What fridge hacking across Europe means for your devices - ABC News & Headlines – Australian Broadcasting Corporation

Cyberattacks on fridges and freezers across Europe have spoiled food and put blood supplies at risk.

The head of the UK's National Cyber Security Centre says the French fridges were using default passwords, and supermarkets from Sweden to Belgium and Estonia have also been hit.

So should your own fridge be connected to the internet?

What about lights, air con and baby monitors?

Cyber security expert Troy Hunt explains why supermarket fridges should never have been  on the open internet and how to choose safer connected devices.

David Coady: Food's been spoiled across Europe and even blood supplies put at risk in repeated cyber attacks on fridges and freezers. The French blood service says temperatures were set to extremely high levels at three sites but plasma was saved after alarms sounded. It follows a second wave of mysterious attacks on supermarkets from Sweden to Belgium and Estonia, which saw the fridges and freezers remotely taken over, some set to 50 degrees Celsius, spoiling millions of dollars worth of food. The culprits and their motive is unknown. France was hit hard in mid-October with hundreds of supermarkets affected. The head of the UK's National Cyber Security Centre told reporters the French fridges were using just default passwords. Commercial fridges and freezers are on the internet so they can be monitored around the clock. But should your fridge be connected to the internet? Cyber security expert Troy Hunt loves connected devices but he's not sure about a smart fridge.

Troy Hunt, Web security consultant: Everything but the fridge. But look, I mean a lot of practical stuff for pretty much every light in the house is connected so I can set scenes. The awning is internet connected so that it can come down a little bit in the evening and keep the backyard dry so i can sit out there first thing in the morning. So there are lots of really good practical reasons for internet of things connectivity but it certainly does raise some security concerns too.

David Coady: But of course securing them can be a hard job if you're not technically minded.

Troy Hunt: Oh look it can be a hard job full stop i've got to be honest i'm not sure when i last updated the firmware on my awning.

David Coady: The convenience of internet connected devices is a trade-off given it's hard to eliminate all risks.

Troy Hunt: You know one of the things that's always concerned me like that's sort of one of the canonical vulnerable IOT devices are things like a baby monitor where people put a baby monitor out there and of course it's in the bedroom because that's where the baby sleeps but it's internet facing and it has a default password or no password. Now in a case like that on the one hand it seems terrible that maybe someone else is watching your baby on the other hand I can understand the desire for a new parent to be able to know if the baby is is still moving around or still breathing or not laying on the stomach or whatever concerns them.

David Coady: And what could actually happen if hackers got in?

Troy Hunt: Well the obvious risk is someone gains access to whatever the IoT thing is. So in this case they gain access to the baby monitor and they can see the baby. We've certainly had incidents in the past where people have been able to speak via these cameras because some of them have microphones and speakers in them as well so you can have a two-way conversation. There has certainly been other precedents where we've seen IoT devices weaponised to start mounting attacks on other devices. There is the risk that a vulnerable device in your house is the foothold into the other devices on your network as well.

David Coady: So if you think the convenience of connected lights, air-con and baby monitors is worth the risk, the advice is to at least look for well-known manufacturers.

Troy Hunt: A lot of these vulnerable ones we've seen have been very cheap devices from offshore where you really don't get much assurance from the company making them as to their security posture.

David Coady: And as for supermarket fridges or critical infrastructure, they can be networked but should never be on the open internet just waiting for someone to log in and default passwords are a no-no. But who changes the password for a fridge?