Latest / Kvetch & Release / Melted Food & Boiled Blood? How Hackers Weaponized the Thermostat

Transcript

Melted Food & Boiled Blood? How Hackers Weaponized the Thermostat · Kvetch & Release

• 0:00
  Speaker 1: It is time for another edition of Litkey's Got a Take.
• 0:03
  Speaker 1: Good morning, John.
• 0:04
  Speaker 2: Good morning, Gene Valaitis.
• 0:06
  Speaker 1: Well, this is quite something. We're talking about what you
• 0:10
  Speaker 1: term the cold chain hack, why supermarkets and blood bank
• 0:14
  Speaker 1: freezers are being hacked in the Internet. So when headlines
• 0:18
  Speaker 1: broke about supermarket freezers in Europe being cranked up to
• 0:21
  Speaker 1: 50 degrees, wrecking all the food, the Pentagon probing U.S.
• 0:25
  Speaker 1: military bases, and overnight hackers targeting French blood banks, Everybody,
• 0:31
  Speaker 1: including me, pictured, you know, Russian or Chinese cyber hackers
• 0:34
  Speaker 1: in dark rooms. But you're suggesting we just might be
• 0:37
  Speaker 1: looking at overweight guys in their underwear, living in their
• 0:40
  Speaker 1: parents' basement, just having fun on the Internet, or at
• 0:43
  Speaker 1: least what they think is funny.
• 0:46
  Speaker 2: Gene, 24-hour news. I mean, listen, you and I, we're
• 0:48
  Speaker 2: both desperate for a Tom Clancy-style script here. Everyone wants
• 0:52
  Speaker 2: a shadowy GRU colonel sitting in a Moscow bunker whispering,
• 0:57
  Speaker 2: activate ICE protocol. Melt the Haagen-Dazs. I don't think it's
• 1:03
  Speaker 2: that way, though. This doesn't smell like the Kremlin. This
• 1:06
  Speaker 2: smells like Axe body spray, stale Doritos, and teenage boredom.
• 1:10
  Speaker 2: I think that some kids found an unpatched industrial port,
• 1:14
  Speaker 2: or a hacker did, dumped the code or the blueprints
• 1:17
  Speaker 2: of how to do it on the web, and now
• 1:19
  Speaker 2: you're getting a bunch of acne-faced trolls realizing, hey, why
• 1:22
  Speaker 2: don't we try and cook a grocery store in Brussels?
• 1:26
  Speaker 2: from home. I think it's just copycats. I really think, though,
• 1:28
  Speaker 2: that the real crisis, it's not military super weapons or
• 1:32
  Speaker 2: super hacking. It's that our critical civic infrastructure is so
• 1:35
  Speaker 2: laughably porous that people are able to hold our groceries hostage.
• 1:41
  Speaker 1: Now, we hear endless talk about sophisticated hacking. But according
• 1:45
  Speaker 1: to your reports and the research you've done, these cooler
• 1:48
  Speaker 1: controllers were sitting wide open to the public in the
• 1:51
  Speaker 1: Internet with things like factory default logins where literally you
• 1:56
  Speaker 1: just had to type the word admin in. Now, I
• 2:01
  Speaker 1: know that you spoke to a local grocery manager down
• 2:05
  Speaker 1: in Windsor, your neck of the woods. What did he
• 2:06
  Speaker 1: tell you is actually happening with the thermostat on frozen foods?
• 2:12
  Speaker 2: Yeah, I did speak with a grocery manager here in
• 2:14
  Speaker 2: Windsor this week, and I asked him if someone targets
• 2:16
  Speaker 2: the store tonight, are the frozen pizzas safe? And he
• 2:19
  Speaker 2: looked at me like I had two heads. The answer
• 2:22
  Speaker 2: was that nobody in the building touches the dial. No
• 2:25
  Speaker 2: one in the city even touches the dial or the thermostat.
• 2:28
  Speaker 2: It's all remotely managed. The people stocking our dinners don't
• 2:32
  Speaker 2: even have keys, quite frankly, to the fridge. They can
• 2:34
  Speaker 2: only load the food in. So this is the sheer
• 2:36
  Speaker 2: institutional laziness of it. The media, us, we can paint
• 2:40
  Speaker 2: a picture of elite cyber operatives cracking military-grade encryption. But
• 2:45
  Speaker 2: the punchline, yeah, I mean, the passwords and usernames were
• 2:48
  Speaker 2: admin and password, default. This isn't a hack. This is
• 2:52
  Speaker 2: leaving the front door to the grocery store wide open
• 2:55
  Speaker 2: with a neon sign that's blinking saying free food.
• 3:00
  Speaker 1: Wow. Now, you know, hacking a grocery store, spoiled food.
• 3:05
  Speaker 1: You know, it sounds kind of comical until you look
• 3:08
  Speaker 1: at the economics. So as I understand it, Canada's food
• 3:12
  Speaker 1: supply is razor thin. It's all about the logistic chain.
