五部门联合警示：黑客正攻击全球制冷与冷链监控系统，改温度可酿火灾与库存损失
美国网络安全与基础设施安全局（CISA）、联邦调查局（FBI）、卫生与公众服务部（HHS）、农业部（USDA）与交通部（DOT）11月5日联合发布警示，称恶意网络活动正针对全球的工业制冷与冷链监控系统。这类系统用于自动与远程监控温度、持续记录温度、管理除霜周期与优化能耗，广泛用于医疗与公共卫生、化工、食品与农业、交通运输等行业，包括冷藏运输服务。
五部门说，攻击者盯上的是零售食品店与冷藏设施里的电子温度控制器和商用制冷控制器。攻击者可利用未打补丁或可从互联网访问的控制器存在的弱点，通过绕过身份验证、注入任意代码、利用弱配置三种途径远程改动设置，迫使机组持续加热和除霜，造成大范围库存损失与设备危害。
一旦得手，攻击者可以改动温度：这会缩短系统使用寿命、造成火灾隐患、导致库存损失，还可能让消费者因食用不安全储存的产品而间接受害。攻击者还可能让运营方看不到当前温度，即所谓「失去监视画面」（denial-of-view）的状态。
CISA 代理网络安全执行助理主任 Chris Butera 在随警示发布的声明中说：「每个依赖制冷和监控系统的组织都应假定自己可能成为目标。」FBI 网络分部运营主任 Brett Leatherman 说，美方正看到这些系统在全球关键基础设施行业成为攻击目标，库存与设备都面临风险。
五部门敦促相关系统的所有者与运营方立即采取防护措施：不要把控制系统设备暴露在公共互联网上，确需远程访问的要用防火墙等边缘设备加以保护；把运营技术（OT）设备隔离到专用网络；改掉默认密码、强化密码并尽可能启用抗钓鱼的多因素认证；及时更新固件，退役并更换已停产、不再受厂商支持的老旧设备；用白名单限制可改动设置的设备与地址；保持异地离线备份并定期测试；开启日志并定期审查；为控制器下游设备设定合理的温度范围，偏离时报警。发现可疑活动可联系 CISA 全天候运营中心（[email protected]、1-844-729-2472），或向 FBI 互联网犯罪投诉中心（IC3）报告。
这份警示未点名攻击者身份，也未公布受害者数量。据路透社报道，警示发布前，美国与欧洲已发生一连串针对商用冷冻设备的黑客攻击。据科技媒体 The Register 报道，10月中旬以来，法国、比利时、爱尔兰、卢森堡与瑞典数百家食品店的数千套远程制冷系统遭入侵，冷柜温度被升至最高约50摄氏度，食物变质并引发火灾；据 BleepingComputer 报道，法国血液机构（EFS）11月3日确认，其制冷设备供应商遭遇网络事件，三处血液储存设施的温度与除霜设置被改动。
Five U.S. Agencies Warn Hackers Are Targeting Refrigeration and Cold Chain Systems Worldwide, Risking Fires and Inventory Loss
The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Health and Human Services (HHS), the U.S. Department of Agriculture (USDA), and the Department of Transportation (DOT) issued a joint advisory on November 5 warning that malicious cyber activity is targeting industrial refrigeration and cold chain monitoring systems globally. Such systems — used for automated and remote temperature monitoring, continuous temperature logging, defrost cycle management, and energy optimization — are widely used across the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors, including in refrigerated transport services.
The agencies said the actors are targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. Exploiting vulnerabilities or weaknesses in unpatched or internet-accessible controllers, the actors may remotely alter settings through authentication bypass, arbitrary code injection, or weak configurations, and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.
If successfully exploited, the actors could change temperatures in ways that affect the service life of the system, create a fire hazard, cause loss of inventory, or indirectly harm consumers if products are consumed after unsafe storage. They could also cause a loss of visibility into current temperatures, a denial-of-view condition.
"Every organization that depends on refrigeration and monitoring systems should assume it could be a target," said Chris Butera, CISA's acting executive assistant director for cybersecurity, in a statement issued with the advisory. Brett Leatherman, the FBI's Cyber Branch operations director, said the government is seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk.
The agencies urged owners and operators to act immediately: do not expose control system devices to the public internet, and protect any necessary remote access with a firewall or edge device; isolate operational technology (OT) devices on a dedicated network; change default passwords, strengthen passwords, and implement phishing-resistant multifactor authentication wherever feasible; keep firmware up to date and retire legacy devices that are at end of life and no longer supported; use allowlisting to restrict which devices and addresses can make changes; maintain current offsite, offline backups and test them; enable logging and review logs regularly; and define reasonable temperature setpoint limits with alerting for deviations. Suspicious activity can be reported to CISA's 24/7 Operations Center at [email protected] or 1-844-729-2472, or filed with the FBI's Internet Crime Complaint Center (IC3).
The advisory does not identify a specific threat actor or publish a victim count. According to Reuters, the statement follows a spate of hacks against commercial freezers in the United States and Europe. The Register reported that since mid-October, hackers have compromised thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden, raising fridge temperatures to as high as 50 degrees Celsius (122 degrees Fahrenheit), spoiling food and sparking fires; BleepingComputer reported that on November 3 the French Blood Establishment (EFS) confirmed a cybersecurity incident affecting a refrigeration equipment provider had altered temperature and defrost settings at three facilities used to store blood products.
来源：美国网络安全与基础设施安全局
发布：GSM·美国（发布链接）
图片来源：图：超市冷藏货架资料图。零售食品店与冷藏设施正是此次五部门警示点名的攻击目标场所。照片：Wilfredor，CC BY-SA 4.0，经 Wikimedia Commons。 / Photo: Refrigerated shelves in a supermarket — retail grocery and cold storage facilities are the settings named in the five-agency advisory. Photo by Wilfredor, CC BY-SA 4.0, via Wikimedia Commons.
GSM Global · 本篇英文版 English edition of this story
