Comment by iugtmkbdfil834

Same reason website's are remote controllable. There's someone who's job it is, is to make sure the fridge is up and running, 24/7 and for the same reason that website operators/SREs don't live at each POP/DC, that fridge operator wants to remotely be able to flip some relays off and on to fix the problem without having to drive onsite, if possible. Additional, a single person/fewer people can then also be responsible for multiple/more sites.

That’s exactly right. There all all sorts of read-only architectures where the device can be monitored without every directly accessing it:

- The device’s control has a radio transmitter that emits its readings, but no receiver. Listen for those messages to monitor it but there’s not a physical path to reply to it.

- The device’s controller writes a database or message queue. Its code never reads from that source. Monitors listen to those messages.

And many, many similar methods with the same core concept: the item transmits its status but doesn’t have a method to receive replies. You just have to commit to using any one of those thousands of mechanisms.

The fridges are cheaper to make because they don't need a bunch of knobs and switches and temperature displays - just an app on employee phones.

Read-only access is mostly an illusion that itself can be hacked to gain control.

because you might not want to send a technician to every single one of them once a firmware update is needed

There are most likely IT governance problems: builders bought fridges, IT didn't provision sufficient access, installers put 3G keys instead of spending time getting the correct VPN/networking, and a few months later no one knows how this thing works, and IT is not mandated to find out that shops ever did that.

> This still shouldn't be online.

This line suggests the units themselves were targeted individually with a hack:

> Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.

But the problem with networked devices spread across tens of thousands of pretty much unguarded locations, surrounded by unvetted employees, but taking orders form a central location is that there is no such thing as "not online". They'll talk to the management server used to set up the nightly defrost schedules across the fleet. Even if they are in an isolated VLAN, it's always one step away from someone connecting a Pi to that network and off they go online. There's only so much zero-trust, NAC/802.1x and segmentation can do when some devices will be too old to support these and their network will be the entry point to the management server, then to the whole fleet.

I'm honestly very surprised that a couple of things things haven't happened yet: the central server for managing these fleets getting hacked and allowing access to the entire fleet, and/or the companies realizing that the only way to limit the reach of an attack is to physically not have the hardware needed to do remote control.

>Ignore may be a tad strong. I am merely asking for hardware that is subject to my control to be within my control.

Which is how they got into this situation. These are industrial refrigeration systems subject to a huge list of variables (how many units, their sizes, and doors hooked up to a refrigeration circuit, open vs closed cases, ambient conditions, hours of store operation, what type of refrigerant, whether heat is going to a cooling tower or air heat exchanger). They use a ton of energy, and percent optimization leads to millions of dollars over a fleet. They are designed to let the user dial in every operating parameter, like defrost.

Compare this to my home fridge where all these parameters are fixed in the firmware because the hardware is 100% identical.

Industrial systems are necessarily different from mass-produced home appliances.

Yes, I have similar strategy. But in all cases I'd prefer to just buy analog appliances. There's no good reason to put a digital computer in a refrigerator. A bimetallic thermostat does the job just fine.

You're right, a commercial freezer is a different beast than a household one. But what good does it really do anyone to be able to adjust that defrost schedule remotely? Surely the personnel on site are the ones best equipped to schedule the defrost cycles of their equipment?

Within a store certain freezers get more traffic than others, depending on how they're stocked, where they're located, etc, and therefore likely require more frequent defrosting. But that's something the store managers can figure out. It doesn't need to be managed remotely by some third party. So why did someone engineer that capability?

More features, generally, means more failure modes. More ways to exploit the system. Adding fringe features that aren't actually necessary (or desired) has become a strange industrial compulsion. It's very unhealthy and disordered behavior from an engineering standpoint--sacrificing reliability and simplicity for... what exactly? Some centralized control capability? But why?