CISA and the FBI Warn Of Attacks against Industrial Refrigeration Controllers

US agencies warn attackers are going after industrial refrigeration controllers. The fixes are basic, and most start with getting them off the internet.

CISA, the FBI, HHS, USDA and the Department of Transportation published a joint advisory on attacks against industrial refrigeration controllers and cold chain monitoring systems. The activity is global. Healthcare, chemical, food and transport companies use these systems to watch temperatures, keep logs, run defrost cycles and save energy, including in refrigerated trucks.

“The authoring organizations are aware of malicious cyber actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities.” reads the advisory published by CISA. “The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.”

The targets are electronic temperature controllers and commercial refrigeration controllers used in grocery stores and cold-storage sites. Attackers may exploit flaws in unpatched or internet-accessible controllers to change settings remotely and force units into continuous heating and defrost cycles. In plain terms, someone could cook your freezer from the other side of the world.

The agencies identify three ways in: bypassing authentication, injecting arbitrary code, and exploiting weak configurations. Once inside, an attacker can change temperatures, which can shorten equipment life, create a fire hazard and destroy stock. Spoiled products that reach consumers can also create a safety risk.

“The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.” continues the adviosry.

An attacker can also hide the damage. Operators lose sight of current temperatures, and that’s a bad moment to learn a cold room has been warm for hours.

CISA’s Chris Butera adds that every organization that depends on these systems should assume it’s a target. The advice follows the Cross-Sector Cybersecurity Performance Goals from CISA and NIST, a minimum set of practices for any organization.

Start with exposure. Keep controller panels off the internet, and if you need remote access, put an up-to-date firewall or similar gateway in front of it. Then separate industrial equipment from the office network with its own virtual network.

Next, fix the basics. Change default passwords, use strong ones, and add phishing-resistant multifactor authentication where you can. Update firmware, and retire or replace devices the maker no longer supports.

Allow only trusted devices and IP addresses to change system settings. Keep tested backups in a separate location, disconnected from the network. Enable logging and regularly check the logs. If devices do not record activity, monitor the network traffic between them.

U.S. organizations should report suspicious activity to CISA’s 24/7 operations center or the FBI’s Internet Crime Complaint Center. Healthcare organizations can also contact HHS.

Reports should include the date, time and location of the incident, a description of the activity, the number of people affected, the equipment involved, and a contact person within the organization.

One control gets forgotten more than the rest. A controller shouldn’t be able to push a freezer past what’s safe, whoever is giving the orders.

“The authoring organizations strongly urge industrial refrigeration and cold chain monitoring system owners and operators to secure remote access to their OT systems.” concludes the report. “To strengthen system security, owners and operators should review the following resources and implement recommended mitigations:

• United Kingdom’s National Cyber Security Centre and Partners: Secure Connectivity Principles for OT“
• CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology
• CISA: Defend the Edge: The Critical Importance of Edge Device Security
• CISA: Internet Exposure Reduction Guidance

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)