A society that thinks and imagines itself as hyper-technological and connected, but which suddenly finds itself vulnerable. After the hacker attacks in recent weeks on the freezers of several European supermarkets, the threat of cybercriminals could enter our homes directly. We talked about it with Walter Narisoni, Director Sales Engineering, South EMEA, of the cybersecurity company SOPHOS who explained to us what the vulnerabilities are of tools that we considered harmless and how to keep them, and ourselves, safe.
How was it possible to intervene remotely on the refrigeration systems of European supermarkets? What vulnerability was exploited?
These attacks were possible because some refrigeration control systems were directly accessible from the Internet without adequate protection measures. To give an idea of the order of magnitude of this problem, although it is important to point out that an exposed system is not necessarily a compromised system, it should be considered that Sophos researchers had identified approximately 2,700 Danfoss StoreView systems exposed on the Internet worldwide, of which approximately 1,500 in France.
In this specific case, the attackers exploited management interfaces exposed online and default passwords that had not been changed. The problem therefore does not necessarily concern a particularly sophisticated vulnerability, but a combination of errors in configuration and security management. Devices designed to control physical processes, such as the temperature of industrial refrigerators, were accessible from the outside and could be manipulated by unauthorized persons. Once access was gained, hackers could remotely change operating parameters, compromising the preservation of products. This is a very concrete example of how a cyber attack can have consequences in the physical world, going far beyond the theft of data or blocking a computer.
Can any device connected to the Internet today potentially become a target of a cyber attack?
Potentially yes. Any device connected to the Internet can represent an entry point for an attacker, especially if it is not updated regularly or does not have adequate protection systems. It's a problem we've known about in the corporate world for some time: businesses use lots of connected devices, from industrial sensors to climate control systems, and not all of them were designed with cybersecurity in mind. For this reason, companies adopt measures such as network segmentation, which allows the most vulnerable devices to be separated from critical systems. The same principle applies to our homes: the more devices we connect to the network, the more potential access points increase. This does not mean that every connected object is dangerous, but that safety must be considered from the moment of installation and maintained over time.
Can the smart refrigerator we have in the kitchen, connected to Wi-Fi and manageable through an app, be hacked? What consequences could it have?
Yes, even a smart refrigerator can be hacked, like any other connected device. If an attacker managed to compromise the control system, he could potentially modify some settings, within the limits of the functions that the device allows to be managed remotely. For example, it could alter the storage temperature of food, with the risk of compromising its quality and safety. But there is also another aspect to consider. A vulnerable home appliance could be used as a starting point to try to reach other devices connected to the same home network. The problem, therefore, is not only what a hacker could do to the refrigerator, but also the fact that a seemingly harmless object could become a weak point in the security of our home. Naturally, the concrete possibility of carrying out these attacks depends on the characteristics of the device and the protections present.
Cameras, thermostats, video intercoms, electronic locks and voice assistants: how safe are the objects in our smart home really?
There is no one-size-fits-all answer. The level of security depends a lot on how they were designed, the protections integrated by the manufacturer and, above all, how they are managed over time. A device can be secure when purchased, but become vulnerable after a few years if new security flaws emerge and the manufacturer doesn't release updates to fix them. It is especially important to pay attention to objects that have access to personal information or that control physical functions of our home, such as cameras and smart locks. The fundamental point is that cybersecurity is not a characteristic that is acquired once and for all. It is a condition that must be maintained over time. For this reason, when we buy a connected device, we should check not only what it is capable of doing, but also what security guarantees the manufacturer offers and how long it will continue to support it.
What is the most underestimated risk? Could a hacker collect information about our habits or take control of home devices?
Both possibilities exist, but the most underestimated risk is probably that of considering these devices as simple household appliances, forgetting that they are in effect small computers connected to a network. A compromised camera could allow an attacker to observe what is happening in your home. A device that records information about our activities could reveal some daily habits. And, in cases where the attacker manages to access control functions, he could also modify the behavior of certain devices. However, we must not imagine that every attack necessarily leads to these consequences. Much depends on the type of device, its capabilities, and the level of access the attacker gains. The most important risk to understand is that when a computing device controls something in the physical world, a digital vulnerability can have real consequences on our daily lives.
How heavy is the producers' responsibility? Should they be required to provide updates and protection for the life of the product?
Producer responsibility is fundamental. Today we buy an appliance by evaluating its price, performance, design and energy consumption, but we rarely ask ourselves how secure it is from an IT point of view. Yet, if a device is connected to the Internet, cybersecurity should be considered an essential feature of the product. In my opinion, manufacturers should provide security updates for a clearly defined period appropriate to the life of the device, as well as make information on vulnerabilities and how to fix them easily available. It would also be important to introduce or strengthen specific certification systems for the cybersecurity of connected products, so that consumers can more easily recognize those that comply with certain security requirements. We cannot expect every citizen to become a computer expert to use a refrigerator, a camera or a thermostat. Security must be integrated into the product right from design and maintained over time.
How much impact can artificial intelligence have? Can it facilitate the identification of vulnerabilities and multiply attacks?
Artificial intelligence is significantly changing this scenario, because it allows us to automate tasks that until recently required very high technical skills. For example, it can help examine large amounts of code and identify possible vulnerabilities in devices and software. It can also facilitate the creation of tools and procedures to exploit these weaknesses. This means that even people with relatively limited IT skills can have access to capabilities that were previously reserved for specialists. The risk is therefore an increase in the speed and quantity of attack attempts, also against connected devices. However, we must remember that artificial intelligence is a tool that can also be used to defend oneself, identifying vulnerabilities and suspicious behavior more quickly. The challenge will be to use these technologies to strengthen security, taking into account the fact that attackers can also exploit them.
What can we concretely do to protect our connected home? What precautions should we take?
There are some relatively simple precautions that can significantly reduce the risks. The first is to avoid making our devices directly accessible from the Internet when it is not necessary. A smart refrigerator or washing machine, for example, should not have management interfaces publicly exposed on the network. The second is to always change the default passwords, choosing strong and different credentials for each device or service. When available, it's important to also enable multi-factor authentication, which adds an additional layer of protection. Another key measure is to keep your devices up to date, possibly by enabling automatic security updates. It is also advisable to separate, when possible, smart objects from other home devices, using a dedicated Wi-Fi network, as long as it is effectively isolated from the main network. This way, if an appliance were compromised, it would be more difficult to use it to reach computers or other systems. For remote connections that require direct access to your home network, a properly configured VPN can be a more secure solution than publicly exposing your management interfaces. Finally, it is important to choose reliable manufacturers, check that they guarantee security updates and disable connection features that we do not use. The principle to remember is simple: we must not give up the advantages of the smart home, but we must learn to consider cybersecurity an integral part of its operation.
