如果您拥有任何工业智能冷柜，请多加小心。美国联邦政府正敦促所有者和运营商将其与互联网断开连接、应用补丁、更改默认密码，并采取其他安全措施，以防范在欧洲已经普遍存在的此类攻击。
If you have any industrial smart freezers, look out. The US federal government is urging owners and operators to disconnect them from the internet, apply patches, change default passwords, and take other security measures to prevent the kind of attacks that have become prevalent in Europe.
美国联邦调查局（FBI）网络处运营主任布雷特·莱瑟曼（Brett Leatherman）在一份声明中表示：“我们看到这些系统在全球关键基础设施领域遭到攻击，这使库存和设备面临风险。”
“We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk,” FBI Cyber Branch Operations Director Brett Leatherman said in a statement.
自10月中旬以来，不明身份的恶意分子黑客攻击了法国、比利时、爱尔兰、卢森堡和瑞典数百家杂货店内的数千个远程控制制冷系统。这些攻击将冰箱内的温度提高到了高达50摄氏度（122华氏度），导致食物变质并引发火灾。
Since mid-October, unknown miscreants have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden. The attacks increase the temperature inside fridges to highs of 50ºC (122°F), spoiling food, and sparking fires.
曾向美国联邦调查局询问其是否记录了针对美洲制冷和冷链监测系统的成功或未遂攻击。我们在截稿时尚未收到对我方问题的回复，也不知道美国超市有针对这些系统的任何有记载的数字攻击。
The asked the FBI if it has documented any successful or attempted attacks against refrigeration and cold chain monitoring systems in America. We had not received a response to our questions at the time of publication, nor are we aware of any documented digital attacks against these systems in American supermarkets.
但有迹象表明，美国本土的运营商已经意识到了这个问题。荷兰杂货巨头阿霍德·德尔海兹（Ahold Delhaize）在美国经营着食品狮（Food Lion）、巨人食品（Giant Food）和停止与购物（Stop & Shop）等美国超市连锁店，该公司上个月表示，在发生影响其大部分美国和欧洲品牌的网络攻击后，已主动将IT系统离线。欧洲的德尔海兹超市正是遭受破坏性冷柜攻击的目标之一。
But there are signs that stateside operators are aware of the issue. Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, last month said it proactively took IT systems offline following a cyberattack that affected most of its US and European brands. Delhaize supermarkets in Europe are among those hit by the destructive freezer attacks.
据路透社援引四位知情官员的话报道，五角大楼据称也将8月份美国各地军事基地发生的一系列导致食物变质的冷柜故障视为疑似网络攻击。
The Pentagon is also reportedly treating a series of freezer malfunctions that spoiled food at military bases across the US in August as a suspected cyberattack, according to Reuters, which cited four officials familiar with the matter.
美国联邦调查局、网络安全和基础设施安全局（CISA）、卫生与公众服务部以及农业部和交通部在周四的一份联合预警中，警告各组织注意工业制冷和冷链监测系统运营商正面临的持续网络威胁。
In a Thursday advisory, the US FBI, Cybersecurity and Infrastructure Security Agency (CISA), Health and Human Services, and departments of Agriculture and Transportation warned organizations about the ongoing cyber threats facing operators of industrial refrigeration and cold-chain monitoring systems.
这些机构表示：“攻击者可能会利用未修补的或可从互联网访问的控制器中的漏洞或弱点，远程更改设置并迫使机组进入持续加热和除霜循环，这可能导致大范围的库存损失和设备隐患。”
“The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards,” the agencies said.
联邦机构称，攻击者通过绕过身份验证、注入任意代码以及滥用薄弱的配置来利用这些缺陷。一旦罪犯进入系统，他们就可以改变温度使食物或控温药物变质、引发火灾，并最终伤害消费了未在适宜温度下储存的产品的民众。如何保持警惕为了防止这些情况发生，政府机构敦促所有者和运营商“立即”实施最佳实践和安全防护措施。
Attackers exploit these flaws by bypassing authentication, injecting arbitrary code, and abusing weak configurations, according to the feds. Once criminals gain access to the systems, they can change the temperature to spoil food or temperature-controlled medications, start fires, and ultimately harm people who consume products that haven’t been stored at proper temperatures. How to stay frosty To prevent these scenarios, the government organizations urge owners and operators to “immediately” implement best practices and security protections.
清单上的重中之重是：切勿将工业控制系统和设备暴露在公共互联网上。伊朗黑客曾于7月份利用可通过互联网访问的可编程逻辑控制器（PLC）侵入了100多个美国的供水系统。这种暴露在外、通常缺乏密码保护的设备，对于寻找捷径以进入关键设施的恶意分子来说是一大福音。
First and foremost on the list: do not expose industrial control systems and devices to the public internet. Iranian hackers used internet-accessible programmable logic controllers (PLCs) to break into more than 100 US water systems in July. This sort of exposed device, which often lacks password protection, is a boon to miscreants looking for an easy button to gain access to critical facilities.
联邦机构建议：“如果确有必要进行远程访问，请使用防火墙或边缘设备对其进行保护，并将其更新到最新版本，以减少安全漏洞。”其他推荐的策略包括：为运营技术（OT）设备创建一个专用VLAN，将工业设备与商业网络隔离。
“Should remote access be necessary, protect it by using a firewall or edge device and updating it to the latest version to reduce security vulnerabilities,” the feds advise. Other recommended tactics include: Create a dedicated VLAN for operational technology (OT) devices, to isolate industrial devices from business networks.
用强密码和策略替换默认密码，并尽可能启用防网络钓鱼的多因素身份验证（MFA）。及时应用补丁，并淘汰和更换不再接收制造商安全更新的旧设备。
Replace default passwords with strong passwords and policies, turning on phishing-resistant multifactor authentication (MFA) whenever possible. Apply patches in a timely manner, and retire and replace legacy devices that no longer receive security updates from the manufacturer.
定义并维护设备和IP白名单，将对OT设备的访问限制在名单上的设备。维护并测试备份。这些备份应保存在异地和离线状态。最后：启用日志记录并定期审查日志以发现任何异常活动。®
Define and maintain a device and IP allow-list, and limit access to OT devices to only those on the list. Maintain and test backups. These should be kept offsite and offline. And finally: enable logging and regularly review logs for any unusual activity.®