Posted by Zeekaas 14 hours ago
Related:
https://www.claroty.com/team82/research/freeze-the-controlle...
I think the military commissary's freezers were hacked - https://news.ycombinator.com/item?id=49508506 - Aug 2026 (239 comments)
To boot, refrigeration has been wholly automatic for decades. It literally runs itself. It doesn't need any network connectivity other than to say "I work" and "I'm broken" and that's it. Allowing control commands to be sent over the network is, yet again, just asking for trouble.
It's funny because red storm rising is an old book at this point, but it's pretty accurately shown exactly how conflict with Russia plays out. Even down to Russia realising it is about to run out of diesel... causing it to invade Europe while it still can.
Yes, they're threatening and doing some low-key sabotaging (through third-parties for plausible deniability, which is good for us since we can choose not to respond), but they're shying away from actually killing people through means that might be directly attributed to them (like with a Shahed drone).
I do accept that Russia wants to hurt NATO for our support of Ukraine, but there's a limit to how far they can go.
You think about a frontal attack like in Ukraine, and maybe you're right. But Russia is already waging a much more subtle war against NATO. Look at who's leading the US. Look at Brexit. Or look at who could soon lead France or Germany... Their conventional army may be weak, but they don't need to fire a bullet either.
And if you know your history you'd know that Russia had to pull out of WWI because the country literally ran out of men during the conflict.
Their political influence, even with right-wing politicians who might be skewed their way, will be limited. And could change at any moment as we've seen with Orban.
Russia continued WW1 with a civil war that lasted until 1922. Their military deaths were quite evenly split between the world war stage and the civil war stage.
A) Lots of Russians died during WW2, it wasn’t “evil Russia sends troops from occupied republics to fight for them while Russians sit back”.
B) Lots of mercenaries from post-Soviet republics fight for money on Russias side now
C) Russia didn’t pull out because they’ve run out of men. Where did you get this?
There are a couple of good WWI documentaries on YouTube which you can watch for free. You'll find that C) is the truth.
I wonder where then the millions of soldiers that fought the russian civil war came from.
And the might of the US/UK/etc are a hundred times stronger than the Taliban in Afghanistan, however who ended up winning that war? Or how about Vietnam?
My point being: the size/capability of a military doesn't necessarily result in a win. I think NATO forces have a particular problem of being pretty unmotivated about Ukraine winning.
Conventional military powers sure seem like they were overrated.
Now Russia is one of only two players with years of experience in the latest generation of warfare, while NATO is still stuck in the 20th century.
I suspect when it comes to the production of certain kinds of advanced war materiel, like missiles, shells or drones, Europe lags or doesn't have a clear advantage.
GDP doesn't matter, despite European defense stocks benefiting majorly from the Ukraine war, this didn't seem to have translated into a similar increase in output, which indicates there are bottlenecks in the system somewhere.
You're assuming rational behavior, but time and time again world leaders have demonstrated that they will pursue erratic behavior if their feelings or vibe suggest them that behavior to be their way out of their own trouble.
Russia doesn’t need direct attack on NATO to intimidate, or even destroy the alliance. And even if it did attack NATO member, it is going to be guess what? A discussion. Just like what they have right now. It’s not going to be DEFCON style theatrical attack from the united West on Russia. You know what happens during WW2? When Russia and Germany carved up Poland? Nothing happened when France declared war on Germany. There was a period of 8 months where they just stared at each other. It was called “Phoney war”. Chances are we might witness Russia just steam rolling Baltics while the West talks between each other what to do next.
So the current incident was a preemptive alert by Brussels.
They are struggling to take a couple of villages in Ukraine, why would they invade the EU.
So a lot of their territorial loss can be attributed to his inaction. If they'd laid several million landmines in the Donbass the Russian attack would've been stumped and the occupied Crimea would've been easy prey.
If you mobilize your armed forces and move all your soldiers to the border and dig them in you'll dissuade an attacker from invading.
It used to be much more true. The Biden admin sent a lot more US weapons to fight Russia, Trump used to be much more amenable to send similar weapons provided somebody paid for it.
Nowadays US materiel is either tied up in the middle east or somewhere else (Patriots), or has been neutralized by Russian EW (HIMARS), or the US is just unwilling to part with it for whatever justification.
