> The laptop class doesn't always grok that the shift-work labor class ...
I think it's more than this. Industrial control system upgrades are serious business and (at least if you're doing them properly) require a lot of planning and consideration. Particularly when the subsystem being replaced is decades old already.
I think the overwhelming majority of people (including on hn) have no understanding of how complex industrial systems are - even as-built, but particularly after decades of evolution. Doing proper engineering in these spaces is expensive.
You can reasonably blame supermarket chains for being insecure, but we certainly aren't currently enabling them (or anybody else) when it comes to fixing these issues.
But you don't need to replace entire system to massively reduce surface area for the attack. Just do what was done for decades, and put the vulnerable devices between VPN and/or additional authorisation layer.
It's far less work than touching anything on controller side (at most changing some network settings) and requires attacker to at the very least penetrate your network perimeter and snoop around to find it rather than "run nmap on a controller's default port over country's IP range"
Is it more expensive to keep your systems upgraded and maintained or to have all your product get destroyed one arbitrary day and then have to pay to do the upgrade anyways so that the arbitrary property destruction doesn't keep happening?
In before "but insurance"; yes insurance can in theory mitigate some of this, but I feel like people on HN have no understanding what it's like to deal with a multi-million dollar insurance claim that the insurance company 100% does not want to pay out. The legal battles over such things take years and are on their own incredibly expensive.
> Is it more expensive to keep your systems upgraded and maintained or to have all your product get destroyed one arbitrary day and then have to pay to do the upgrade anyways so that the arbitrary property destruction doesn't keep happening?
It happened once. Did you do the maths here? Can you tell us which one was Kore expensive and what percentage chance there was of this hack happening?
Someone did the math. Cost of continual maintenance, versus cost of product loss. They determined it wasnt worth the maintenance cost, and accepted that risk. And that risk manifested.
This happens all the time. Unfortunately, in my experience, most of the risk acceptance happens without even really believing in the cost of the risk, and people just accept everything. it is highly likely someone like that accepted this.
The polite term is 'self-insurance', and it's often the right move.
That class of risk was just theoretical for decades, so the price on it was basically 0.
Now that we see large scale incidents will there be an actual money value associated with upgrading systems and security for supermarket appliances.
I think it's fair that the price up until now has been mostly zero. On the other hand you can 10+ years of examples on HN of people saying these types of threats with IoT devices and internet connected industrial hardware are not theoretical and it's shocking they weren't being exploited more often.
I can find 10+ years of examples on HN of people saying all kinds of stuff, and it's shocking how outlandish that so much of it is.
In my recent experience (last 3 months) with a cyber claim getting insurance to pay out was actually pretty straightforward. It was about a $250K USD loss on a phishing attempt (someone hijacked and rerouted payment details for a wire)
The fix is taking them off the internet, use DOS, and require manual insertion of a floppy to make updates.
I get the first and last point, but how does DOS help?
You can use a modern operating system just fine.
I ascertain that they were using hyperbole as a form of humor.
I work in SCADA development, and believe me, there's a reason the industry moves slowly.
This slowness also means it sometimes has a hard time understand new risks and a lot of industrial systems are not operated by people who understand those risks and do…very stupid things.
This comment could be a lot more interesting, useful and worth typing than it is. :(
Sorry, it was a busy day. I was agreeing with everyone else here. The move fast and break things attitude is one we can't afford when building control systems for critical infrastructure. I used to work in big tech, and if I pushed an update that didn't work or wasn't tested properly, the worst thing that could happen was we revert the change and there's a minor inconvenience to a user. If Facebook goes down for an hour, the company loses money, some advertisers get mad, and their users get frustrated. If an industrial Siemens SCADA operation goes down for an hour, the best case is the operation (be it a factory, airport, wastewater plant, etc.) shuts down for an hour. The worst case is people get sick or die.
It sounds dramatic but every update or change to the system rocks the boat and exposes it to a whole new tranche of dangers. So we spend most of our time observing. There's no such thing as a casual QoL update in SCADA.
What I don’t get is, if it’s so critical, why wasn’t the bare minimum done to isolate the hardware from the Internet At Large?
I think for the big players, it often is, my impression is the more systemic risk is smaller players (like very local utilities) these are sometimes run by very unserious people.
Most SCADA systems date from the 1970s and a lot of them don’t really think about network security or even have a concept of it. So, they don’t think about the consequences of connecting it to the Internet for remote access. It’s just a feature they want.
Go on.
Yeah the margins are tiny because private equity has spent the better part of the century destroying American dynamism and outsourcing all externalities including getting hacked to the people.
This is only partly true, historically before private equity was a thing grocery was always a razor thin margin business that operated on volume. PE just made it worse.
My in-laws had a family grocery store back in the 60s and 70s. Privately owned and operated, no way they'd have been paying any attention to security concerns like this.
Their only chance would have been if appliance companies wouldn't be dumb enough to put a simple refrigerator on the public internet in the first place.
My appliances will never be networked, for this very reason. Risk to reward is just not there.
This is happening in France.