Supermarket cyber attack: seven countries had 12% fewer consoles

Updated November 9 with both ports from the pass from November 3: the seven countries had 72 consoles, 66% fewer than the 209 from October 20, and 45% fewer without Aspider Solutions' network.

In the early hours of November 2, attackers warmed the fridges and freezers of supermarkets in seven more European countries, three weeks after France's. Sabcobel, the Belgian company that runs Delhaize's refrigeration systems, said the units' evaporators had been switched to defrost, and some shops reported temperatures as high as 50C. About 40 Delhaize supermarkets in Belgium and Luxembourg were hit, and in Belgium 15 Carrefour stores, five Spar shops and Ikea's store in Mons. In Sweden, 7 of Coop's 800 stores were hit and a few of ICA's, in Finland fridges failed in some of Kesko's K-stores, in Ireland 13 SuperValu supermarkets, "limited to a specific model", and in Estonia a Selver store. Danfoss told the Dutch broadcaster NOS that at least 17 companies in the Netherlands were hit, butchers and small neighborhood stores among them (BBC).

ICA said its system was Danfoss's, and Coop that some of its fridges were on a 4G mobile network (Guardian). The EU's food commissioner called it "a deliberate attempt to disrupt our food supply chain" (Guardian). On November 3 the UK's National Cyber Security Centre said it was working with food suppliers hit in the UK, and that the attacks had used vulnerabilities "out there for a long period of time" (Guardian).

Web IP records the page title of every address answering on port 443 or 80. We counted four families of refrigeration console by their titles in two of its passes, October 6 to 11, which ended hours before the French attack, and the pass from October 20, which our France recount used. Then we counted both ports again in the pass from November 3, the day after the second attack. Censys has published the firmware versions of the StoreView consoles in six of the seven countries (Censys).

After France's attack, the seven were down 12%

Of the seven countries' 237 addresses from before the French attack, 165 served a console again from October 20.

Sweden on StoreView, the Netherlands on XWEB

StoreView is Danfoss's, XWEB Dixell's (Copeland sells it too) and pCOWeb Carel's. None of the seven countries had a Copeland Site Supervisor console, the fourth family.

By IP Country, only Italy (318) and France (193) had more consoles in Europe than the Netherlands. All 88 of Aspider Solutions' (AS196640) were XWEB: it is part of KORE Wireless, which sells mobile connectivity for devices. Telenor Sverige's 10 were on its two ASNs, and Hi3G Access is 3 Sweden's network.

After their own attack, the seven were down 66%

Aspider Solutions went from 88 consoles to 6, all of them XWEB. Of the seven countries' 209, 52 served a console at the same address from November 3 and 157 returned no page title on either port. 20 consoles answered from addresses that had served none from October 20.

By family, the seven countries' XWEB consoles went from 127 to 24 and their StoreView ones from 75 to 41, and pCOWeb had 7 in both passes. On port 80 they went from 131 to 31 and on 443 from 81 to 43, an address serving a console on both counted under each.

61% served the console on plain HTTP alone

128 of the seven countries' 209 consoles from October 20 served it on port 80 alone: 111 of the 127 XWEB, 10 of the 75 StoreView and all 7 pCOWeb. 125 of the 128 completed no TLS handshake on 443 at all.

203 of 209 on ISP networks

203 of the 209 sat on networks that ASN types as ISPs, business broadband and mobile lines, and 6 in hosting space.

Finding them yourself

Filter Web IP's title column on Danfoss StoreView, Danfoss - StoreView Web, XWEB, XWEB EVO, XWEB PRO, Site Supervisor, Emerson Site Supervisor and Carel pCOWeb Home Page, the titles we matched, then join the addresses to IP Country and IP ASN. port gives the port each title answered on and tls_ok whether a TLS handshake completed on 443. last_seen, the newest day each port was seen open, sorts a pass's consoles from those seen only before it.

How we counted

A console is an address whose page title on port 443 or 80 is one of the titles above, counted once per address, from its newest response in each pass. The recount sets each address's newest response on each port from November 3 against October 20's consoles, and none of October 20's addresses changed country or network between the IP Country and IP ASN lookups of October 26 and November 9. Other hosts held across the same two passes: in the seven countries' /24 blocks that held a console, from 1,627 to 1,617 on port 443 and from 1,038 to 1,009 on port 80, and on Aspider Solutions' network from 58 to 56 on port 80. Europe is the EU, the UK, Norway, Switzerland and Iceland, and Elsewhere every other country. Rest of Europe includes the UK, whose food suppliers reported attacks on November 3. These are counts of addresses: Belgium's 35 consoles aren't 35 stores. Four families matched by title on two ports aren't every controller a shop runs, and a count over more ports or products runs higher. Sabcobel's systems and SuperValu's "specific model" needn't be among them, and nothing here says which consoles were attacked.

Hosting space, where a console can be a decoy that copies a real one's title and certificate (Coldframe), held 6 of the seven countries' consoles in each pass, and 44 and 48 worldwide, and the tables count them.

Getting access

Web IP ships as CSV, rebuilt weekly, and its docs page has the schema. Sign up to evaluate it from its sample. A license is per database and never metered: see licensing, or talk to us about what you need.