Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly.

That said, the timing of the disclosure and the issue are rather concerning.

Regarding the highest value targets to hit with an attack like this, you would want to target Guam, Hawai'i, and other isolated overseas locations where this would have ripple effects in the local economy. Guam specifically would cause catastrophic supply shortages, since DeCA probably supplies around 50% of the groceries on that island (that's a WAG based on my time there).

I opened Siemens TIA Portal and PLCSIM for the first time and thought “wow, I didn’t think the Windows 95 GUI library was still supported.” None of the PLC contractors we had hired knew how to enable TLS on the thing (user/pass eg admin/admin was their usual). Anecdote: I once spent hours reading the docs and clicking around trying to get it to accept an SSL certificate signed by a real CA and it wouldn’t go, but it accepted one I self-signed in openssl.

In all fairness, the people who are experts in the field of Siemens PLC programming are usually mechanical-ish engineers and security is not in their skill set or on their mind.

Because a half dozen a day sounds plausible as standard maintenance issues, as the author acknowledges. If it were a hack, I'd expect something like 50% of them to have problems. But not knowing how many there are, I don't know how significant these incidents really are.

"Every nonelectric cooler comes with 25 years of free real-time monitoring. On a visit to the company in the spring of 2012, I watched as technicians in Broad Air’s space-age control room checked on the performance of its units in locations as diverse as the Adolfo Suárez Madrid–Barajas Airport in Spain; Qualcomm headquarters in San Diego, California; and Fort Stewart, the U.S. Army base in Georgia [emphasis added].

"Zhang says that 80 percent of his clients are repeaters. “If you bring long-term benefits for your clients, they will choose you.”"

But, I'd be a lot more inclined to that idea if it wasn't for how they failed: they started a defrost cycle that turned the freezers into heaters, spoiling the food quicker. And the failure happened overnight, delaying discovery of the problem.

It could be just a compounding of bad luck. But an attacker with access to the specs for the freezers might be aware of how long they would stay cold after being simply shut off.

Wanted to offer a few clarifications:

I’m not a cybersecurity expert; I’m an investigator (in a totally different field), and this was essentially me following a weird thought to see where it went. My background is in natsec so that’s where my mind goes. There have since been at least dozens of additional freezer outages reported in a similar pattern, but I'm refraining from calling/tracking down every individual weirdness based on a Facebook comment at this point since there are much larger outlets with journalists more proficient than I covering this by now. Another interesting thing - There are numerous freezers and fridges within base stores, not under the control of DeCA/DoD, and none of those appear to be impacted.

I completely agree that a bad update/configuration or other shared technical failure may be the much more boring answer. The interesting part to me is that potentially hundreds of varying systems can converge upstream into common monitoring/control infrastructure. Anyone on this forum probably understands that, however IoT was something that was a relatively new concept when I was in school, and my degrees were somewhat relevant. The average person is blissfully unaware how expansive (and how much work behind safeguarding) the IoT is.

Also, since it came up: Yup. Human written. I’m pretty firmly anti-AI as a writer and also just, like, societally. I'll be sure to add some sort of footnote detailing my ai usage at the bottom of future public facing work, because I too detest reading (or questioning if what I'm reading is) slop. Minimal LLM used for understanding technical concepts and what the fuck fridge norms are…The weird formatting, excessive bolding, neurotic parentheticals, and rant energy are, unfortunately, totally my own. Sorry guys.

This was my first ever public post and intended audience was ~ 10 friends forced to read my diatribe, not thousands of strangers very validly raising questions I am not smart enough to answer myself. Appreciate the discussion and will be further educating myself on some of the points a few of you have brought up.

Regardless if this was a hack or a bug, the bigger lesson is that overcomplicated systems fail in catastrophic ways. Why do military commissaries need remote-controlled freezers? It seems like a very fragile, and needless, way to run a freezer.

---

But, there are some options that the author didn't consider:

1: This could be a quickly applied patch that failed.

2: This could be a "script kiddie" hack from someone who isn't a government actor.

I'm less onboard with a state actor. Generally, when a state actor has hacked something, they don't want the victim to know. In this case, if it was a state actor, I would anticipate that they would make a single freezer fail in a way that they could verify using something like a hacked video camera or otherwise by watching public social media feeds. IMO: A state actor would only "make sense" if they knew the hole was closing soon and they don't care if they're discovered, perhaps because their operation is winding down.

Could be a hack or a design flaw. I await the root cause analysis.

There doesn't seem to be anything indicating an advanced attack. If you're a foreign adversary and you want to flex your muscles (in a way that would be a borderline act of war), you don't just flip one switch and giggle about spoiled food.

We know there's been a severe rot of operational capabilities in the military thanks for Hegseths purges and general stupidity. It's entirely possible and quite likely that over the course of his various drunken binges he decided to get rid of people who were in charge of operational control for stuff like freezers across military bases.

I was curious if this was continued evidence of poor appropriations and upkeep or what... I do see "U.S. military commissary refrigeration maintenance, equipment replacement, and physical infrastructure are funded through the 5% commissary surcharge paid by customers at checkout rather than direct congressional appropriations."

So, perhaps the first place would be to follow the money - are these being repaired at the proper rate? Is this repair outsourced to third party vendors? (my guess). Is this gonna end up being the McDonald's Ice Cream machine all over again?

Really though, Hanlon's would be much easier to believe this is yet further ineptitude by those who run things (I am not going to claim malfeasance/malevolence, except a general sense of such across the board by this admin).

Since I'm not on the inside, anything I have to say would be speculative, just like the above, or the author themselves (I have no idea who it is, and perhaps they have a better beat on the ground with regards to this), but it just falls in line with "we're running out of missiles" and "sailors attempting to kill themselves".

