Pentagon officials suspect hackers went after the military’s commissary freezers, according to Reuters.
Four officials said Defense Department investigators are treating a string of freezer malfunctions at military bases in August as a suspected hack, with one adding that investigators spoke to their French counterparts after hackers attacked supermarket freezers across France earlier this month. The Pentagon told Reuters in a statement that a unit of Cyber Command is “working in close coordination with interagency and law enforcement partners” on the issue, while Army criminal investigators confirmed they are collaborating with French police.
The blog Signal and Silence was the first to raise suspicions about the issue in late August, writing that they were “self-aware enough to know this sounds insane,” but “there is a nonzero chance someone has hacked the commissary freezers.” That post identified 14 reported commissary/freezer outages at military installations in 11 states. (Reuters confirmed at least six.)
Signal and Silence also noted that social media posts from Arizona’s U.S. Army Fort Huachuca had clarified there was no power outage, but that the freezer went into “defrost mode where it heated up all the food. Trust us when we say it was ‘spoiled.'” The Pentagon’s Defense Commissary Agency (DeCA) imposes engineering specifications requiring defrost be “controlled through the RMCS [Remote Monitoring Control System],” and one procurement document shows RMCS is in place at 182 sites, including all 14 on the list. The blog also catalogued posts showing that commissaries at bases including New Mexico’s Holloman AFB, California’s Fort Irwin, and Rhode Island’s Naval Station Newport had all posted notices about refrigeration failures that kept chilled and frozen goods off shelves.
Finally, Signal and Silence noted that in early August, Claroty Team82 security researchers had posted two studies identifying vulnerabilities in the Danfoss AK-SM 800A and Copeland XWEB Pro freezer control systems, which are used to centrally manage commercial refrigeration. The blog couldn’t establish whether any affected DeCA sites used those specific systems, though Reuters reported Danfoss had an army of such controllers in France. At least one DeCA site uses a similar Danfoss system, but it wasn’t on the affected list.
According to Reuters, the French incident affected more than 350 stores and in some cases resulted in fires. This dovetails with one anecdotal report cited by the Signal and Silence blog post that two commissary deli freezers at Wyoming’s F.E. Warren AFB reached temperatures of 160 to 180 degrees Fahrenheit (it’s not clear whether this measurement was of the temperature display, the food, or the machinery itself).
If confirmed to be a hack, this would come down to a perennial security issue: industrial controllers, the computers used in a massive variety of industrial devices or operational technology (OT) to collect sensor data and receive instructions. Controllers (particularly programmable logic controllers, or PLCs) have been used in virtually every industrial or infrastructure environment for decades—hence the problem. Many controllers were designed before either the global internet or widespread awareness of the risks that pop up when industrial or OT systems connect to the internet. It is only relatively recently that manufacturers of PLCs and other types of controllers have paid attention to security concerns, and the long tail of vulnerable controllers is a juicy target for threat actors looking to extort organizations over downtime or simply cause damage and organizational disruption.
In the rapidly modernizing agricultural and food industries, that often means the attacker’s leverage is rendering food commercially useless by making it unsafe to consume. While cranking up the dial on freezers is one method, simply shutting down production can cause mass spoilage of goods or costly supply chain issues. For example, farmers literally can’t stop milking cows if dairy packaging and processing facilities go offline. The milk either spoils or is dumped under the FDA’s Pasteurized Milk Ordinance, which requires unprocessed raw milk tanks be drained after 72 hours.
Bill Moore, the CEO of industrial cybersecurity provider Xona Systems, told Reuters that designers originally viewed controllers as isolated devices occasionally serviced by humans, not gateways to the internet.
“It can definitely disrupt the supply chain for food,” he said.
