Cooling and refrigeration control systems: Identifying, updating and protecting systems
The attacks on cooling control systems that have come to light in recent weeks show that Switzerland, too, is affected by this threat. Several incidents in Europe and Switzerland highlight that vulnerable cooling and refrigeration control systems can still be successfully targeted and that the recommended protective measures have not been implemented everywhere.
The NCSC had already warned operators of critical infrastructure via the platform Cyber Security Hub (CSH) following the incidents in France. As the affected systems are also widely used by small and medium-sized enterprises (SMEs), the NCSC is once again highlighting the risks. Organisations are advised to identify the cooling and refrigeration control systems they use, check whether they are accessible from the internet, and implement the recommended protective measures.
What is this about?
In recent weeks, attacks on cooling control systems have come to light in several European countries, including Switzerland. Initially, the focus was on three control systems from Danfoss: the end-of-life products AK-SM 800 System Manager and AK-SC 355, as well as the current product family AK-SM 800A / AK-SM 8xxA, if they are running on outdated firmware.
Subsequently, refrigeration management systems from the Copeland/Dixell XWEB product family were also identified as potentially affected. Protective and migration measures were recommended, particularly for older, no-longer-supported systems.
According to current findings, attackers gain access to management interfaces that are directly accessible from the internet. Following a successful compromise, they can remotely alter the settings of refrigeration systems, such as temperatures, defrost cycles, alarm thresholds or notification settings. Tampered refrigeration systems can lead to the spoilage of food, medicines or other temperature-sensitive goods, thereby causing financial losses and operational disruptions. In addition to incidents in the food sector, incidents in the healthcare sector have also been reported abroad.
The cases identified to date show that vulnerable or inadequately protected systems are still in operation. Organisations should therefore check whether the control systems mentioned are in use and whether they are accessible directly or indirectly via the internet.
Who is affected?
The issue does not only affect the food retail sector. Cooling and refrigeration control systems are also used in, amongst others:
- Butchers and food production facilities;
- Restaurants and hotels;
- Pharmacies;
- Doctor's offices and laboratories;
- Logistics and warehousing facilities;
- Industrial and production facilities;
- Agricultural businesses.
Many organisations are unaware that their refrigeration systems are directly or indirectly accessible via the internet or are operated by external service providers.
Recommendations
The NCSC recommends implementing the following measures as soon as possible:
- Check whether refrigeration or cooling control systems are used in your organisation
Please also take into account systems that are maintained or operated by external service providers. - Install available security and firmware updates
Follow the manufacturer’s recommendations. Security updates are available for the AK-SM 800A / AK-SM 8xxA product family, which address the known vulnerabilities. Newer firmware versions also activate additional protection mechanisms and enforce encrypted communication via HTTPS. - Take special protective measures for systems that are no longer supported
Older systems that no longer receive security updates should not be directly accessible from the internet. If continued operation is necessary, access should be strictly limited to trusted networks or VPN connections. - Restrict remote access to cooling and refrigeration control systems
Management interfaces should not be directly accessible from the internet. Where possible, the systems should be disconnected from the internet or access should be restricted to trusted IP addresses or a secure VPN connection. Remote access should be via a centrally managed access point. Default passwords should be changed immediately and replaced with secure, unique passwords. - Replace systems that no longer receive security updates
End-of-life products pose an increased risk and should be replaced by supported systems as soon as possible.
Further information
Measures for security in the Internet of Things (IoT)
Cyber Security Hub (CSH)
CERT-FR (French)
BSI (German)