Latest / Beyond the Byte / Hackers Turned Supermarket Freezers Into Heaters. Is a Digital Crisis Next?
Transcript
- Mo Hafez: Hi. I want to talk about something that's been bothering me this week. I've been looking at a collection of headlines, and individually they might not seem all that connected. The Pentagon is preparing military bases to operate independently of the civilian power grid for extended periods. Some plans envision up to 90 days. Meanwhile, the British government is encouraging households to prepare for three days without essential services. The European Union is doing something similar. And then there is this bizarre story out of Europe. Someone has been hacking supermarket refrigeration systems, not stealing credit cards and not holding customer data for ransom, but actually changing the temperature of the refrigerators and freezers remotely, causing food to spoil. In Sweden, some freezers reportedly reached 50 degrees Celsius. That's 122 degrees Fahrenheit. And this wasn't just one supermarket. We saw attacks across France in October, followed by another wave across Europe earlier this week. Meanwhile, the Pentagon is also investigating suspicious refrigeration failures at American military bases. Now, I'm not suggesting all these incidents are connecting. We don't have evidence of that. And I'm certainly not suggesting that there's some secret global blackout or cybersecurity incident coming in the next couple of weeks. But I do think there's a bigger story here. What if the next major global crisis is a digital one? And would we actually be prepared? Welcome back to Beyond the Byte. I'm Mo Hafez. Today, I want to connect some of these stories, explain how cyber attacks actually work, and explore why the systems we depend on may be more vulnerable than we realize. And one quick favor before we get into it, if you're watching on YouTube, take a second to check that you're subscribed. YouTube doesn't always show you every new episode, even if you've watched before. Subscribing is free, it takes a second, and it really helps me keep bringing you these conversations. So if you haven't already, I'd really appreciate it. All right, let's get into it. let's start with these refrigerators because I know what some of you are thinking. How on earth do you hack a fridge? Well, it's actually a great example of something I spend a lot of time explaining whenever I talk about cybersecurity. You see, when we think about hacking, we often picture somebody breaking into a computer, stealing passwords, or downloading sensitive information. But computers don't just store information anymore, they run things. Factories, elevators, electrical equipment, water treatment plants. Commercial refrigeration. We call that operational technology or OT for short. And here's the difference. IT is generally about the information, information technology. OT is about what the machines actually do. Now, imagine you own a chain of a hundred supermarkets. Every store has refrigerators, freezers, and equipment that needs to be monitored. Instead of sending some technicians to every location, you connect these systems to a network. Now somebody can check temperatures remotely, adjust settings, and diagnose problems. That's convenient and it's very efficient, but you've also created a way for someone to interact with physical machinery through software. And if that connection isn't properly secured, somebody who shouldn't have access might be able to change those settings. And that's the concern illustrated by these European incidents. Attackers manipulated refrigeration controls, causing equipment to heat up when it should have been cooling. Now think about that for a second. The electricity is working, the machinery is running, but the instructions have changed. And suddenly you've got real-world damage caused by somebody manipulating software. Now imagine that instead of controlling refrigeration, the compromised system controlled a water pump or part of an electrical network. That's where things get more serious. And while refrigerators were being hacked, October was also a particularly rough month for the software infrastructure we depend on. To the point that it's being called Black October. We had critical vulnerabilities discovered in PHP, which is a technology that powers a huge portion of the web. We also have a compromised release of Lite LLM, which is a tool that developers use to connect applications to AI models. We also saw problems with digital certificates, which are part of how computers establish trust when communicating over the internet with each other. Now I'm not going to get into all the technical details. That's an entire episode by itself. But here's what I find fascinating. These incidents exposed weaknesses at different layers of the internet. The software running websites, the tools developers download and trust, even the systems computers use to verify who they're communicating with. And that Lite LLM incident is a particularly interesting example of something called a supply chain attack. That is, instead of attacking every application individually, An attacker tampers with software that lots of other applications and companies depend on. It's a bit like contaminating a product before it reaches the store, rather than visiting every customer individually, or what we call poisoning the well. And because so many organizations rely on the same underlying technologies, the potential impact of a single compromise can be enormous. These were separate incidents, and not every vulnerability resulted in a successful attack. But they do illustrate something important. We don't always see the technological foundations holding our digital world together. We just assume they'll work until they don't. And we've already seen what happens when critical systems fail. In 2015, cyber attackers disrupted electricity distribution in Ukraine, leaving approximately 225,000 customers without power. In 2021, Colonial Pipeline suffered a ransomware attack. And the company shut down pipeline operations as a precaution. So suddenly, a cybersecurity incident was disrupting fuel distribution across parts of the United States. And remember the CrowdStrike outage in July 2024? That wasn't even a malicious cyber attack. It was a faulty software update that affected millions of Windows computers. Airlines, hospitals, and businesses