Why are fridges being hacked around the world? | BBC News — Transcript

Full transcript

1. 0:00ice creams, pizza,
2. 0:02all that useless now.
3. 0:05>> Cyber criminals have once again targeted
4. 0:07[music] European supermarkets.
5. 0:09>> It's insane. I don't see what they stand
6. 0:10to gain from it. It's a form of
7. 0:12terrorism. [music] Really
8. 0:13>> simply told the units to heat up instead
9. 0:15of cool down. In some cases, [music] the
10. 0:17temperatures are said to have risen to
11. 0:19as much as 50° C.
12. 0:21>> Has happened just a couple of weeks ago
13. 0:22in France [music] and now it's happening
14. 0:24throughout uh the rest of Europe.
15. 0:26Several regional French uh blood banks
16. 0:29have been affected.
17. 0:30>> Harm has been kept to an acceptable
18. 0:32level. It's time [music] to fix that or
19. 0:34the consequences could be worse than
20. 0:36they've ever been.
21. 0:41Fridges and freezers in supermarkets
22. 0:44across Europe have fallen prey to a wave
23. 0:47of cyber attacks. hackers managing to
24. 0:49remotely crank up the temperature to 50
25. 0:52degrees C, causing thousands of euros
26. 0:55worth of food to be thrown out. Blood
27. 0:58banks in France have also been targeted.
28. 1:01Well, over the next 10 minutes, we'll be
29. 1:03looking at how these fridges can be
30. 1:06hacked, whether Russia or Iran could be
31. 1:09behind it, and whether artificial
32. 1:11intelligence could supercharge these
33. 1:13types of attacks in the future. So,
34. 1:16let's start with the basics. Why are
35. 1:19fridges in supermarkets even connected
36. 1:21to the internet? Well, here's Jake
37. 1:23Moore, global cyber security adviser at
38. 1:26ESET. Supermarket fridges are connected
39. 1:29to the internet because it simply helps
40. 1:31those engineers that are sitting
41. 1:33remotely far away from those fridges and
42. 1:36freezers and they can then control them
43. 1:38and do things like checking that they
44. 1:40are still uh online and they can check
45. 1:43the temperature. Maybe they need to
46. 1:45update that temperature to go up or down
47. 1:47a little bit. But unfortunately, that
48. 1:50then opens risk because it's on the
49. 1:52internet. Hackers can equally then try
50. 1:54and use the same techniques to get in
51. 1:57there and adapt to take advantage of
52. 1:59that and that's where the problems lie.
53. 2:02So that's why they're connected to the
54. 2:05internet. So now let's ask how did
55. 2:07hackers gain control of them and raise
56. 2:09the temperature. Here's our senior
57. 2:11technology reporter Chris Valance.
58. 2:14Well, the alarming thing is it's not
59. 2:15that complicated. Essentially, what
60. 2:17happened here is we had two makes of
61. 2:20these fridge controller devices that
62. 2:22were connected to the internet. And
63. 2:23there were known security weaknesses uh
64. 2:26with those devices. And so what the
65. 2:28hackers did, we imagine, is that they
66. 2:31used widely available tools that will
67. 2:33let you search the internet for things
68. 2:35connected to it. And basically ask those
69. 2:37tools, where are these devices? And then
70. 2:40they were able to use the known and
71. 2:42security weaknesses to uh take control
72. 2:46of these devices. And in some cases that
73. 2:48was very straightforward. For example,
74. 2:50one problem was that uh one make of
75. 2:53these devices came with a set of
76. 2:55passwords, default passwords. And that
77. 2:57these were set out in if you like the
78. 2:59the sort of the user guide. You could
79. 3:01find them easily on the internet. And
80. 3:03many places simply hadn't bothered to
81. 3:05change those passwords. So all the all
82. 3:08the hackers had to do was find one of
83. 3:10these devices, connect to it, type in
84. 3:13the password, and then they had control.
