European supermarkets have been targeted by costly cyberattacks to grocery stores, and even blood banks, that tamper with the temperatures of commercial fridges and freezers.
Jeff Shirley is the founder and CEO of Rivercity Innovations, a Saskatoon-based tech company founded in 2017 that uses low-powered sensors to monitor data like temperature, GPS positioning, moisture, and humidity—meaning it will alert a company if its fridges have experienced a drastic temperature change. Rivercity offers its systems in seven countries, and says it’s been receiving calls from European customers since the hacks.
BetaKit’s Prairies reporter Jesse Cole sat down with Shirley to chat about what happened in Europe, and whether Canadian Internet-of-Things devices, from fridges to HVAC systems, should be considered at risk.
The following interview has been edited for clarity and length.
Why does a fridge need to be connected to the internet in the first place?
Think of a grocery chain with hundreds of stores. You’re not going to send out a technician to every single case at every single store every day to adjust settings and controls. So, experts remote in and simultaneously monitor.
Those pieces of equipment are also not as simple as a house fridge. Sometimes they have different temperature zones. Ice cream is usually -25°C, whereas frozen pizzas might be at -18°C. That all ties into energy management and planning for predictive maintenance.
It’s not just a refrigerator: it’s a very complex, multi-million-dollar coolant system managing its energy to protect the environment and keep your food safe at the right level, and making sure that glass door doesn’t frost up every time you open it. It’s extremely complex.
Can you tell us what happened with these high-profile hacks?
These cooler systems—think your supermarket, your grocery store—they have very big refrigeration freezer systems. These have mechanical rooms that run coolant and power to them. Those coolant systems are monitored by companies and are controlled through a control system. The service companies remote into those systems to check the cooling, the performance, and ensure all of the temperatures are right.
What has happened in Europe is that a vendor had some hardware that required patches. If businesses didn’t patch it, people could see those systems if they were publicly on the internet, through the channels that the remote service companies would use.
Those people attempted to hack the systems and succeeded. They changed the settings, just like if you’re in your house; they increased the thermostat and said, “let’s go to 50°C,” and the system said, “OK, because you’re the service company.”
Freezers, by design, have to run defrost cycles. Sometimes, every eight hours or so, it’ll run up to like -5°C to burn off the frost from the humidity in the store condensing on the glass. Those defrost cycles were leveraged by the hackers to go to 50°C and stay there. Overnight, all the frozen pizzas thawed, all the meat thawed, all the ice cream melted, and you come into the store at 7 a.m. and you have puddles and ruined product.
Which, I imagine, is worth tens of millions of dollars across a chain.
Hundreds of millions of euros were lost in the first wave about three weeks ago, and in the last wave, more countries were hit by similar hacks.
The damage is immediate. The only thing that mitigates it is third-party monitoring, because these coolers are wired to behave like this. They’re not unusual settings for somebody to say, “I want you to be warmer temporarily.”
I don’t believe it was nefarious because there’s no malware that we’re hearing about. Nobody’s saying, “pay me in Bitcoin.” It seems to be across the platform of wired control systems, and I expect it will extend to more countries.
So you need third-party monitoring. Our business—that’s what we do. We’ve been getting calls.
Tell me how that third-party monitoring works.
Think about your local Co-op or IGA. The big grocery stores have wired control systems. They’re physically wired in the building. They’re very expensive and very complex. A smaller company is not going to put a $100,000 wired monitoring system in there. What River City does is monitor the coolers and the freezers. [Editor’s note: It does so using battery power and Long-Range, Wide-Area Network, rather than Wi-Fi.] We alert the staff if the freezer isn’t normal. We send out those alerts as a triage, kind of like a weather warning on your cell phone about tornadoes coming.
Here in Canada, this has been good for our business, but my heart goes out to these companies.
It’s also not just about the hacks. Whether it’s a hack or a forest fire or a flood season, businesses lose their power. So having the ability to get those alerts, to go back and validate that food, is still good.
We have a very awesome client in British Columbia. Do you remember the forest fires in the Okanagan Valley this summer? The power went out; they knew they were going to be down for more than a day. So they decided to donate that food to the first responders in the community, so that client of ours went in, sent the semi-trucks in with permission from the perimeter border guards, and brought that food out to the first responders. Doesn’t that sound better than it’s all melted and on the floor in the morning?
You mentioned these vulnerabilities are stemming from unpatched software. How vulnerable are we in Canada?
There are five or six major players in wired control systems worldwide. In Canada, three or four are very active. They have their own security teams, their own departments. They will advise the grocery chain that this hardware needs to be updated. If the chain has updated it, problem solved.
It’s no different whether it’s a computer or a refrigeration system. You can think of this as a very complex IT nightmare. There will be big chains doing due diligence right now, asking, “are we vulnerable? Have we patched it?” And if they haven’t, just imagine having 1,200 stores with 100 coolers each, and you need to update the control systems in those stores, which might be a complex circuit board and computer and management system. And every store has its latest versions and updates, which might not all be aligned.
Absolutely, it’s going to be our priority for Canadian brands. I think yes, we’re vulnerable, but Canada is a very developed country. We’re on top of things
Do you think this signals anything concerning about the broader Internet-of-Things ecosystem when it comes to cybersecurity risks?
The moral of the story is you can’t run a large enterprise business with IoT-connected devices for the public if you’re not going to put in best practices for security. Use a VPN. Use firewall rules. Use dedicated ports. Use two-factor authentication. Change your passwords to be complex. Change your passwords every 60 days. Who would have thought that the refrigeration control panel needed the default password changed?
It’s a major problem. The Internet of Things is more than just grocery stores.
Commercial properties have a remotely managed central HVAC system. Say somebody hacks a commercial building and turns everybody to 50°C? My advice is to get some safety nets in place.
Feature image courtesy Unsplash. Photo by JC Gellidon.