Comment by 9x39
3 hours ago
If you believe some of the emerging comments out there - try "Danfoss CVE" - you'll see that some of the suspects are 15-20 year old controllers like the Danfoss SM800 (EOS 2021) and SC355 (EOS 2016).
Why don't they just--- no margin. But there were CVEs-- no margin.
The laptop class doesn't always grok that the shift-work labor class has nothing in terms of luxuries like security reviews and gear replaced on cycles and other basics taken for granted.
But I'd setup Tailscale and-- would you, the grocery store manager running on 3% margin, really? What if you're part of a chain and it's centrally controlled elsewhere, like all the other decade-old tech you use but have to call and wait for a dispatched tech to handle?
Secure-by-default laws will eventually help, but there's always going to be groaning infrastructure particularly in commodity industries, and we still haven't onboarded most of the disaffected men to the Internet that will commit innumerable more hacks and disruptions.
> The laptop class doesn't always grok that the shift-work labor class ...
I think it's more than this. Industrial control system upgrades are serious business and (at least if you're doing them properly) require a lot of planning and consideration. Particularly when the subsystem being replaced is decades old already.
I think the overwhelming majority of people (including on hn) have no understanding of how complex industrial systems are - even as-built, but particularly after decades of evolution. Doing proper engineering in these spaces is expensive.
You can reasonably blame supermarket chains for being insecure, but we certainly aren't currently enabling them (or anybody else) when it comes to fixing these issues.
Is it more expensive to keep your systems upgraded and maintained or to have all your product get destroyed one arbitrary day and then have to pay to do the upgrade anyways so that the arbitrary property destruction doesn't keep happening?
In before "but insurance"; yes insurance can in theory mitigate some of this, but I feel like people on HN have no understanding what it's like to deal with a multi-million dollar insurance claim that the insurance company 100% does not want to pay out. The legal battles over such things take years and are on their own incredibly expensive.
> Is it more expensive to keep your systems upgraded and maintained or to have all your product get destroyed one arbitrary day and then have to pay to do the upgrade anyways so that the arbitrary property destruction doesn't keep happening?
It happened once. Did you do the maths here? Can you tell us which one was Kore expensive and what percentage chance there was of this hack happening?
1 reply →
That class of risk was just theoretical for decades, so the price on it was basically 0.
Now that we see large scale incidents will there be an actual money value associated with upgrading systems and security for supermarket appliances.
1 reply →
In my recent experience (last 3 months) with a cyber claim getting insurance to pay out was actually pretty straightforward. It was about a $250K USD loss on a phishing attempt (someone hijacked and rerouted payment details for a wire)
I work in SCADA development, and believe me, there's a reason the industry moves slowly.
This comment could be a lot more interesting, useful and worth typing than it is. :(
2 replies →
Go on.
Yeah the margins are tiny because private equity has spent the better part of the century destroying American dynamism and outsourcing all externalities including getting hacked to the people.
This is only partly true, historically before private equity was a thing grocery was always a razor thin margin business that operated on volume. PE just made it worse.
2 replies →
Doesn't sound all that convincing to me. There is no need for network controlled fridges in the first place. And it's not like setting up that network control was free. This is not about saving money, this is about ignoring what IT people preach since multiple decades now, spending more for the attack vector and then loosing a lot of money when that attack vector gets used. Margins? If it were about margins the problem wouldn't exist.
(I can see the need for remote monitoring, that the freezer actually worked. Controlling the temperature is the issue.)
I don't get it - it is not like the people working in a supermarket are expected to pay for securing the hardware in it. It is up to the owners who clearly have the money to run a supermarket chain not to keep insecure shit exposed to the Internet.
We all end up paying for that though
So what you're telling us is that there is tremendous opportunity for a startup to disrupt the space with new Refrigeration-as-a-Service (RaaS) products controlled by AI. That way we can replace those legacy microcontrollers with modern, secure GPUs and vibe-coded AI agents.
Thank you for saying this. It's quite frustrating to read some comments here that have obviously lost touch with the reality of the vast majority of people and businesses across the world.
