Hacker News

Generally agree with your assessment, but in the case of Guam or other more remote installations if there were catastrophic issues we'd just airlift food in. Costly but certainly manageable.

Hawaii I'm not sure why that would be an issue unless the whole island was attacked or shut down. Even if the on-base shops were hacked you could just go shop at Wal-Mart or Costco or any number of other locations on the islands. If there was an extended issue then the commander could authorize meal stipends as they do for some units today and then you would just go buy food off-base. Ideal? No. Manageable? Very much.

I always wonder by folks with some "inside" knowledge like you will then come out to share more details. Why? I understand that there's no security through obscurity, but I don't think that the details to get your point across matters. Loose lips sink ships.

>Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly.

Are these materially different? Assuming that there wasn't a literal command to turn off all freezers, from an organizational, non criminal perspective, to the organization the damage will be the same, the root cause will be a bug (whether exploited by chance or malice), and the fix will be the same(fixing the bug).

America's tech-sector has a similar problem, which--until recently--was tempered by the idea that it was a dependable and predictable ally to most of its customers.

Not just in the sense of secretive kill-switches, but "US government commands you to turn over this encryption key and you're not allowed to say you did so" stuff.

Most factories I know do not allow their PLC be accessed from the internet. They are usually on a separate Network. However, the "engineering" station (the computer running e.g. TIA Portal) sometimes is.

The PLC engineers I had contact with usually had an electrical engineering background. That's why they like PLCs in the first place with the ladder logic programming languages, grafcet and if they feel fancy a bit of structured text (assembly like) or structured control language (pascal like). They indeed did not know much about software security but a great deal about machine safety.

A real security nightmare are older OPC servers (OPC-DA) which is super reliant on DCOM. OPC is quite important to connect the PLCs to SCADA systems or 3rd party devices.

Isn't this the industry expectation in that kind of equipment? If it was signed by a real CA the cert. could expire and render the equipment unable to communicate.

My mind was blown when I realized that the way tftp works is that as the machine is booting it asks the network if anyone has some software for it to run.

> In all fairness, the people who are experts in the field of Siemens PLC programming are usually mechanical-ish engineers and security is not in their skill set or on their mind.

Stuxnet was over a decade ago.

There should be a simple rule that everyone with the ability to understand things like PLCs should be able to grasp: your equipment does not touch the internet or external storage, period.

Those who can't grasp this concept should be shown the door with a recommendation that they find a less mentally-taxing line of work.

They are charging down that path because vulnerabilities that effect the refrigerators were disclosed the same day as 14 refrigerators failed in an absurd way. They all turned on the defrost cycle and heated the food.

The problem is the author should have put a few concise bullet points at the top. (14 freezers failed at the same time. They are all internet-controlled, and failed at the same time as a disclosure about a vulnerability. They all failed by turning on the defrost cycle and heating food.)

I really recommend skimming the article to the end.

(Unfortunately, the article really is so verbose it's a borderline rant.)

Obvious sabotage would be addressed promptly. Subtle sabotage could persist as a minor torment indefinitely.

The article has a post that says this happened across 14 bases at the same time.

I was thinking timezone update - because of course an internet-connected freezer needs updated zone info so one can configure defrost schedules without the benefit of UTC.

Even if it isn't an attack, you demonstrated how it could be one. The vulnerability is likely there and worth mitigating. Excellent investigation and write-up!

Hi, I'm the poster. Sorry for the unexpected attention! I saw this on Bluesky and thought it was interesting enough to share here. If anything the style of your writing makes it stand out in a good way, we shouldn't always have polished/corporate-speak posts here.

I thought this was excellent. It pulled together a whole bunch of interesting evidence, was very careful not to make claims that weren't supported by that evidence, and every time I had a question it answered my question in the next paragraph. Hope you publish more!

I came to these comments coz I was curious about the AI usage here, and FWIW I also thought it smelled AI written, but I didn't think it was slop. (IMO not all AI output is slop and not all slop comes from AI).

My main question was "did Claude do the investigation by itself or just write up the article from someone's notes?"

Also though, I'm quite willing to believe this is human written and the human just happens to have a Claudey style. The actual prose isn't that Claudey it's just the structure of how it presents ideas. But, Claude had to get that structure from somewhere. It's not that surprising to see people with that style of communication.

