Pentagon officials suspect that hackers went after the military commissary refrigerators, according to Reuters.
Four officials said Defense Department investigators were treating a series of refrigerator failures at military bases in August as a suspected hack, with one adding that investigators had spoken with their French counterparts after hackers attacked supermarket freezers across France earlier this month. The Pentagon told Reuters in a statement that a unit of the Cyber Command “is working in close coordination with interagency and law enforcement partners” on the issue, while army criminal investigators confirmed they were collaborating with French police.
The blog Signal and Silence was the first to raise suspicions about the issue in late August, writing that they were “self-aware enough to know this sounds crazy,” but “there’s a non-zero chance that someone hacked the commissary refrigerators.” This post identifies 14 reported commissary/refrigerator outages at military installations in 11 states. (Reuters confirmed at least six.)
Signal and Silence also noted that social media posts from Arizona’s US Army Fort Huachuca had clarified that there was no power outage, but that the refrigerator went into “defrost mode where it heated up all the food. Trust us when we say it was ‘spoilt.’ [Remote Monitoring Control System]”And one procurement document shows that RMCS is in place at 182 sites, including all 14 on the list. The blog also cataloged posts showing that commissars at bases including New Mexico’s Holloman AFB, California’s Fort Irwin, and Rhode Island’s Naval Station Newport all posted refrigeration failure notices and cooled frozen goods.
Finally, Signal and Silence noted that in early August Claroty Team82 security researchers posted two studies that identified vulnerabilities in the Danfoss AK-SM 800A and Copeland XWEB Pro refrigerator control systems used to manage central commercial refrigeration. The blog could not determine whether all affected DeCA sites used these specific systems, although Reuters reported that Danfoss had an army of such controllers in France. At least one DeCA site uses a similar Danfoss system, but it was not on the affected list.
According to Reuters, the French incident affected more than 350 businesses and partly led to fires. This corresponds to an anecdotal report cited by the Signal and Silence blog post that two commissary deli refrigerators at Wyoming’s FE Warren AFB reached temperatures of 160 to 180 degrees Fahrenheit (it’s unclear if this measurement was from the temperature display, the food, or the machine itself).
If confirmed to be a hack, this would come down to a perennial security issue: industrial controllers, the computers used in a massive variety of industrial devices or operational technology (OT) to collect sensor data and receive instructions. Controllers (especially programmable logic controllers, or PLCs) have been used in virtually every industrial or infrastructure environment for decades—hence the problem. Many controllers were designed either before the global Internet or widespread awareness of the risks that arise when industrial or OT systems connect to the Internet. It is only relatively recently that manufacturers of PLCs and other types of controllers have paid attention to security concerns, and the long tail of vulnerable controllers is a juicy target for threat actors who blackmail organizations about downtime or simply cause damage and organizational disruptions.
In the rapidly modernizing agriculture and food industry, this often means that the attacker renders the food commercially useless by making it unsafe to consume. While increasing the number on refrigerators is one method, simply shutting down production can cause mass wastage of goods or costly supply chain issues. For example, farmers literally cannot stop milking cows if the milk packaging and processing facilities go offline. The milk either spoils or is dumped under the FDA’s Pasteurized Milk Ordinance, which requires unprocessed raw milk containers to be drained after 72 hours.
Bill Moore, the CEO of industrial cybersecurity provider Xona Systems, told Reuters that designers originally saw controllers as isolated devices, sometimes serviced by humans, not gateways to the Internet.
“It can definitely disrupt the food supply chain,” he said.