Comment by gwbas1c
16 hours ago
To summarize for people who TLDR: 14 freezers failed at the same time. They are all internet-controlled, and failed at the same time as a disclosure about a vulnerability. They all failed by turning on the defrost cycle and heating food.
Regardless if this was a hack or a bug, the bigger lesson is that overcomplicated systems fail in catastrophic ways. Why do military commissaries need remote-controlled freezers? It seems like a very fragile, and needless, way to run a freezer.
---
But, there are some options that the author didn't consider:
1: This could be a quickly applied patch that failed.
2: This could be a "script kiddie" hack from someone who isn't a government actor.
I'm less onboard with a state actor. Generally, when a state actor has hacked something, they don't want the victim to know. In this case, if it was a state actor, I would anticipate that they would make a single freezer fail in a way that they could verify using something like a hacked video camera or otherwise by watching public social media feeds. IMO: A state actor would only "make sense" if they knew the hole was closing soon and they don't care if they're discovered, perhaps because their operation is winding down.
Could also just be a bunch of IoT devices running on synchronized time source that have what amounts to a defrost cronjob. And a latent bug that due to everything being synced and on the same schedule failed in the same manner (eg crashed the controller immediately after turning the heating element on and either didn’t boot back up or booted and some shitty programming forgot to check the heating element status). Saving state across boots or having a race condition of some sort like this gets my vote - since it’s a pretty common failure mode junior programmers are susceptible to.
I’ve seen similar too many times in my career - synchronized clocks are great until someone deploys a cronjob that fires at exactly the same time across the fleet and it breaks a certain OS or firmware revision. Which then exposes another bug that exists globally.
I definitely still subscribe to don’t attribute to malice what you can attribute to incompetence mindset.
Certainly all speculation though, real root cause will be interesting if it ever becomes public.
Iran is actively looking for ways to attack back against the United States especially against military targets without actually escalating the situation.
I'm sure some script kiddie broke into a government network, hacked an industrial process, and forced a limited supply piece of equipment into a failure mode that takes some thought and is more unique as an attack vector. It's just like buying hacks for CS source right?
>Generally, when a state actor has hacked something, they don't want the victim to know
Could be the Iranians, or someone aligned, conducting anti-morale operations. Could be the start of a series of small but annoying failures.
Or could be a rouge LLM in one of the big labs, that accidentally self-prompt-injected itself with the title of that vulnerability research paper.
I suppose.
But if I was an Iranian operative with instructions to damage the morale of the American war machine, I'd absolutely do a series of things like this.
It doesn't really harm anyone, but enough similar events and the families of servicemembers start to feel unsafe, which is psychologically very different than the servicemembers themselves feeling unsafe.
It's probably more benign than that, most likely firmware or a central controller failure, but still
These aren’t your typical refrigerator or freezer, these facilities have walk-ins or purpose built cold storage with multiple evaporators and condensing units. A building automation system is pretty standard for most buildings above a certain size, and monitoring and controlling the refrigeration is usually a part of it.
Unfortunately, I would wager that all BAS software is full of flaws and holes, allowing access to it for the public internet seems like a bad idea. I need to be on my company VPN to access our locally hosted BAS front end (which I have authorized access for) which seems like the bare minimum security.