Cyber firm claims over 800 UK supermarkets vulnerable to attack

UK: An internet scan has revealed that more than 800 refrigeration and BMS controllers in the UK are vulnerable to a cyberattack similar to those experienced in France this week.

Following the news that refrigeration systems in a number of French supermarkets had been forced into a continuous defrost cycle by hackers, a team at UK Cyber Defence Ltd measured how many refrigeration and building-services controllers in the UK are currently reachable from the open internet. 

It says it used the same public internet-scanning services that anyone can use, alongside the company’s own threat-intelligence platform, IP Insights, which watches the same territory from more angles.

It found more than 800 instances of control screens answering directly to the open internet, across several different manufacturers. 

“The short version is that the United Kingdom is exposed – not on the scale France was, and not in quite the shape you might expect, but exposed,” UK Cyber Defence warned. And 800, it maintains, is a conservative figure.

While, in France, the exposed controllers were overwhelmingly Danfoss, the Danish manufacturer’s controls barely showed up in the UK’s freely available open-source data sets.

“Of the controllers we can see answering on the open internet here, the most common by some way are Copeland (the Emerson/Dixell XWEB family) and Carel, with Danfoss a distant third — a handful rather than hundreds,” UK Cyber Defence said.

The security firm suggests that the problem with Danfoss controllers may have been a particularly French problem. “There are getting on for three thousand Danfoss controllers facing the internet there, more than in any other country on earth, which is a large part of why France was the one that got hit,” it claims. “In the UK, Danfoss barely shows up in the freely available open-source data sets.”

The UK Cyber Defence’s claim of 800 vulnerable controllers is said to be a low estimate. The scans carried out count live controllers whose management screens were answering to the internet when the search was undertaken. The scanners can only see a device if two things are true at once – it is reachable from the open internet, and it presents a recognisable web page or other indicator when something connects to it. 

UK Cyber Defence explains that there is nothing wrong with the web page existing. “The problem is where it is reachable from. Think of the controller’s login page as a door. On a safe installation that door opens onto a private corridor: to get to it at all the engineer first connects through a locked, encrypted tunnel – a VPN – or through the manufacturer’s own managed remote-service system, and only then reaches the controller. 

“On an exposed installation, the same door opens straight onto the street: anyone on the internet, anywhere in the world, can walk up to it and try the handle. 

“Our 800-plus are the doors currently opening onto the street.”