posted in Technology
'Unprecedented' Cyberattack cripples supermarket fridges across Europe as hackers activate automatic defrosting — delivery and store prices also impacted by incident
www.tomshardware.com/tech-industry/cyber-security/unprecedented-cyberattack-cripples-supermarket-fridges-across-europe-as-hackers-activate-automatic-defrosting-delivery-and-store-prices-also-impacted-by-incident
Replying to @return2ozma@lemmy.world
Im surprised that the EU doesnt have a secuirty requirement for IT infrastructure in the food supply. Seems like an oversight
Replying to @fruitycoder@sh.itjust.works
There’s nothing as far as I know, even in industrial settings. Some companies are better than others, and some fields are better than others, but at the low level everyone does whatever the fuck they want. Always-connected teleservice routers and similar devices are everywhere, with outdated firmwares just waiting to be hacked. It’s improving but very slowly.
Replying to @Damage@slrpnk.net
Erh we have the NIS2 directive… requirements are skyyyyyy high for critical infrastructure which is surprisingly a lot of industries. Among other things vulnerability management is a topic companies subject to NIS2 must cover. Not saying that it cannot happen to have outdated crap connected somewhere but the exposure is getting fast smaller and smaller.
Replying to @a4ng3l@lemmy.world
Very limited scope
Replying to @Damage@slrpnk.net
As in what?
Replying to @a4ng3l@lemmy.world
As in for example this case isn’t covered
Replying to @Damage@slrpnk.net
Food food supply chain isn’t covered? Isn’t it under « important entities »?
Replying to @a4ng3l@lemmy.world
Distribution not retail
Replying to @a4ng3l@lemmy.world
The problem as that these directives and standards are completely beside the point. They do manage a lot of security-relevant stuff, but in the end what’s hacked isn’t the documentation the standards require but the actual code running on the machine.
And there’s pretty little that the standard can do against actual honest bugs and mistakes in the code.