未知攻击者对法国约700家超市的冷链系统发动了大规模网络攻击1。攻击者通过远程控制器的安全漏洞获得管理员权限，远程激活除霜装置，导致冰箱温度升至50摄氏度1，造成大量食品腐烂，部分电气系统还因此起火1。
这场事件的根源在于设备制造商的安全防护缺陷。Danfoss、Dixell和Copeland等厂商生产的冷链控制器存在严重漏洞，其中Danfoss控制器采用每日更换密码的机制，但该密码可被公开固件代码破解1。更为严重的是，相同的密码在数百或数千家门店的设备上通用1，这为攻击者提供了大规模入侵的便利条件。
Unknown attackers compromised the refrigeration systems of approximately 700 supermarkets across France by exploiting serious security vulnerabilities in remote control devices, according to findings from Ars Technica 1. The attackers remotely activated defrost mechanisms on freezers manufactured by companies including Danfoss, Dixell, and Copeland, causing internal temperatures to climb to 50 degrees Celsius (122 degrees Fahrenheit) 1. The resulting food spoilage and electrical malfunctions caused fires in some locations 1.
The breach stemmed from poor security practices embedded in the controllers themselves 1. Controllers produced by Danfoss were designed to change their access passwords daily, but the passwords could be cracked using publicly available firmware code 1. More critically, the same credentials were used across hundreds or thousands of store locations, allowing attackers who obtained one password to gain administrative access to devices in multiple facilities 1.
评论
还没有评论，欢迎留下第一条。