Responding to a NATO “attack” from Estonia, Putin can pivot to a bigger enemy where of course Russia has to employ universal conscription / nuclear weapons / whatever. The country must unite against this unprovoked western attack, etc, etc.
A single Tomahawk missile could obliterate Moscow which would immediately end the war because Russia is extremely centralized. It's the reason almost 80% of all Russian SAM capability is stationed around the city.
Putin is unpredictable but he's not stupid. You don't become president of Russia by being stupid.
Do you even know how big Moscow is? And nuclear Tomahawks were discontinued. Even if they weren’t, you’d need dozens to obliterate Moscow.
Who attacked Ukraine, again?
I think an actual invasion would initiate a very serious and deadly response, but their constant pranks will continue to go unpunished (unfortunately).
No body knows how much petro product Russia is producing or who is buying them. Those diplomatic documents suggest treating simultaneously as a black box and a cornered animal. The financial sanctions actually was a double edged sword considering UK essentially blocked all foreign transactions even for international infrastructure investments Russia made to foreign countries and at the same time from a global perspective UK was not seen as a reliable financial partner. So, Russia is desparate, EU is desparate but they are not allowed to sit in a table to negotiate... Because US will not allow that. If a war happens across EU every party invovled will see this is to be positive thing because for the last decade economies has slowed down and political views has become extremely polarizing. A war at a massive scale brings everyone together for their country and economy jumpstarts.
This is of course a stupid lie they are telling themselves. They've been invading Ukraine since 2014. They had the option of being good international citizens, with an elite flying to the west and buying some football teams for their entertainment, but they chose not to do that.
> Russia is desparate, EU is desparate but they are not allowed to sit in a table to negotiate... Because US will not allow that.
Russia can retreat inside their internationally recognized borders at any time. The problem is they don't want to sue for peace because that would admit losing, and include losing illegally annexed territory. They've made no serious attempts at even starting negotiations with Europe, while escalating "hybrid warfare".
If nothing else, war has been many times convenient to keep regimes in power (see Bush post 9/11 for an obvious example). Putin might want to strengthen his case. See absurd discussions / push for a "Republic of Narva" as an example cause belli.
https://www.nytimes.com/2022/03/09/opinion/ukraine-russia-in...
A sect of realpolitik theorists outlined why Russia would be compelled to invade Ukraine. Even Kissinger thought that expansion of NATO westward would compel war with Russia. To say no one predicted this or that it’s self-defeating for Russia is a mistake of analysis. The war logically follows from Russia’s security goals.
> The war logically follows from Russia’s security goals.
According to Kozyrev, instead of a patchwork of dysfunctional countries at war with each other like in the former Yugoslavia (with overspilling effects on Russia), EU and NATO integration helped build modern, peaceful and predictable countries in Central and Eastern Europe, which in practical terms meant "free-of-charge security" (his term) for Russia. What's there to complain about?
Furthermore, Mearsheimer et al treat countries as monoliths and completely ignore the competing interests of groups and individuals within them. Russia of the early 1990s was a flawed democracy; today it is a totalitarian dictatorship. The war against Ukraine is a downstream effect of the destruction of Russian democracy and consolidation of absolute power into the hands of Putin's security apparatus gang. Putin wants to be remembered as a "great ruler" and that's all there is to it; a small man who managed to gain absolute power, no different from Hitler.
Because Russian leadership is acting in self interest and preservation and a neverending state of war might be what secures its own position and power.
They can't take Kiev but they're threatening Paris.
By the way similar thing might happen to geniuses buying Internet-connected cars.
What could possibly go wrong?
The grid could stabilize as a side effect. And the cars are already connected to the internet.
No firmware updates. no admin configuration. no ssh backdoors. just a transmit-only system
It sounds like you think victims are necessarily blameless.
The evil victim blamers say "why was she wearing that short skirt?" They don't realize that the mosquitoes are sexist, and that we can and should eliminate all of the mosquitoes so she can wear what she wants.
"Hey, maybe we shouldn't send men over the top only to die in a barrage of machine gun fire..."
"That's just victim blaming--it isn't our behavior that needs to change; it is the enemy's behavior that needs to change."
Victim-blaming is another term that is apparently becoming a meaningless vibe.
In my experience, new cars have new car problems, but old cars have old car problems.
There’s no clear winner in every metric, just trade offs.
