted cooling systems for blood supplies from minus 30 to 110 degrees Celsius. Since the incident was noticed quickly, no damage was caused. Otherwise, blood donations intended for patients might have been lost.

Already on Monday, hackers in several European countries had switched the cooling systems of various supermarkets from cooling to heating. In Germany, individual stores in North Rhine-Westphalia, Lower Saxony and Bavaria were also targeted, including branches of the CAP, Edeka and Rewe chains. A butcher's shop in the Bavarian Upper Palatinate is also affected. There had already been similar attacks on French supermarkets in October.

The hackers always exploited vulnerabilities in the cooling systems controlled via the Internet. Older systems from the Danish manufacturer Danfoss were among those affected. The IT security expert Christoph Fischer criticized the fact that manufacturers had delivered control systems with unchanged factory settings and standard passwords. According to Fischer, the operators of the refrigerators should have received updates long ago that required passwords to be changed.

The backdoor on older devices was created because the standard password was primarily made up of the current date, said IT expert Christoph Kunz on NDR. This makes it easy to guess. The hackers could then access the controls via the browser and change the temperature of the refrigerator shelves. This attack is not very complicated, says Kunz.

In Fischer's opinion, individual passwords should be assigned when the devices are first put into operation. Remote access via the Internet could be useful for maintenance, but it must be secured, “for example using certificates and asymmetric encryption”.

The problem: The older refrigerator models no longer receive security updates to close the gap, says Kunz. According to the IT news service heise online, the manufacturer Danfoss limited itself to recommending that customers replace their old devices.

In mid-October, the Federal Office for Information Security (BSI) issued a series of recommendations for operators of “small and very small industrial technology”. Above all, the BSI recommends that such systems should not be accessible directly from the Internet. To do this, operators could secure access using virtual private networks (VPN), multi-factor authentication and secure passwords. Regular software updates are also essential. However, this only works if there are some. (with dpa)