Some of us are old enough to remember the 1980s.
It was a decade of advancing technology, brilliant music, questionable fashion choices, fantastic hair, and advertising slogans that have somehow embedded themselves permanently into our memories. One that has always stuck with me was Zanussi’s famous phrase: “The Appliance of Science.”
Back then, the idea that your washing machine could contain cutting-edge technology seemed remarkable.
Fast forward forty years and the appliance of science is everywhere.
Smart homes, connected devices and the Internet of Things (IoT) have become so commonplace that we barely notice them. A few years ago, when we moved house, my wife and I bought a new washing machine and tumble dryer.
Being a geek, they obviously had to be smart devices.
The sales pitch sounded brilliant. I could control them remotely, monitor cycles from my phone, and generally embrace the future. Unfortunately, Alexa never developed the capability to collect my socks and grundies from the bedroom floor and actually load them into the machine, so the remote-start feature was used far less than anticipated.
The technology was impressive. The practicality, less so.
My enthusiasm cooled even further when I discovered that the remote-control functionality relied on protocols that effectively created an insecure backdoor into the device. There was no way I was going to risk hostile actors interfering with my spin cycle, so that feature was quickly disabled.
While that sounds mildly amusing, the reality is that we’ve recently seen a series of attacks against commercial systems across Europe that stem from exactly the same underlying issues.
- Poorly secured connected devices.
- Unpatched systems.
- Default credentials.
- Inadequate monitoring.
- Known vulnerabilities that had never been adequately addressed.
In many cases, the weaknesses exploited were not sophisticated zero-day vulnerabilities requiring advanced tradecraft. They were vulnerabilities that had already been identified, documented and discussed. The problem wasn’t the discovery of the issue. The problem was that the issue remained exposed.
The Fridge Problem
The cybersecurity industry has been warning about IoT security for years.
We regularly advise people to change default passwords, review security settings, apply updates and monitor connected devices.
It’s sensible advice. The challenge is that most people treat a connected fridge differently to a laptop.
When was the last time somebody conducted a security review of their washing machine? Exactly.
The reality is that as technology becomes more integrated into our homes, businesses and supply chains, devices that were never traditionally considered IT assets now represent potential attack surfaces.
The same mindset that leaves a smart thermostat running with default credentials can eventually leave commercial and industrial systems exposed.
What Worries Me Isn’t the Attack
As a cybersecurity professional, the recent incidents concern me. But perhaps not for the reason many people expect.
The vulnerabilities themselves were relatively straightforward. The techniques involved were not revolutionary. No artificial intelligence magic was required.
What concerns me is attribution. More specifically, the lack of it.
Various reports and commentators have suggested potential involvement from nation-state actors. Others have pointed towards different geopolitical players. So far, however, there appears to be little consensus and even less certainty.
If financial gain was the objective, we would naturally look towards organised criminal groups.
If publicity were the goal, we might expect a hacktivist organisation to claim responsibility.
Neither appears to fit particularly well.
Which leaves us asking two very important questions:
Who?
Why?
Understanding the Threat Actor Puzzle
Most of the vulnerabilities exploited were well known. That creates an interesting problem from an intelligence perspective.
The attacks do not necessarily require the capabilities we normally associate with sophisticated Advanced Persistent Threats (APTs). Yet the apparent lack of financial motivation makes them difficult to neatly categorise as conventional cybercrime.
Last year, at a cybersecurity conference in Newcastle, I heard a phrase that made me smile.
“NPT” or New Persistent Threats.
It was being used to describe the opposite end of the threat actor spectrum: script kiddies, opportunists and inexperienced attackers who are numerous, persistent and increasingly capable thanks to automation and AI-assisted tooling.
It’s a useful concept because today’s threat landscape isn’t just populated by highly capable nation-state operators. It is also crowded with thousands of individuals who can leverage readily available tools to achieve outcomes that would once have required specialist expertise.
So was this an APT an NPT or something in between?
At this stage, we simply don’t know.
When an Attack Doesn’t Make Sense
I’ve spent a large part of my career as an intelligence analyst, working alongside some exceptionally capable people. One lesson you learn very quickly is that the technical details only tell part of the story.
Understanding the who and the why is often far more important than understanding the how.
We know how these attacks happened. We know where they happened. We know when they happened. What remains unclear is who was responsible and why they chose these particular targets.
That’s the part that bothers me. Cyber operations are rarely conducted without purpose.
If tonnes of ice cream and crème brûlées are suddenly put at risk because refrigeration systems have been disrupted, there is usually a reason beyond simple mischief.
Was it a demonstration of capability?
A warning?
A distraction?
A probe designed to test responses?
A way of reminding Western nations that vulnerable technology exists everywhere? I don’t know.
But I do get suspicious when incidents don’t appear to make much sense on the surface.
After all, Darth Vader didn’t spend years overseeing a mysterious Imperial construction project because he fancied a new office block.
There was always a bigger objective.
The Real Lesson
The lesson isn’t about supermarkets. It isn’t even about refrigeration systems.
It’s about preparedness.
We already recognise that operational technology, industrial control systems and critical national infrastructure are under constant attack from capable adversaries.
What these incidents demonstrate is that vulnerabilities within connected systems remain abundant and exploitable.
If relatively unsophisticated weaknesses can create disruption in one environment, we should view that as a warning rather than an anomaly.
A shot across the bows.
An opportunity to identify weaknesses before someone targets systems that truly matter.
Closing Thoughts
Whether the perpetrators turn out to be nation-state actors, opportunistic attackers or something else entirely, the response should be the same.
- Improve visibility.
- Strengthen monitoring.
- Reduce exposure.
- Patch known vulnerabilities.
- Challenge assumptions.
- Invest in skills.
The demand for expertise in Cyber Threat Intelligence, Operational Technology security and Industrial Control System defence is only going to grow.
The good news is that there are excellent opportunities to develop those skills through organisations such as CompTIA, EC-Council, CREST, Siker and Microsoft – to name a few.
So let’s not cry over spilt ice cream.
Let’s recognise these incidents for what they may be: a timely reminder that while technology continues to evolve, the fundamentals of cyber defence remain exactly the same.
And perhaps, just perhaps, let’s remember to secure the fridge as well.
