Israeli hackers and activists Noam Rotem and Ran L from Safety Detective research lab have discovered a security breach that affected industrial refrigerating systems around the world.
Found to have affected systems manufactured by Resource Data Management, a Scotland-based remote monitoring solutions company, the researchers found thousands of the internet-connected refrigerating systems vulnerable to hacks.
This is because the owners were still using the systems' default username-password combination.
What hackers needed to do, is to simply use the Shodan search engine to find these devices, and hack into them using their default password, which can be found on the manufacturer's website.
Many of these vulnerable units are located in industrial refrigerators in restaurants, hospitals and supermarkets and grocery stores from the U.K., Ireland, Sweden, Germany and China. The researchers also found a pharmaceutical company in Malaysia and a cooling facility in Germany.
Defrosting these industrial refrigerators could lead to huge financial losses, water damage, and possibly the destruction of the units.
"The systems can be accessed through any browser,” said Rotem. “All you need is the right URL, which as our tests show, isn’t too difficult to find.”
To defrost these industrial refrigerating systems, according to Rotem, only takes a “click a button and enter the default username and password.”
And by having access to systems, bad actors can also modify user settings if they wanted to, send an alarms or initiate other features available on the exposed devices.
These systems all use the unsecured HTTP protocol and the 9000 port (sometimes 8080, 8100, or 80), and they all have the default username and the default "1234" password.
Resource Data Management responded by saying that:
But the thing is, according to Rotem, the change isn’t mandatory, so many owners don’t bother. The company also distanced itself from its own security practices.
"We have no control over how our systems are set up by the installer and we suggest your article is directed at the users and installers of our equipment," the company's representative said. "We will inform owners that we have new software available with new functions and features but ultimately it is up to them to request an upgrade."
In the era of the Internet of Things, owners of these devices should take special care to secure their systems. They are all advised to change their system's default login credentials to prevent any unwanted people from breaching their systems.
