A Warmer Cold War

A major cyberattack has hit supermarket fridges and freezers in a number of European countries, stirring understandable suspicions of yet another Russian “gray zone” onslaught. It follows an earlier, similar attack on some 700 French supermarkets in September in which hackers caused cooling units to heat up to over 100 degrees Fahrenheit, setting off fires and spoiling food. Damage was estimated to have run into the tens of millions of euros.

In recent years we have learnt that lengthy, efficient supply chains can be a source of vulnerability. The same is clearly true of hyper-connected businesses, not to speak of the internet of things. However annoying and costly, an attack on refrigeration units is obviously no Pearl Harbor, but it is not much of a stretch of the imagination to think that it was a dress rehearsal for something.

The attack was also another reminder to ponder the vulnerability of equipment, whether it’s buses in Norway or inverters used in solar power, bought from manufacturers based in unfriendly countries.

Here’s the Washington Post from December last year on the inverters:

More than 85 percent of the utilities surveyed confidentially by the research group Strider Technologies are using inverter devices made by companies with ties to the Chinese government and military. Many cybersecurity experts warn that the devices are vulnerable to hacking that can set off cascading outages.

Chinese officials say the warnings are unfounded. The researchers, however, found evidence that engineers in China have been studying how vulnerabilities in the U.S. grid could be exploited. While such studies are common in the industry — scientists around the globe routinely share knowledge on power grid resilience — some of the Chinese efforts unnerve U.S. officials in the context of China’s broader initiatives to infiltrate infrastructure.

For a classic (if elderly) example of the devastation wreaked by a real-world (Russian) hack, in 2018 Wired told the tale of what happened when Maersk, a hugely important shipping company, was hacked:

Jensen walked out of the building and into the warm air of a late June afternoon. Like the vast majority of Maersk staffers, he had no idea when he might return to work. The maritime giant that employed him, responsible for 76 ports on all sides of the earth and nearly 800 seafaring vessels, including container ships carrying tens of millions of tons of cargo, representing close to a fifth of the entire world’s shipping capacity, was dead in the water. . . .

The release of NotPetya was an act of cyberwar by almost any definition—one that was likely more explosive than even its creators intended. Within hours of its first appearance, the worm raced beyond Ukraine and out to countless machines around the world, from hospitals in Pennsylvania to a chocolate factory in Tasmania. It ­crippled multinational companies including Maersk, pharmaceutical giant Merck, FedEx’s European subsidiary TNT Express, French construction company Saint-Gobain, food producer Mondelēz, and manufacturer Reckitt Benckiser. In each case, it inflicted nine-figure costs. It even spread back to Russia, striking the state oil company Rosneft.

The result was more than $10 billion in total damages. . . .

For days to come, one of the world’s most complex and interconnected distributed machines, underpinning the circulatory system of the global economy itself, would remain broken. “It was clear this problem was of a magnitude never seen before in global transport,” one Maersk customer remembers. “In the history of shipping IT, no one has ever gone through such a monumental crisis.”

The turnaround began when someone tracked down a “lone surviving domain controller in a remote office—in Ghana”:

At some point before NotPetya struck, a blackout had knocked the Ghanaian machine offline, and the computer remained disconnected from the network. It thus contained the singular known copy of the company’s domain controller data left untouched by the malware—all thanks to a power outage.

There’s a lesson there.