> in the future being called a "genius" will always be seen as pejorative.
If you are not a genius and someone calls you a genius, well, for you the future is already here, genius! (Shit I didn't really mean that :P)
Lots of industrial controls haven’t been updated since they were deployed in the 90’s. “And why should they be? If it ain’t broken…” Well, because they’re freaking broken!
So I’m glad that this happened in a tangible, public way people can easily understand without it involving something much more drastic. If your family asks about this, explain that you’re glad no one blew up a gas pipeline… yet.
Connected vehicles are the example that terrifies me the most. There have been numerous examples of lax security in this area already and a fleet of rogue cars or delivery trucks could obviously cause huge amounts of damage, injury, and loss of life.
There's a legacy of openness in car tech and software that was never designed with robust security and isolation of critical components in mind. I've heard that this has started to change more recently and that's reassuring if true. But this still feels like an area with far too little regulation or oversight given the past choices of vehicle manufacturers and far too much rush to connect everything up remotely even for minor convenience reasons.
In some cases there also now seems to be legally mandated connectivity for things like automated emergency calls after an accident. This should at least have a genuine benefit in the unfortunate situation that it's needed - but until vehicle security looks more like Fort Knox than a sandcastle it might still prove to be a bad choice in the end.
Fortunately, there is a straightforward solution. Find the cellular modem fuse and pull it. You now have a modern, but fully offline car. Security aside, connected cars are absolutely awful for your privacy.
The "straightforward" solution is to tell vehicle manufacturers that they aren't allowed to sell vehicles with connectivity unless they also have proper security and privacy protections in place. If no-one can give them money for it then they won't do it.
I am not aware of such a requirement in the U.S. In any case, it would be extremely difficult to enforce, and many cars that initially had connectivity went offline when 3G networks were decommissioned. I doubt those cars are now "illegal."
> Our research uncovered a hidden "code-of-the-day" authentication mechanism that could be abused to bypass normal authentication
> Our analysis began by examining the internet exposure of these devices, where we identified thousands of publicly accessible management interfaces
> (shell injection vulnerability in management interface)
This is how we used to vibe-code before we had LLMs.
On the bright side I'm sure the manufacturer and others will have an increased security posture going forward.
I initially misread it as "On the bright side, I'm the manufacturer..." (and earn a nice profit).
Wonderful world we live in where refrigerators and cars also become e-waste because a manufacturer gets tired of patching them
We're in a "post-patching world" in that the number of 0days coming out is so rapid, I'm not sure it would even matter.
The physical architecture itself is the problem. There needs to be better controls (physical and software) to access those systems. Airgap possibily.
It's not immediately obvious to me why fridges in supermarkets need remote control; a supermarket is a place where there are always people, it's not a base on Mars. And even if a remote is needed, it should probably not go further than the manager's office.
I don’t know to what degree control is needed, but remote supervision of cold holding temperatures is good to make sure food doesn’t spoil. Most places that don’t have networked fridges have staff manually logging the cold holding temperatures to make sure things are working.
Again, though, I don’t know about making changes though.
The other, more likely, answer is that there’s a diagnostic mode that allows raw control of the system and no one bothered to require physical presence to enable service mode.
With remote firmware update capability, at attacker could easily brick the entire fleet. With just service access it could be possible but would be more complex.
Having networked telemetry seems like a good idea, just not sure why they would need remote control too - that seems far more dangerous than necessary.
Wow, are you an optimist. The manufacturer has stated that they're past the period of security updates. And others... meaning the supermarkets? They outsource that. The people they outsource it to? Maybe they'll start paying attention to security.
Probably to inflict pain on the life of the voters so they can blame the government and manipulate the 2027 French presidential election in April. Maybe just a test.
Same as the high velocity train being sabotaged again just in the Spain national day. Hybrid war.
In France this benefits the pro-Russian Lepen's party with the "government is a disaster but we will make them pay for your suffering". Page "16" of the manual. In the end is all the same handbook all around the planet.
Just by the record, EU has just approved the biggest packet of sanctions against Russia so yes, they know. The more desperate grows Russia, the more this will happen. Until it will stop, suddenly, for no reason.
But it could be just for the lulz.
Remember the hackers behind the seven proxies, AntiSec, which hacked the NATO library website, and went to prison for it.