US issues cyber attack warnings

USA: Authorities in the US have urged refrigeration owners and operators to strengthen their security arrangements following the recent spate of cyber attacks. 

The Cybersecurity and Infrastructure Security Agency, FBI, Health and Human Services, US Department of Agriculture, and the Department of Transportation have said that are aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally. 

They urge owners and operators to defend against this activity by using strong authentication, keeping systems updated, identifying any systems that are accessible from the internet, removing unnecessary remote access, and securing any necessary remote access.

The authoring organisations say they are aware of malicious cyber actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. They warn of attempts to exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles.

They urge organisations to eliminate public internet exposure and protect necessary remote access by using a firewall or edge device and updating it to the latest version to reduce security vulnerabilities. 

It advises the isolation of operational technology (OT) devices by creating a dedicated virtual local area network (VLAN); to change default passwords, strengthen passwords, and implement strong password policies. In addition, it advises implementing multifactor authentication wherever feasible and urges operators to keep device firmware up to date and replace legacy devices. 

The agencies did not explicitly say whether any refrigeration systems in the US had been targeted, but it is reported to be investigating incidents of refrigeration malfunctions at commissaries on military bases in August.