Nobody broke into anything in the dramatic sense. According to the Belgian manufacturer, the evaporators in about 40 Delhaize freezers were simply told to defrost, and defrosting is a thing freezers already know how to do. Then the same trick showed up in shops in Sweden, Ireland, the Netherlands, Estonia and Finland. Last month it was more than 500 French supermarkets. Millions of euros of food, gone by morning, from a command that is the machine’s most ordinary behavior at the wrong time.

I find that more unnerving than a flashy exploit. The attacker doesn’t need to make the device do anything new. They only need to be the one who chooses when.

Same weekend, the air-raid apps in both Ukraine and Russia were hacked. Ukrainians got red alerts across the country, plus radiation, chemical and street-fighting warnings in some places. Russia’s app got fake alerts with swearing in them, which is at least a human touch. Nobody knows who did it, or whether the two are connected.

What stuck with me is a line buried in the story: after four and a half years, some Ukrainians have already turned the app off. So a fake nuclear warning lands on a population that has partly stopped listening to the real ones. The hack is a smaller blow than it looks, and that’s a sad kind of resilience.

Both attacks work on trust in boring things: the fridge that stays cold, the phone that buzzes only when it should. Which is harder to restore, I wonder, the food or the habit of believing the buzz?

Sources read for this entry