Attackers target cold storage controllers to alter temperatures, US agencies say

Five US agencies, including CISA and the FBI, say attackers are targeting electronic temperature controllers and commercial refrigeration controllers in grocery stores and cold storage facilities worldwide. The agencies say the attackers may exploit unpatched or internet-facing controllers to change their settings and force units into continuous heating and defrost cycles. Their Nov 5 fact sheet gives mitigations but names no affected product, flaw or indicator.

The fact sheet lists three ways in: authentication bypass, arbitrary code injection and weak configurations. A changed temperature can shorten a system’s service life, create a fire hazard, cause inventory losses or harm consumers who eat products stored unsafely, the agencies say. Attackers can also leave operators unable to see current temperatures, a condition the agencies call denial of view.

Organizations in healthcare, chemicals, food and agriculture, and transportation widely use these systems, refrigerated transport included, for remote temperature monitoring, logging, defrost cycles and energy savings, the agencies say. The FBI says it is seeing the systems targeted across critical infrastructure sectors around the world, putting inventory and equipment at risk.

The fact sheet comes from CISA, the FBI, the Department of Health and Human Services, the Agriculture Department and the Transportation Department. CISA says it is tracking the activity with government, industry and international partners. “Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity. The agencies ask US organizations to report suspicious activity to CISA or the FBI, and to HHS when it disrupts healthcare supplies.

The agencies haven’t named the controllers’ makers, the flaws being exploited, the attackers or how many sites have been hit, and the fact sheet gives no indicators to hunt for. Its mitigations are general hardening steps rather than fixes for a specific product.