We're so insistent on being #1, we can't admit we're in a society that is falling apart (and again, it may be the case that this IS a hack, but if I were to place my bets...)

Ineptitude, lowest cost players, etc "efficiency" indeed. You get what you pay for, and I guess 5% don't pay for a whole hell of a lot these days.

And yes, remember you can explain everyting by adding enough dimensions to a game of chess. But in reality? Seems the upside is near zero while the dowside is sacrifising your access.

Now, considering how the OpenAI/HF hack emerged out of nowhere, it might be possible that groups of AI agents might have done this even without any close human supervision.

> "I'm sorry I'm familiar with that function. Let me research enabling defrost for you."

Having remote on/off capability, or even the ability to set temperatures for freezers remotely is just so insanely idiotic, I don't get it. Why even have the path? If the temp is wrong, go investigate.

This is such a colossal non-problem. The risk is now, at the start of a war action base supplies could be made unusable.

One of the big current risk scenarios is, all smart cars, all meat packing plants, all industrial capacity, all phones, all internet, all interrupted at precisely the same time. A multi-pronged hack, right at the start of the war.

Imagine all electric cars bursting it flames in garages as they charge overnight. Conjoined with all cell phones, network connectivity, and landlines going out. And 911 call centres.

So now you have a fire raging, the fire department doesn't even know, and if it wanted to respond? There's 4 fires on every suburban block.

Within a few hours, a large portion of the populous now has no housing.

That's just from two simple hacks, communication and electric cars.

The society of always-on-connected is just dumb, stupid, insane, and has threat-results worse than some nuclear exchange scenarios.

And there will never, ever, ever be secure software. Ever. Never going to happen, ever. No rust, no this or that, no AI help, will ever, ever, ever secure software. Ever.

And how do I know this?

Because 50 years later, I've seen software just as buggy, insecure, as it always has. Anyone thinking "oh, we can just do this thing! And then software will be safe" is a loon, it'll never ever happen.

And that means?

Nothing important should ever be network connected, ever.

So why would any yahoo think remote control capacity on a freezer is sane?

The PLC engineers I had contact with usually had an electrical engineering background. That's why they like PLCs in the first place with the ladder logic programming languages, grafcet and if they feel fancy a bit of structured text (assembly like) or structured control language (pascal like). They indeed did not know much about software security but a great deal about machine safety.

A real security nightmare are older OPC servers (OPC-DA) which is super reliant on DCOM. OPC is quite important to connect the PLCs to SCADA systems or 3rd party devices.

Stuxnet was over a decade ago.

There should be a simple rule that everyone with the ability to understand things like PLCs should be able to grasp: your equipment does not touch the internet or external storage, period.

Those who can't grasp this concept should be shown the door with a recommendation that they find a less mentally-taxing line of work.

Now with the EU cyber resiliency act things are moving but I think it's infeasible for many sites to meet modern security standards, because of both hardware and software.

The problem is the author should have put a few concise bullet points at the top. (14 freezers failed at the same time. They are all internet-controlled, and failed at the same time as a disclosure about a vulnerability. They all failed by turning on the defrost cycle and heating food.)

I really recommend skimming the article to the end.

(Unfortunately, the article really is so verbose it's a borderline rant.)

In my mind, if this was a hack, it was probably not a Stuxnet virus or something. These are smart fridges we're talking about - someone probably just logged into them using leaked credentials or a Web app vuln, and turned them off.

It's definitely suspicious. My money is on inside job — perhaps someone not fond of the current administration's handling of things. In my experience, these types of vulnerabilities are well-known and kept in the back pocket of engineers that have a lot of experience maintaining the equipment. Everywhere I've worked has been deeply vulnerable in some way, all of the engineers knew it, and often joked about it or were counting the days to getting pwned because companies never like to spend money to address the issue. I'm sure the military is no different. Probably worse.

My main question was "did Claude do the investigation by itself or just write up the article from someone's notes?"

Also though, I'm quite willing to believe this is human written and the human just happens to have a Claudey style. The actual prose isn't that Claudey it's just the structure of how it presents ideas. But, Claude had to get that structure from somewhere. It's not that surprising to see people with that style of communication.

I’ve seen similar too many times in my career - synchronized clocks are great until someone deploys a cronjob that fires at exactly the same time across the fleet and it breaks a certain OS or firmware revision. Which then exposes another bug that exists globally.

I definitely still subscribe to don’t attribute to malice what you can attribute to incompetence mindset.

Certainly all speculation though, real root cause will be interesting if it ever becomes public.

Could be the Iranians, or someone aligned, conducting anti-morale operations. Could be the start of a series of small but annoying failures.

I'm sure some script kiddie broke into a government network, hacked an industrial process, and forced a limited supply piece of equipment into a failure mode that takes some thought and is more unique as an attack vector. It's just like buying hacks for CS source right?

Unfortunately, I would wager that all BAS software is full of flaws and holes, allowing access to it for the public internet seems like a bad idea. I need to be on my company VPN to access our locally hosted BAS front end (which I have authorized access for) which seems like the bare minimum security.

The internet security practices I experienced when working with the DOD in a prior life were…interesting?

Outside of the classified realm, there seemed to be little to no on the ground understanding of the Internet. Many things where internet connected that shouldn’t be or weren’t that should. I was involved in one contract where we had to demonstrate the ability to remotely access and control a system (to satisfy the system’s owner) as well as demonstrate that the system could not be remotely accessed via the internet (to satisfy the base IT folks). The solution was a hotspot kept in a lock box…that I doubt was ever locked after we left because it was constantly attached to our internal monitoring network despite our pleas.

“If sovereign and subject are in accord, put division between them.” —Sun Tzu, The Art of War

This sounds like the sort of "quasi-religious point of view" you're slamming, considering it's been tried repeatedly already without great success.