超市冰柜遭黑客攻击，凸显万物联网的风险Supermarket-Fridge Hacks Show Risk of Linking Everything to the Internet

BRUSSELS—Cyberattacks on supermarket freezers and blood banks across Europe in recent days send a warning that when things everywhere connect to the internet, things everywhere are vulnerable to hackers. It is a weakness made worse by AI.

Almost all new devices now come with an app or a web portal, controlling everything from lights and ovens to cars, pacemakers and power plants. The internet-of-things, or IoT, has made daily life more convenient while offering companies big savings through innovations including remote operation of industrial equipment and predicting when maintenance is needed.

But constant remote access to physical equipment now brings the same risk that long faced online data: Hackers also want to get in. Artificial intelligence suddenly makes the problem much bigger, because hackers are automating their hunt for exposed web connections and running searches at blistering speeds.

“Attacks on physical equipment used to require specialist skills, time and money. AI is removing those barriers, which means far more connected devices are becoming viable targets,” said Gianni Cuozzo, chief executive of Exein, a Rome-based company that develops cybersecurity technology to protect connected devices, physical AI systems and critical infrastructure.

Since last month, supermarket-refrigeration controllers across Europe have been hacked to defrost and heat up units, turning them into ovens and ruining stock. French blood banks were also attacked, though the hack was thwarted before causing damage. The culprits aren’t publicly known, and experts say they didn’t demand ransoms, indicating their aim was to disrupt rather than extort.

Automated physical systems such as electricity grids and controls in water facilities “are not built on the strong foundations they require,” said Richard Horne, the CEO of Britain’s National Cyber Security Centre, in his annual review speech last week.

“Our resulting exposure as a society is huge and increasingly exploited in cyberattacks, as we are seeing in the disruption of refrigeration units across Europe,” he said, warning of an unprecedented surge looming in cyber incidents.

When countries in the North Atlantic Treaty Organization last year agreed to spend 5% of economic output on defense and security, they allocated almost one-third of that to homeland resilience in areas including cybersecurity and infrastructure protection. California, the European Union, the U.K. and other jurisdictions have mandated better IoT security standards.

The U.S. Cybersecurity and Infrastructure Security Agency, other federal offices and allied governments have issued a string of warnings about hacking dangers lurking in physical systems including port cranes, security scanners and ventilation systems. CISA and the Federal Bureau of Investigation in July warned about hacking of water and wastewater networks across the U.S.

Still, more than 20% of IoT devices have at least one known cybersecurity vulnerability, according to cybersecurity specialists Palo Alto Networks. Office printers and digital video recorders, which remain on constantly, are top targets of hacking, according to Palo Alto. Vending machines, access controls and payment terminals are also on the target list.

Hackers include governments and state-backed operations. One of the first high-profile cyberattacks on a physical system, the 2010 sabotage known as Stuxnet targeting Iranian equipment used to enrich uranium, is widely attributed to the U.S. and Israel. NATO members and allies have accused Russia and China of staging cyber-physical attacks and planting hidden software for future disruptions.

The Polish government’s Computer Emergency Response Team in August said the “first cyberattack against Poland’s energy sector in which the objective was purely destructive” occurred last December. No attribution for the attack was given.

Hackers supporting Ukraine have attacked digital control systems in scores of Russian power plants, factories and water plants since Moscow’s invasion in 2022, which itself was preceded by hacks on Ukrainian infrastructure. Webcams have become a top target in the conflict, acting as tools of espionage and war.

The danger extends far beyond any particular device that gets hacked. When equipment—be it a living-room smart TV or an assembly-line control—connects to an internet server via Wi-Fi or some other local network, that piece of equipment also potentially offers hackers a backdoor into the local network. Once inside that network, hackers can then attack other connected devices, including servers controlling valuable information.

Computers, servers and networks inside enterprises now generally carry layers of cyber-defenses, often overseen by specialists. Most IoT devices, in contrast, get little or no attention regarding cybersecurity. In the recent cyberattacks on European refrigeration systems, some of the targets had weak or default passwords, according to the Dutch National Cyber Security Center.

“The world is connecting everyday equipment to the internet faster than we are securing it,” said Boudewijn Wijnands, CEO of Fortaegis, a company based in Amsterdam developing computer-security systems using physical properties of microchip materials. He said adding layers of software protection increases cost and complexity but doesn’t necessarily solve problems because “the cracks often appear at the seams where hardware and software layers meet.”Hackers frequently target little-noticed devices within bigger systems, from which impact can ripple far.

Solar panels, for example, connect to electric systems via digital inverters, which convert direct current into alternating current. Technical experts fear that they could be used to crash entire power grids.

A small number of companies dominate inverter manufacturing, so a hack—either by outside attackers or a nation-state with direct control—could potentially disrupt power supplies, officials say. Grids aren’t built to withstand big swings in electricity flows.

A recent report prepared for the EU warned that the sudden disappearance of three gigawatts from Europe’s grid could trigger rolling blackouts. A single Chinese brand makes inverters that handle more than 100 gigawatts of EU solar power, according to an industry group’s analysis, meaning a cutoff in just some of its inverters could wreak havoc on European power supplies.

A challenge in protecting physical devices is that their digital controls often have minimal computer memory. Such setups complicate both installing cybersecurity software and conducting forensic analysis on attacks to identify culprits.

New approaches to protecting equipment include security systems integrated into microchips, not software and networks. Exein, for example, trains chips to flag unexpected digital activity, like in Europe’s supermarket hack, when freezers were cranked to above 120 degrees Fahrenheit.

“A refrigeration unit should recognize that heating to a dangerous temperature makes no sense and reject the command, even from a system it normally trusts,” said Exein’s Cuozzo. “Compromising one central system should not mean compromising every device connected to it.”