• 3:17
  Speaker 1: So if this wave of freezer sabotage continues to hit
• 3:22
  Speaker 1: grocery warehouses and stores, who ends up paying for all
• 3:25
  Speaker 1: that spoiled food?
• 3:27
  Speaker 2: It does sound hilarious until we remember that grocery chains
• 3:30
  Speaker 2: don't keep warehouses of surplus food anymore. I mean, this
• 3:34
  Speaker 2: is a hyper-lean, just-in-time logistics chain. The food professor, Sylvain Charlebois,
• 3:39
  Speaker 2: he made an actual really good point about it in
• 3:41
  Speaker 2: a new post. And he says that perishability actually gives
• 3:44
  Speaker 2: attackers an automatic countdown clock. When it's financial files, you
• 3:48
  Speaker 2: can haggle back and forth with extortion for days, but
• 3:51
  Speaker 2: when it's raw chicken and dairy, the cost of waiting
• 3:54
  Speaker 2: doubles every three hours. So, spoilage does the extortion work itself,
• 3:58
  Speaker 2: and even if you get the power back on, how
• 4:00
  Speaker 2: do you even verify that if the meat that you
• 4:02
  Speaker 2: have didn't get too warm? You've got to dump it all, right? So,
• 4:05
  Speaker 2: who eats the cost? Well, it's not going to be
• 4:07
  Speaker 2: the insurers. It's not going to be the grocery store.
• 4:09
  Speaker 2: I mean, it's going to be you. It's going to
• 4:10
  Speaker 2: be me. It's going to be passing the cost on
• 4:12
  Speaker 2: to the consumer, on to our receipts. You'll walk through
• 4:15
  Speaker 2: the checkout line next week, and you'll be paying an
• 4:18
  Speaker 2: unwritten corporate incompetent surcharge. It'll just show up on your
• 4:21
  Speaker 2: butter or on, excuse me, maybe on something that's not
• 4:23
  Speaker 2: supply managed. So the issue is that our supply chain
• 4:26
  Speaker 2: is brittle, and working families are always the designated shock absorber.
• 4:31
  Speaker 1: You know, you make a good point there. I wonder
• 4:33
  Speaker 1: if the If the stores, the grocery stores, even have
• 4:36
  Speaker 1: insurance against something like this happening, because this is, like,
• 4:40
  Speaker 1: brand new. This is uncharted territory. You know, melted ice
• 4:44
  Speaker 1: cream is one thing. But overnight in France, hackers tried
• 4:47
  Speaker 1: to raise the temperature of the freezers holding donor plasma
• 4:51
  Speaker 1: meant for surgeries and cancer treatments up to 110 degrees,
• 4:54
  Speaker 1: you know. So moving from food to life-saving blood supplies
• 4:59
  Speaker 1: is crossing the line. Do we know what the Canadian
• 5:02
  Speaker 1: Blood Services and our health care system are doing to
• 5:05
  Speaker 1: protect the plasma and bloods that ill people need in Canada?
• 5:11
  Speaker 2: Hackers trying to target French blood clinics in France, that's
• 5:16
  Speaker 2: where the joking stops completely. Spoiled waffles, yeah, petty vandalism,
• 5:20
  Speaker 2: kind of funny. Spiking trauma plasma kept at minus 30
• 5:24
  Speaker 2: up past the boiling point of water, that would be horrifying.
• 5:27
  Speaker 2: You're rolling the dice on cancer patients and people bleeding
• 5:31
  Speaker 2: out on surgical tables. So I can't speak for Canadian
• 5:33
  Speaker 2: Blood Services and what they do internally, but I can
• 5:36
  Speaker 2: say step one doesn't require an expensive blue-ribbon federal panel.
• 5:41
  Speaker 2: Change your passwords. Change the login on all the freezers.
• 5:45
  Speaker 2: If life-saving medical assets share the security protocols of your,
• 5:49
  Speaker 2: I don't know, your smart toaster, you shouldn't be running
• 5:51
  Speaker 2: a limo at Nainstand, let alone a medical network. Step two,
• 5:55
  Speaker 2: what should be done is treat cold storage as a
• 5:57
  Speaker 2: closed sovereign chain of custody. From a minute a volunteer
• 6:01
  Speaker 2: rolls up a sleeve in Niagara to the hospital bed
• 6:04
  Speaker 2: in St. Catharines, that stock must be secured like bullion.
• 6:09
  Speaker 2: I mean, never wire life support to the public Internet.
• 6:12
  Speaker 1: Yeah. Grocery change, health networks, they've been running pretty lean lately,
• 6:17
  Speaker 1: and generally people off-site are managing those freezers for blood
• 6:21
  Speaker 1: and food and all the rest of it. Have we
• 6:23
  Speaker 1: become so obsessed with trimming corporate fat that we've completely
• 6:27
  Speaker 1: forgotten about basic safety?
