KUALA LUMPUR: Malaysia needs to strengthen its operational cyber resilience, as recent attacks targeting supermarket refrigeration systems in Europe have exposed vulnerabilities in connected systems that could disrupt food supply chains, according to a cyber security expert.
Adjunct Professor of Cybersecurity Practice at the University Malaysia of Computer Science and Engineering (UNIMY), Murugason R. Thangaratnam, said attackers did not need advanced hacking skills, as everyday connected systems, such as refrigeration controllers, building management systems and monitoring platforms, were built for convenience and uninterrupted operation rather than security.
“So once they (appliances) are online, they become part of the attack surface. So this is one of the biggest gaps we seem to be having at the moment. It is how operational technology (OT) security is converging with information technology (IT) security.
“Refrigeration falls under OT technology, and I think this is something that the government and industry are trying to address because the OT side is still a big gap,” he said when asked whether a similar cyberattack could happen in Malaysia during an interview on Bernama TV’s Bernama World programme titled “Europe’s Supermarket Cyber Threat”, on Tuesday.
A series of cyberattacks targeting supermarket refrigeration units across Europe has forced stores to dispose of spoiled food.
According to reports, hundreds of supermarkets in France was hit by the attack in October after hackers gained control the software regulating the temperatures of refigeration units. This was followed by similar attacks on supermarkets in several European countries in early November.
Meanwhile, Murugason said the use of similar systems and remote monitoring platforms across retailers could expose multiple businesses to the same vulnerabilities, particularly when third-party vendors and service providers were involved.
“So that’s the real concern. One weakness, repeated across many sites. The risk sits in the supply chain, and the fix has to include vendors and service providers, not just supermarkets,” he said.
On how hackers could gain control of refrigeration systems, Murugason said weak default passwords and internet-exposed devices could allow attackers to access connected equipment by posing as authorised users, potentially enabling them to alter temperature settings or disable alarm systems.
“There does not have to be any sophisticated malware attack; it’s as simple as that. Default passwords like 1234 are public knowledge, and even without that default password, publicly available search engines like Shodan can find exposed devices in minutes,” he said.
Murugason noted that most Malaysian retailers and cold-chain operators used similar connected systems that were remotely managed by third parties, meaning they might not be immune to similar cyberattacks.
While acknowledging the efforts of the National Cyber Security Agency (NACSA) and other agencies in developing the country’s cyber security framework, he stressed that Malaysia needs to move beyond compliance towards strengthening operational resilience.
“In practice, we need to know what is connected and have visibility over what is connected, remove default passwords and public exposure, and have manual fallback plans. That means we need to go back to a pre-digital workflow. We must be ready for that, but it must be tested.
“Any fallback plan, if it’s not tested, is not a plan, and we need to hold vendors accountable. Security has to be at every level along the chain, from the main contractor or the main buyer all the way down the supply chain. So we need to be prepared, not panic,” he added. – BERNAMA
