Cybercrims go beyond stealing data to attack physical building systems

Late Sunday night, a still-unknown cybercriminal or group hacked thousands of remote-controlled refrigeration systems across hundreds of French grocery stores, spiking temperatures, spoiling food, and sparking fires.

This is part of an ongoing trend of attacking physical systems that can do damage in the real world.

In August, a ransomware attack disrupted building-management systems at a Canadian hospital, affecting door access controls, central HVAC monitoring, and the issuing of staff access cards.

And three years ago, cyberattacks hit Las Vegas casinos, causing slot machines to go dark, preventing payment kiosks and ATMs from spitting out cash, and locking guests out of their rooms when the electronic keys stopped working.

Not all digital intrusions remain in cyberspace, and attackers don’t need to encrypt files and steal data to cause chaos.

Hitting physical systems often produces more severe consequences - and turns up the heat on executives to pay an extortion demand.

“There was one gig where the customer was refusing to pay, and so the threat actor was like, ‘Hold my beer, have fun getting into your offices,’ and locked everybody out,” Tim Beasley, a senior incident response consultant at Semperis, told The Register.

Beasley won’t name the customer, or provide any incriminating information, but said the incident response involved police smashing glass in addition to his team recovering compromised data.

“The cops had to break in, and literally get into the building, breaking some windows, so the customer was able to finally get back in,” he said.

We asked if the customer paid the ransom demand, and Beasley yelled: “Oh, hell, no!” A report published earlier this month by ServiceNow’s Armis Labs found increasing evidence of ransomware attackers using physical consequences as leverage in their intrusions.

“Today’s BAS operate at the intersection of IT and OT worlds, creating unprecedented exposure,” the report said.

Ransomware with physical consequences Building automation systems - BAS - are the critical systems that control and monitor facilities’ HVAC, lighting, energy usage, and water consumption.

They also oversee badge readers, door locks, surveillance cameras, fire alarm control panels, and other physical safety equipment.

As such, BAS make very attractive targets for ransomware operators looking for high-pressure ways to extort organizations into paying multi-million ransom demands.