• 6:30
  Speaker 2: It is the fatal rot of the modern boardroom. Some
• 6:33
  Speaker 2: McKinsey suit walks in with a PowerPoint and says, fire
• 6:38
  Speaker 2: 30 skilled on-site engineers who actually know how to turn
• 6:40
  Speaker 2: a wrench. Outsource the system monitoring to a third-party contractor
• 6:44
  Speaker 2: on an iPad. I mean, that can be called trimming
• 6:47
  Speaker 2: corporate fat. In reality, though, sometimes you end up hacking
• 6:50
  Speaker 2: straight through muscle and sawing off the bone. And as
• 6:53
  Speaker 2: Charlebois noted, the real trap is that big players like
• 6:56
  Speaker 2: the Loblaws of the world can afford enterprise IT firewalls,
• 7:00
  Speaker 2: but they depend on small family-owned farms and independent processors
• 7:03
  Speaker 2: who can't afford 20 IT consultants. So if an attacker
• 7:07
  Speaker 2: knocks out a greenhouse or a local packaging plant, the
• 7:10
  Speaker 2: supermarket shelves would still be empty. So a fortress with
• 7:12
  Speaker 2: a cardboard back door is no fortress at all, and
• 7:15
  Speaker 2: everyone needs to remember this in any aspect of business.
• 7:18
  Speaker 2: We've dismantled mechanical systems that function reliably for 50-plus years
• 7:23
  Speaker 2: and replaced them with fragile digital loops, all to extract, what,
• 7:28
  Speaker 2: a miserable half-percentage bump in quarterly EBITDA? A licensed human
• 7:32
  Speaker 2: being walking the floor with a clipboard was not an
• 7:35
  Speaker 2: operational inefficiency. That human was the only fail-safe keeping the
• 7:39
  Speaker 2: system alive.
• 7:42
  Speaker 1: Well, everything does get plugged into the Internet. For example,
• 7:45
  Speaker 1: I've got my cell phone here. And if somebody is
• 7:48
  Speaker 1: coming to my condo because they want to come and
• 7:50
  Speaker 1: see me, you know, I can open the door and,
• 7:53
  Speaker 1: you know, I'm a half an hour away from home. So,
• 7:57
  Speaker 1: I mean, it includes everything. Like I said, doorbells, cars, refrigerators.
• 8:01
  Speaker 1: So what's the hard lesson here for companies and consumers
• 8:04
  Speaker 1: who think digital convenience is always better?
• 8:08
  Speaker 2: You know, I just helped my parents set up their
• 8:10
  Speaker 2: new smart oven. It connects to Wi-Fi. They're able to
• 8:13
  Speaker 2: check the timer and change the temperature of it, all
• 8:16
  Speaker 2: from the convenience of the couch, not 15 feet away
• 8:19
  Speaker 2: from the kitchen.
• 8:20
  Speaker 1: I don't get it.
• 8:21
  Speaker 2: The takeaway, Gene, it's staring us in the face. Slapping
• 8:24
  Speaker 2: an antenna onto something doesn't necessarily make it smarter. It
• 8:27
  Speaker 2: might make it smart, but not smarter. We've been conditioned
• 8:30
  Speaker 2: to believe that if hardware doesn't have an app, Bluetooth
• 8:33
  Speaker 2: or cloud, it belongs in the Stone Age. But sometimes
• 8:36
  Speaker 2: low-tech is better tech. A heavy deadbolt, a mechanical thermostat,
• 8:41
  Speaker 2: and equipment that has zero capability to let Silicon Valley
• 8:44
  Speaker 2: say hello, that can't be hacked from 3,000 miles away.
• 8:47
  Speaker 2: Not every aspect, I think, of our life needs frictionless convenience.
• 8:52
  Speaker 2: Vital systems, I mean our food, our drinking water, our
• 8:54
  Speaker 2: medical supplies, I don't think those should ever trade baseline
• 8:57
  Speaker 2: resilience for notifications on an app. If an operational fix
• 9:01
  Speaker 2: gene requires an engineer to walk down a hall with
• 9:04
  Speaker 2: a physical brass key, congratulations, you've actually built something very secure.
• 9:09
  Speaker 2: So my takeaway, keep the internet on our phones and
• 9:12
  Speaker 2: keep it out of your fridges and ovens.
• 9:15
  Speaker 1: I still can't get over the fact that you discovered
• 9:18
  Speaker 1: that some of the logins and passwords were admin1234. Oh, geez.
• 9:23
  Speaker 2: Yes, it's not great, Gene. Change your password. That's the takeaway, too.
• 9:28
  Speaker 1: All right. Great take today. Appreciate you. We'll see you
• 9:30
  Speaker 1: tomorrow morning, 9.15. Cheers. There he goes, John Litke. It's
• 9:34
  Speaker 1: called Litke's Got a Take, and they're always something else.