Researchers continue to find serious vulnerabilities in internet connected refrigerators
As companies running refrigeration units in the U.S. and Europe recover from recent hacking incidents, threat intelligence firms have disclosed more than a dozen new serious security vulnerabilities in popular products, while others continue to track intense interest from potential threat actors in similar internet-connected devices.
On Friday, cybersecurity firm VulnCheck published details on 14 vulnerabilities discovered earlier this year in Dixell refrigeration units, which are manufactured by refrigeration technology firm Copeland. According to lab testing with rebuilt versions of the vendor’s firmware, each flaw would have given an attacker “root” or administrative access to the infected unit. Many of the vulnerabilities have severity scores between 8 and 9.8, and at least two are known to be under active exploitation in the wild.
The vulnerabilities all affect Dixell and Copeland’s XWEB EVO supervision system, which is one of four known to have been affected in the October hack of refrigeration controllers in 700 supermarkets across France.
VulnCheck security researcher Valentin Lobstein wrote that he began looking into XWEB’s cybersecurity profile after reading that an affected device from another vendor was “almost insulting” in its lapses, including setting the password of the administrative account to the current day’s date. Then he began to look at XWEB’s access controls.
“It is worse than a weak daily code,” wrote Lobstein. “The login page runs the submitted username as a shell command before it ever checks the password.”
Lobstein and Vulncheck notified Copeland and Dixell and helped them fix the problems before disclosing the vulnerabilities, which now have patches available. Legacy versions of the supervisory system remain exposed to potential takeover.
Copeland confirmed to CyberScoop that certain XWEB monitoring solutions are affected. The company urged customers to keep their devices off the public internet and update to the latest patched software.
“We continue to recommend that customers follow industry-standard cybersecurity practices, including keeping devices off the public internet and maintaining software and firmware at the most current available levels,” a Copeland spokesperson wrote in response to a request for comment. “These practices help mitigate the reported risk. We have reached out to customers to reinforce previously provided cybersecurity best practices and patching guidance, and our teams are available to support them as needed.”
Meanwhile, XBOW researcher Max Günther set up a series of fake “honeypot” servers that mimicked the same affected vendors and models, underscoring just how quickly industrial controllers connected to the internet can attract unwanted attention.
Günther deployed the servers online as part of a fake chain of pizza stores and indexed them with search engines such as Shodan. He also set up an online dashboard to visualize the potential real-world impact of any hacks. Within a day, the servers were getting probed by attackers, with some attempting to access and alter temperature settings.
“I’ve already seen hundreds of requests, everything from generic PHP2Shell-related exploit probes to actual attempts to log in to the simulated refrigeration controllers,” he wrote on LinkedIn earlier this week. “And then someone seemingly managed to log in and change the temperature of one of my virtual freezers, defrosting all the virtual pizzas inside.”
French authorities have blamed the Iranian government for the supermarket hacks. A similar series of incidents affecting refrigeration units owned by the U.S. military are also suspected to be due to cyberattacks, according to Reuters.
