The attackers who sabotaged the cooling systems in hundreds of French supermarkets exploited the increasingly widespread connectivity of devices that were mostly mechanical in the past. Experts explain the likelihood of a refrigerator, a smart TV, or a deep fryer being targets of a cyberattack.
From refrigeration and heating systems to surveillance cameras and alarm networks, a growing range of devices can now be monitored and controlled remotely. And this provides new opportunities for cybercriminals.
The first question anyone might ask after the sabotage of the refrigerated display cases in French supermarkets is this: can hackers truly penetrate my refrigerator?
Theoretically, yes. If a device is connected to the Internet – either directly or through an app, a cloud service, or a home network – it can potentially be compromised by hackers.
In 2015, at a cybersecurity conference in Las Vegas, researchers demonstrated how a Samsung smart refrigerator could be compromised, allowing them to intercept some of the Internet traffic passing through the device, as reported by Reuters.
Experts also explain why hackers would do this. In many cases, they are more interested in stealing data, disrupting services, or using connected devices as a gateway to a broader network.
Usually, the target is an institution or a company. And an individual who presents a specific interest for attackers may also be targeted.
Household Devices Vulnerable to Hacker Attacks
The most common targets are devices connected to the Internet and controlled remotely. Among these are:
- surveillance cameras;
- video intercoms;
- alarm systems;
- smart locks;
- thermostats;
- central heating systems.
And smart appliances – such as refrigerators, ovens, and washing machines – can be vulnerable if connected to the Internet. Surprisingly, even some toothbrushes are connected to the Internet.
According to industry security data, routers – not appliances – account for more than three-quarters of total attacks on connected devices, as mentioned by the source.
The number of these devices has rapidly increased as manufacturers have introduced Internet connectivity into products that were previously solely mechanical.
What Hackers Can Do
Once inside a device, a hacker can generally do one of the following:
- collect information;
- take control of the device.
A camera can reveal the inside of a home, a microphone-equipped device can capture sounds, and a compromised router can expose all data traffic in the network.
Hackers who take control of a device can turn it on or off, modify its settings, or block users' access to their accounts. A hacked thermostat can affect the heating system, while a compromised freezer or refrigerator could disrupt temperature control.
In the worst-case scenario, attackers can use devices with weak security to gain access to other systems in the same network or to steal personal information associated with online accounts.
What Are the Biggest Risks
Another question addressed by specialists is: can hackers take control of a car or power and water supply networks?
Reuters mentions a few cases:
- In 2015, researchers remotely took control of a moving Jeep through the Internet-connected entertainment system; this incident led to the recall of approximately 1.4 million vehicles and the implementation of software updates.
- Nearly a decade later, researchers revealed a vulnerability that allowed them to locate, unlock, and start certain Kia vehicles using only the license plate number. They reported the vulnerabilities to Kia – the company addressed them within a few months – and there was no evidence of their exploitation in real attacks.
However, modern vehicles and aircraft are designed with complex safety and backup systems.
Critical infrastructure, such as power and water supply networks, generally have multiple levels of security, monitoring, and regulation not present in consumer devices.
This doesn't mean they are immune to cyberattacks, but they generally represent much more challenging targets than a household appliance connected to a domestic Wi-Fi network.
How to Protect Your Devices
Cybersecurity experts generally recommend three important measures:
- changing default passwords;
- enabling two-factor authentication where available;
- regularly installing software updates.
Additionally, users should remove or replace devices that no longer receive security updates, keep most devices on a local network, and connect products to the extended internet only when there is a clear reason to do so.
But the simplest rule is also the most effective: the fewer connected devices you have, the fewer potential entry points for attackers.
T.D.