Could also just be a bunch of IoT devices running on synchronized time source that have what amounts to a defrost cronjob. And a latent bug that due to everything being synced and on the same schedule failed in the same manner (eg crashed the controller immediately after turning the heating element on and either didn’t boot back up or booted and some shitty programming forgot to check the heating element status). Saving state across boots or having a race condition of some sort like this gets my vote - since it’s a pretty common failure mode junior programmers are susceptible to.

I’ve seen similar too many times in my career - synchronized clocks are great until someone deploys a cronjob that fires at exactly the same time across the fleet and it breaks a certain OS or firmware revision. Which then exposes another bug that exists globally.

I definitely still subscribe to don’t attribute to malice what you can attribute to incompetence mindset.

Certainly all speculation though, real root cause will be interesting if it ever becomes public.

Iran is actively looking for ways to attack back against the United States especially against military targets without actually escalating the situation.

I'm sure some script kiddie broke into a government network, hacked an industrial process, and forced a limited supply piece of equipment into a failure mode that takes some thought and is more unique as an attack vector. It's just like buying hacks for CS source right?

>Generally, when a state actor has hacked something, they don't want the victim to know

Could be the Iranians, or someone aligned, conducting anti-morale operations. Could be the start of a series of small but annoying failures.

These aren’t your typical refrigerator or freezer, these facilities have walk-ins or purpose built cold storage with multiple evaporators and condensing units. A building automation system is pretty standard for most buildings above a certain size, and monitoring and controlling the refrigeration is usually a part of it.

Unfortunately, I would wager that all BAS software is full of flaws and holes, allowing access to it for the public internet seems like a bad idea. I need to be on my company VPN to access our locally hosted BAS front end (which I have authorized access for) which seems like the bare minimum security.

Yeah I don't know why "hack" is more obvious than this. Central control pushes an update, it bugs out and cooks a dozen commissaries' frozen foods. Smart hack would be to do this randomly and fly under the radar.

I'm in the firmware bug camp too. Over/under on "the remote management server went down and a bug on all the freezers decided to put them back into some form of local control where its first action was to do a defrost cycle then put it back into offline service"?

The article posits that they may just have centralized monitoring, not control. Since this didn't affect every location, I would assume it was a shared default password or something

This _IS_ the U.S. Government.

Because they’re prefabbed walk-in coolers or freezers (at minimum, they could be purpose built cold storage warehouses) with multiple condensers, evaporators, pumps, temperature sensors, and humidity sensors. The refrigeration equipment needs some sort of control system and direct digital control is the usual way to do that these days.

This is food storage for a commissary, aka a store. They don’t use residential refrigerators.

Freezer's went into defrost melting all the frozen food and ice. If they just go down you have days to weeks to respond before everything unfreezes just based on the thermal mass and size of the freezer.

This is a much bigger deal than the freezer being down.

The bold text use make me think it was largely LLM-written. Maybe even LLM-researched.

As the saying goes, the S in IoT stands for security

Not exactly strong evidence presented here, but it wouldn't be a surprise either

What's funny is that trump of all people is banning a lot of crap like this - internet connected chinese cars, internet connected solar panels, and other utility stuff.

But I fear the vested/wealthy interests involved in iot data mining, advertising, "relationship management" and plain "we own this"...

It (probably) prevents a comprehensive law supporting common sense.

How many people do you know that have always on microphones in their home so that they buy things from amazon or google trivia answers?

Yes

it's not AI generated so it must be true

The vulnerability research paper article mentions has a title that I could imagine an LLM take as an instruction - or a challenge.

I would agree, but the freezers going into high heat defrost mode seems like an intentional action from someone, whether that be incompetence or malice on the side of DeCA, or malice from a third party. If they got rid of the people commanding the freezers what to do, I feel like they'd just stay on whatever mode they were already on, rather than suddenly command all the freezers to defrost

To be fair, if you want to mess with your adversaries troop morale, screwing up dinner is pretty effective.

General Stupidity should probably be demoted for this.

This is exactly the sort of thing that a saboteur would want its targets to think.

“If sovereign and subject are in accord, put division between them.” —Sun Tzu, The Art of War

Oops, you're absolutely right to call me out for that. Starting the defrost cycle without emptying the freezer first COULD lead to spoilage. The load-bearing temperature is 0 degrees Celsius — above that point, and frozen food starts to go bad.

It'll take them two weeks and then they'll find the systems were hacked half a year ago and they had industrial robots write messages on a literal chalkboard in order to share progress.

Anthropic: “We opened the pantry door!”

Can you spell out the danger this blog post represents?

what's with the pearl clutching?