85. 3:16Well, our correspondent Nick Beak has
86. 3:18been to one supermarket that's been
87. 3:20targeted by hackers.
88. 3:22>> All that you can see here is having to
89. 3:24be thrown away. But come and have a look
90. 3:25at this cuz it tells the story. The boss
91. 3:27of this supermarket just outside
92. 3:29Brussels reckons that about 100,000
93. 3:32euros worth of produce is having to be
94. 3:35thrown away. That's more than £80,000
95. 3:38worth of stock. What happened was in the
96. 3:40early hours they found out that the
97. 3:42temperature of the fridges and the
98. 3:44freezers had been put up to 50° C. So
99. 3:47they've had to chuck out all of this
100. 3:49food. So here we've got ice creams,
101. 3:51pizza,
102. 3:53all that useless now. Now these hacks
103. 3:57haven't just targeted supermarket
104. 3:59fridges though. Hackers have also
105. 4:01attacked French blood banks. Chris
106. 4:04Valance again. Well, there have been
107. 4:06reports that among those impacted by
108. 4:08this issue with fridge controllers,
109. 4:10several regional French uh blood banks
110. 4:13have been affected um according to the
111. 4:15reports out today and indeed um
112. 4:17statements from the French Ministry of
113. 4:19Health reported by Reuters. Um again,
114. 4:22this seems to have affected uh cold
115. 4:24storage facilities used to store blood
116. 4:26products. Apparently, we believe no
117. 4:28blood products were damaged according to
118. 4:29the French Ministry. Uh but again it
119. 4:32underlines the uh challenge here that
120. 4:36when you talk about something like a
121. 4:37fridge controller, [music] it can uh
122. 4:39impact lots of different businesses.
123. 4:42>> So where did these latest attacks
124. 4:44actually happen? And have there been
125. 4:46similar hacks on fridges before? Take a
126. 4:49look.
127. 4:49>> The latest attacks targeted around 40
128. 4:52supermarkets in Belgium and Luxembourg.
129. 4:55Fridges were also hacked in Sweden,
130. 4:57Ireland, the Netherlands, Estonia, and
131. 4:59Finland. A similar wave of attacks hit
132. 5:02French retailers in mid-occtober,
133. 5:04forcing some fridges to warm to 50°
134. 5:07overnight. And something similar
135. 5:09unfolded in the US in early August. A
136. 5:12series of fridge malfunctions at a
137. 5:14number of American military bases.
138. 5:17Officials are working together to work
139. 5:19out if the incidents are linked.
140. 5:21>> Working out who is behind these attacks
141. 5:24is not easy. Hackers obviously take
142. 5:26great care to hide their tracks. And
143. 5:29even when there is a claim of
144. 5:31responsibility, it can be other hackers
145. 5:33trying to take the credit. With that in
146. 5:36mind, Chris Valance looks at some of the
147. 5:38theories. Some security companies have
148. 5:41said that the hacks that they've
149. 5:43observed uh bore the hallmarks of uh
150. 5:47Russian linked groups. Other security
151. 5:50companies have claimed they bear the
152. 5:51hallmarks of Iranian linked groups. We
153. 5:55have uh two claims from Russian activist
154. 5:59groups to have carried out this attack.
155. 6:02But those claims again have to be
156. 6:05treated with some caution. The claims
157. 6:07for example were deleted from the
158. 6:09telegram channel where they were posted.
159. 6:11People will look for corroboration from
160. 6:14those hackers before they'll be
161. 6:16confident in saying those groups were
162. 6:18responsible. But at the moment there are
163. 6:21many people who say we just can't be
164. 6:23sure who was behind this.
165. 6:25>> So then what else is vulnerable to these
166. 6:28kinds of attacks? Well, Kieran Martin is
167. 6:30the former chief executive of the UK's
168. 6:33National Cyber Security Center.
