alt Hacker News> The advent of AI and its ability to find vulnerabilities so quickly
No AI needed. The supermarket controllers had software with guessable passwords and outdated nginx, both of which had patches out for a year.
Some hardware had reached end-of-live, and were never replaced.
All were connected directly on the internet instead of secure APNs or VPNs.
This is long-standing, basic management failure, and the fines should reflect that.
Replies
Tryvrsakjo10 • today at 12:38 PM
So, the people in charge are either inept or just sleeping on the job especially for things that are so important to people's lives. cause it seems like everyday something else is getting hacked or exploited because of its vulnerabilities.
➕ show 1 reply
It is hard to wrap your head around a freezer reaching EOL due to no longer providing firmware updates though. I can absolutely understand why you'd have a hard time convincing a manager that you need to spend money to replace a "perfectly good" freezer just because the vendor no longer provides firmware security updates.
I agree that it's a manager failure in part, but I also think it's a failure on part of the industry to not demand longer term support for this type of product, and also on part of regulators for not realizing the vulnerability of the situation (though the EU Cyber Resilience Act seems an acceptable first stab at remedying this).