I’d be willing to bet many more HN users work for companies who are the ones creating unnecessarily network connected smart devices than work in infrastructure, trades, retail-adjacent positions that implement/use many of these network connected devices.
Lots of completely out of touch comments
I don't know how it is in Europe, but here in Canada, looking at grocery stores in isolation makes little sense when most of the market is controlled by a handful of vertically integrated conglomerates. On top of the stores, they own a lot of the distribution, wholesale operations, real estate, and even some suppliers. Their own financials show record revenue and profit, year after year, and their margins have increased significantly over the last few years too. We can't reduce the economics of such integrated corporate groups to their retail net margins alone to judge profitability. As far as Canada goes, small margins my ass.
> their margins have increased significantly over the last few years too.
Empire (Sobeys et al) has seen consistent profit margin of ~2% for the last 2 decades.
Loblaws and Metro have higher profit margins at ~3-4% attributable largely to their acquisition of pharmacy brands which function as high margin grocer/convenience storefronts.
Target learned the security lesson the hard way, but they definitely learned it. When I was there, security was one of the rare parts of the tech org I found legitimately impressive. (But also: I am not a security guy! Maybe their actual practices were compelling but flawed! But the organization as a whole was legitimately serious about it )
Target is a far outlier in the insane shit that they do in terms of retail security. No one else really approaches them in this regard.
Target learned the security lesson the hard way
About the 2013 Target data breach, https://krebsonsecurity.com/2015/09/inside-target-corp-days-...
I worked with the Target security team on a few projects and I definitely agree that they take it seriously
Apparently Home Depot has a very good developer culture too.
The margin is certainly blown, now
I can imagine that there's already an industrial security company at their door, offering a solution to prevent this from happening ever again, already tailored just for them.
Maybe it's even honestly not related to the attack.
The hardware vendor has long offered software updates. Unclear if the groceries were paying for support, they certainly weren't installing them.
Boeing still took the blame for MAX, when their customers didn't pay for training.
1 reply →
They probably have insurance for things like this. Speculation, but still. Lots of businesses mitigate risk by just buying insurance.
Insurance for cyber incidents usually only cover you if you took reasonable measures. Like not exposing your internal systems to the Internet.
They had plenty of margin to pay for unnecessarily cloud-connected refrigerators.
It's not entirely clear which comments/criticisms you're responding to when pointing out the lack of margin. Whose excuse is that? And what's it an excuse for?
Security isn't optional just because margins are low. If eg FedEx decided to disregard security because they only made 3% of the value of the packages they ship in profit, they'd lose most of that business fast. But yes, let's not shame folks for failing to preempt theoretical-yet-unseen threats, if that's what you mean.
I think it's that people who've never faced a security threat and never had to think to are among the most vulnerable. And grocery stores are notoriously thin margin businesses who actually strive not to spend unnecessary the most.
At least that's what I got from it.
Ok, then why were their damned fridges connected to a network then?
"The chain wanted to have Internet enabled control and dashboards about their fridges" or something?
You don't get to say you want the perks of being Internet enabled and then turn around and say that protecting against the downsides would cut into your margins too much. Sheesh
Framing IT vs OT differences as a class struggle?
Sir, I think you just invented entirely new type of technomarxism. Sunrise, parabellum!
...
As fun as it is, this has nothing to do with laptops and everything to do with someone not implementing Purdue model right.
[flagged]
Of course not. It is precisely because they have to fight for scraps that this is the place where workers are beaten down the most, because the owners are making pretty damn sure they will be the ones to get that margin lining their pockets, everyone else be damned.
In high-margin industries, you can give a 3% salary increase and free coffee and snacks, it is a rounding error compared to the 20% yoy increase applied to your multi-billion dollar compensation.
> Of course not. It is precisely because they have to fight for scraps that this is the place where workers are beaten down the most, because the owners are making pretty damn sure they will be the ones to get that margin lining their pockets, everyone else be damned.
My class-brained friend, margin is what you get after wages, not before.
I was talking about the supposed oppression of customers through high prices, but it’s typical that communists imagine that the purpose of an enterprise, private or public is to provide jobs to union workers rather than to actually useful products or services to customers.