169. 6:36>> When it comes to physical safety, most
170. 6:39things are safe. So when you get in a
171. 6:42plane, for example, if the plane's
172. 6:45computer is hacked, the pilots know how
173. 6:47to land the plane safely. Similarly,
174. 6:49when people hear that this is a hack of
175. 6:51of fridges, they think, well, is my
176. 6:53internet connected fridge at home safe?
177. 6:54These are completely different. These
178. 6:55are industrial. But there are the wider
179. 6:58things that governments, businesses, and
180. 6:59you and me have to worry about. Can we
181. 7:02keep schools open if hackers, for
182. 7:05example, stop their ability to pay
183. 7:07teachers? Can we keep hospitals running
184. 7:09if admission and triage systems are not
185. 7:12available? So this is a pretty important
186. 7:15lesson that we need to maintain [music]
187. 7:17and improve our cyber security
188. 7:19resilience massively.
189. 7:21>> So how can we defend ourselves against
190. 7:24these sorts of attacks? Well, global
191. 7:27cyber security advisor Jake Moore
192. 7:29explains
193. 7:30>> the most important thing that businesses
194. 7:32can do is keep those devices that are
195. 7:35hugely critical completely separate.
196. 7:38Now, if they have to be on the internet,
197. 7:39then they should be using uh VPN, so
198. 7:42virtual private networks, not on a
199. 7:44public network. They also need to keep
200. 7:46those appliances up to date with the
201. 7:48latest patches. Just like we need to
202. 7:50update our phones, we need to update
203. 7:52anything that's connected to the
204. 7:54internet and not be using very basic or
205. 7:57default passwords because that's how
206. 7:59hackers can can get in. Now, this attack
207. 8:02doesn't appear to have used artificial
208. 8:04intelligence, but could AI make these
209. 8:07sorts of attacks more likely or more
210. 8:10damaging? Here's Jake Moore again. So,
211. 8:12AI has come along and can speed up the
212. 8:15way in which it finds those
213. 8:18vulnerabilities. It's effectively called
214. 8:20a vulnerability scanner. This is what
215. 8:22humans can do, but AI can do it a lot
216. 8:24quicker. And if it can do it quicker, it
217. 8:26means that those attacks could happen
218. 8:29much sooner than we first expected. So
219. 8:32really AI is going to play a part in
220. 8:34this. Equally though, we can also use AI
221. 8:36to help us, the good guys, defend
222. 8:39against those [music] types of attacks.
223. 8:41So it's really about fighting fire with
224. 8:43fire. AI isn't going anywhere and both
225. 8:45sides are going to be using it.
226. 8:47>> So what does this mean for the future of
227. 8:49cyber security and how serious could
228. 8:52these attacks become? Back to Kieran
229. 8:54Martin.
230. 8:56>> If you think about the ease with which
231. 8:58this was done, and then think about how
232. 9:00both hostile nations but also new AI
233. 9:02capabilities can help speed and scale up
234. 9:04these types of attacks, you can do more
235. 9:06of them than you used to be able to do.
236. 9:09And if you think about the major
237. 9:10disruption that could be caused by lots
238. 9:12of these types of events happening at
239. 9:14the same time in one country for example
240. 9:17then that country is in quite a lot of
241. 9:19trouble quite a lot of economic pain and
242. 9:21social distress and and that's what
243. 9:24adversaries want. So the implications
244. 9:27are we have years, decades of what we
245. 9:31call in the cyber security profession
246. 9:32technical debt. Stuff that just should
247. 9:34have been fixed or updated ages ago and
248. 9:37we've been coasting and harm has been
249. 9:39kept to an acceptable level. It's time
250. 9:41to fix that or the consequences could be
251. 9:44worse than they've ever been. It's a bit
252. 9:46like there's some bad security practices
253. 9:48that have been hiding out in the dark
254. 9:50and AI combined with geopolitical
255. 9:52tensions are are shining a search light
256. 9:55on them and they're finding them.
257. 9:56>> And that's the very latest on the cyber
258. 9:59attacks on fridges across Europe.