around the world were disrupted. Now, those are three very different incidents, but they demonstrate something about our modern infrastructure. A problem in one system can affect things that seem completely unrelated. Your grocery store depends on electricity, on payments, on communications, and on transportation. And those services have dependencies of their own. And we've built an incredibly interconnected world and that's given us enormous benefits. But it also means a serious disruption Can spread far beyond wherever it started. Which brings me back to that doomsday scenario that we were looking at. So why is the Pentagon preparing? Well, the Pentagon has an initiative called Fortress America, focused on making military installations more resilient and less dependent on civilian infrastructure. Now, part of that involves generating electricity independently of the grid with ambitions for prolonged operations without outside support. And strategically, that makes sense. You can't assume the infrastructure supporting military operations will always be available, especially during a conflict. But here's what caught my attention. Across Europe, governments are having a similar conversation about civilian preparedness. The UK has been encouraging households to be ready for several days without essential services. And just two days ago, on November 3rd, the European Commission issued additional preparedness guidance. Now, these aren't all warnings about cyber attacks. Governments are preparing for Extreme weather, geopolitical conflicts, sabotage, and other emergencies too. And I haven't seen credible evidence that any of this points to an imminent global blackout, but I don't think we should be dismissing the underlying concern either. Because what happens if electricity or communications become unavailable for several days? What happens to banking, to food distribution, or healthcare? And how many organizations have actually tested whether they can continue operating? I think those are much more useful questions than trying to predict some date when the world might go dark. Now, let's add AI to that equation because this is where artificial intelligence comes in. Not necessarily as the villain of the story. There's no verified evidence that AI caused these refrigeration attacks, but AI could change the speed and scale of cyber attacks. Think about what a skilled attacker traditionally has to do, find potential targets. Understand their systems, look for vulnerabilities, and test different approaches. And that takes time and expertise. Now, AI can help automate parts of that process. And with agentic AI, we're talking about systems that can do more than answer questions. They can use tools, they can interact with software, and they can carry out sequences of tasks autonomously. So instead of a person manually investigating one potential weakness, AI agents could help investigate many. And that's what makes this interesting. Because the concern isn't necessarily that AI invents some entirely new way to hack the internet, so to speak. It's that weaknesses we've known about for years could potentially be discovered and exploited much faster and at a much greater scale. In fact, just a few days ago, Britain's National Cybersecurity Center warned that AI-powered malware is highly likely to be used in ransomware attacks against critical infrastructure by 2028. Now, AI can also help defenders find vulnerabilities and analyze suspicious activity and respond faster. So there's an interesting strategic question and paradigm here. If both attackers and defenders are becoming increasingly automated with AI, who gains the advantage? And how do we make sure the AI agents that we're giving access to our systems don't become another vulnerability themselves? Now, I don't want this episode to leave people thinking that they should disconnect everything and move into a bunker somewhere. But I do think we need to rethink something. Because for years, we've talked about cybersecurity primarily in terms of preventing attacks, right? Keeping the attackers out, patching vulnerabilities, protecting user credentials. All of those are essential, but no system is perfectly secure. So what happens when something gets through, when something gets in? Right? Can critical systems be isolated quickly? Can your organization continue operating? And can you recover quickly from a cyber attack? And that's the difference between security and resilience. Because security tries to prevent something from going wrong. But resilience is about limiting the consequences and recovering when it does. And increasingly, I think we have to design for both. And incidentally, just a few days ago, CrowdStrike announced an agreement to acquire Dreadnode. Which is a company focused on offensive AI security testing. And the timing of that announcement was particularly interesting to me because that brings me to my upcoming conversation with Daria Bahrami, who is the head of policy at Dreadnode. And Dreadnode works at the intersection of AI and offensive cybersecurity. And in our conversation, we explore some of the difficult questions surrounding AI-powered attacks, defensive strategies, whether the best defense is in fact a good offense. As well as autonomous agents and the evolving cybersecurity landscape. Because when you hear about hackers turning supermarket freezers into heaters or military planners preparing for prolonged infrastructure failures, cybersecurity starts to look a little bit different. It's no longer just about protecting information, it's about protecting the systems that make modern life possible. And as artificial intelligence increases the capabilities available to both attackers and defenders, Those questions become even more important. So for now, I'll leave you with this. We have spent decades making our world more connected, more automated, and more efficient. And we've benefited enormously from that progress. But perhaps the next great technological challenge isn't simply making our systems more intelligent. It's making sure they're resilient enough to survive when things go wrong. Because the doomsday scenario doesn't necessarily begin with every light going out. Sometimes it begins with something as ordinary as a refrigerator getting hot. I'm Mo Hafez, and this has been Beyond the Byte. As always, stay curious, stay ethical, and lead human.