CG

Chris Grove

Things Chris Says on Podcasts

“They're hitting the defrost mode and going up to as high as 175 degrees on something that's supposed to be a freezer.” — Chris Grove, CyberWire Daily “The barrier of entry for these attacks is so low that it doesn't take someone, even a computer person, to pull it off. The technique doesn't require malware, doesn't require any secrecy or any special technologies. It's a trick to get in and tamper with it. So it's not even really hacking.” — Chris Grove, CyberWire Daily “I'm focused on restocking the shelves, hiring employees and selling lottery tickets. And asking them to defend against a potential nation-state adversary is a huge ask. It's like asking your neighborhood police force to defend against an army from another country.” — Chris Grove, CyberWire Daily

Where to Find Them

Chris Grove has been a guest on CyberWire Daily .

Recently: “Peer pressure meets private keys.” on CyberWire Daily (November 2026).

What They Said

“They're hitting the defrost mode and going up to as high as 175 degrees on something that's supposed to be a freezer.” — Chris Grove, CyberWire Daily

Asked about the technical weakness behind the refrigeration attacks, Grove described chained vulnerabilities that let attackers log in and run commands while leaving few logs. This is the practical result: machinery behaving as its operators never intended.

CyberWire Daily · 2026-11-09 Permalink → Listen →
CyberWire Daily Around 17:23 into the episode
Chris Grove

…be an angry hacktivist group. It could be someone who wants to enhance their negotiating position by expressing a capability that they have. It could be a variety of different threat actors. So until we kind of figure that out, it's going to be really hard to know when this ends and how it ends.

Dave Bittner

Can you help us understand the technical part of it? You mentioned there's a trick that's being taken advantage of here. What's the weakness that these systems have?

Chris Grove

It's basically a way to use the date to predict a password. So imagine something has a password that's easily guessed. That's, well, there's actually multiple things in play here. First of all, there's the techniques to do it, but the attacks have not been directly tied to any one of a group of techniques that are out there. So some researchers discovered some vulnerabilities in this product that enables someone to break down the front door, essentially. They can log into the device using a simple trick. Once they're logged into the device, there's other vulnerabilities that those researchers discovered that enable commands to be executed that shouldn't be executed. It's like an escalation of your privileges, essentially. The way that they are executed doesn't leave a lot of logs and traces. Also, the way these are being connected to the internet, there's not a lot of security, if any at all. So there's…

Dave Bittner

In terms of protecting critical infrastructure, to what degree do we take this seriously? How much is this a cautionary tale for other verticals?

Chris Grove

It definitely should be taken very seriously. This is a sign of the times. We don't expect these things to go away. Word on the street right now is that since August, all of the nation's largest incident response firms have been fully booked, overcapacity. So when someone gets hit with one of these…

Dave Bittner

So how do you suppose the industry is going to respond to this? You know, both the cyber industry and the folks responsible for the refrigeration units themselves.

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.
“The barrier of entry for these attacks is so low that it doesn't take someone, even a computer person, to pull it off. The technique doesn't require malware, doesn't require any secrecy or any special technologies. It's a trick to get in and tamper with it. So it's not even really hacking.” — Chris Grove, CyberWire Daily

Asked what is going on with the attacks on refrigeration controllers in Europe, Grove said the threat actor is still unknown. Although the campaign looks coordinated, the low skill needed means it could be a nation state, hacktivists or anyone else.

CyberWire Daily · 2026-11-09 Permalink → Listen →
CyberWire Daily Around 15:13 into the episode
Chris Grove

…this in-house. They have their own operations, but many of them, the not largest, the mid and smaller markets, they don't. They need to work with system integrators. And those system integrators can't send people out to take their meter readings every day. And therefore, they deploy remote access.

Dave Bittner

Well, help us understand what we're dealing with here. I mean, in terms of what you've seen from the reports, but then also, of course, your insights from you and your colleagues at Nozomi. What's going on here?

Chris Grove

TBD. We are still trying to determine exactly what's going on. We see the impact, but we don't know the threat actor yet. There's some suspicion around who's behind these. But until we really know that, it's very hard to determine why this is happening. We do know that it seems very targeted, very coordinated. And typically, these types of operations will lead to nation state involvement. Except the barrier of entry for these attacks is so low that it doesn't take someone, even a computer person, to pull it off. The technique to do this doesn't require malware, doesn't require any secrecy or any special technologies. It's a trick to get in and tamper with it. So it's not even really hacking. These are opportunistic attacks and targeting of these types of systems really seems to be confined to a certain region, a certain type of device. And it could be anyone. It could be a nation state. It could be an angry hacktivist group. It could be someone who wants to enhance their negotiating position by expressing a capability that they have. It could be a variety of different…

Dave Bittner

Can you help us understand the technical part of it? You mentioned there's a trick that's being taken advantage of here. What's the weakness that these systems have?

Chris Grove

It's basically a way to use the date to predict a password. So imagine something has a password that's easily guessed. That's, well, there's actually multiple things in play here. First of all, there's the techniques to do it, but the attacks have not been directly tied to any one of a group of…

Dave Bittner

In terms of protecting critical infrastructure, to what degree do we take this seriously? How much is this a cautionary tale for other verticals?

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.
“I'm focused on restocking the shelves, hiring employees and selling lottery tickets. And asking them to defend against a potential nation-state adversary is a huge ask. It's like asking your neighborhood police force to defend against an army from another country.” — Chris Grove, CyberWire Daily

Dave Bittner asked how seriously critical infrastructure should take the wave of attacks on refrigeration controllers. Grove was describing a small store owner running a few freezers who likely doesn't know the devices are vulnerable. It frames the mismatch between who owns these systems and who is attacking them.

CyberWire Daily · 2026-11-09 Permalink → Listen →
CyberWire Daily Around 19:33 into the episode
Chris Grove

…hitting like the defrost mode and going up to as high as like 175 degrees on something that's supposed to be a freezer. And that's the impact. And how it happened, they don't always know. They just know these are some of the ways that it could have happened. And these are happening a lot lately.

Dave Bittner

In terms of protecting critical infrastructure, to what degree do we take this seriously? How much is this a cautionary tale for other verticals?

Chris Grove

…the day that those things will matter. So it's a challenge for a lot of them. And if I, again, back to my example, if I'm running a few stores and I have these freezers in there, there's a very good chance I don't even know that these are vulnerable. I don't know what to do if they were. And I don't know even maybe where the network connection is. It's probably not something that I'm focused on. I'm focused on restocking the shelves, hiring employees and selling lottery tickets. And asking them to defend against a potential nation-state adversary is a huge ask. It's like asking your neighborhood police force to defend against an army from another country.

Dave Bittner

So how do you suppose the industry is going to respond to this? You know, both the cyber industry and the folks responsible for the refrigeration units themselves.

Chris Grove

Yeah. So the industry that creates the refrigeration controllers and freezers and such have been already responding, but they've end of life to these things like a decade ago. So they are trying to notify the customers they know that I have these to get these off the internet. They're not…

Dave Bittner

That's Chris Grove from Nozomi Networks. When you run security for a company that's scaling fast, the stakes just keep climbing. More compliance frameworks, more vendors, more risk, and a board that wants to see it all in one place. And all the information you need, it's scattered everywhere.…

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.

Collections They Appear In

Software Engineering & Infra