Slashdot Mirror
Hackers Actively Targeting Gas Pumps
An anonymous reader writes: Security researchers from Trend Micro wondered what kind of cyberattacks might target one of our most common and vital pieces of infrastructure: gas pumps. So, they set up some honeypots to find out if and how gas pumps were being attacked. The researchers ended up getting more than they bargained for. Between February and July, there were at least 23 distinct attacks on their honeypots alone (PDF). This included identifications, modifications, and DDoS attacks. "In their research, they found that a DoS or DDoS attack could disrupt inventory control and distribution, which means gas stations may not have enough supply on hand. Changing pump names could result in the wrong fuel being added to a tank—such as putting Unleaded inside Premium, or vice versa. Drivers wouldn't like that. Or changing the pump volume could result in tanks being underfilled."
You'd think we would see some actual disruption. Seems like pumps have adequate protection thus far.
Many of these systemsâ"earlier this year, Rapid7 identified about 5,800 of them worldwideâ"are connected to the Internet without a password
Isn't anyone held responsible for this kind of gross negligence ?
"Changing pump names could result in the wrong fuel being added to a tank—such as putting Unleaded inside Premium, or vice versa. Drivers wouldn't like that."
This would actually be an interesting social experiment, just to see if anyone actually noticed.
I used a very infrequently used credit card at a gas station way out in the middle of nowhere on I-10 in Florida going to Panama Beach. I check my account balances frequently, and luckily caught 25+ Xbox Live subscriptions that were opened on that card a day or two after using it at that gas station. I hadn't used that card for anything else in probably several months before those charges, so I really think my CC details got skimmed at that pump.
You would think those types of charges would trigger some type of fraud detection scheme, but no. And MS wouldn't do anything about the charges, at all. CC company reversed the charges though.
Captcha: Charge. For real.
Though this might provide a useful defence for the idiot who did it by mistake...
Who knew?...
This is why we can't have anything nice.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Try over a decade! But the banking and credit card industry had no incentive to change - until recently withe huge attacks against Target and other retailers.
And still tet're moving at a snails pace.
Even now, when something happens, it's the consumer's burden. That's why I have ONE credit card and NO debit card. And no, having one credit card has no detrimental affect on your credit score.
I thought you were talking about natural gas pumping stations. Jeremy Clarkson on American English.
I worked at an unnamed gas pump producer for a while. Their concern with security was laughable. Security was the minimum amount of effort they needed to pass certification. In some cases, the passwords were stored on the server in a clear text file. Very poorly managed company. These places mainly see themselves as hardware companies that have software bonus. They haven't realized how crucial software is to their business, so they treat it with that level of respect.
24/7 online like a porn site just waiting for someone to start pumping?
Who the fuck had that bright idea?
I would have thought the obvious hack would be to grab card details or get free gas from self-service pumps. So far it just seems like mean pranks, not actual for-profit crime.
First they started associating computer hackers with crime. Now they call 'hacker' somebody that steals from a gas pump? Soon we will be reading that a bunch of humans have been hacked by actively attacking their skin, with lead bullets.
Also, Slashdot, you were cool.
My other signature is a car
Changing pump names could result in the wrong fuel being added to a tank—such as putting Unleaded inside Premium, or vice versa.
As things the average driver would care about, that falls way down the list, as long as they don't pay for it, they'd never notice, as most vehicles would adjust just fine. Only a few rare gearheads would even claim to be able to notice, and few of them I suspect.
Now if it were possible to mix up diesel, or there were places selling leaded gasoline, that might be an issue, but unless you're getting your gas from an airport(or apparently, Algeria), the latter isn't a problem, and the former shouldn't be since they wouldn't have any reason to connect them, and would have several reasons not to do so.
The hacked inventory shows full when the rest of the contents of the pump are in fact small drug pellets delivered using a remote controlled filter mechanism of some sort.
I used to install pump controllers and POS systems a long while back. Pump controllers would only talk to the back-end computer on a separate VLAN. The primary VLAN had the POS terminals on it. The back office PC had a dial-up VPN connection back to the Home Office. The network didn't rely on the internet but on dial-up access. To affect the station network you would have to have physical access.
It wouldn't surprise me that gas stations today have internet access for real time inventory and sales management of gas, groceries, etc. This would, as the article points out, open up the site to DDOS and other standard internet attack vectors. One way to reduce this threat is to implement ACLs, only allowing traffic back to the Home Office public IP addresses. But that only defends against basic DDOS attacks. The type of hardware/software that you would need to thoroughly protect the site is prohibitively expensive.
One defense is the fact that there are so many of them. Yes, a botnet could wreck havoc on a number of stations, but hitting them all in a region, in my opinion, would be a lot harder. Granted, maybe you only need to disrupt "enough" of them.
http://it.slashdot.org/story/15/01/23/1856201/us-gas-stations-vulnerable-to-internet-attacks
Give 'em a break, it's only been seven months since this was last posted.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Were these honeypot pumps set up in the same way real systems would be set up? In other words, how realistic was the experiment? Were hackers able to attack these systems because they were set up to be honeypots, or does the experiment really indicate that gas pumps around the world are vulnerable?
FTA: "..Or changing the pump volume could result in tanks being underfilled"
Yeah, because Hackers would never do the opposite.
"Security researchers from Trend Micro wondered what kind of cyberattacks might target one of our most common and vital pieces of infrastructure: gas pumps" ref
FTW. Again.
For what it's worth, the pumps themselves (the part that delivers fuel) are likely to be barely changed from the late '90s, when they were a simple embedded system with no operating system other than "while (1) dostuff();" The displays were just beginning to change then, though. Gilbarco's new LCD display ran on Linux, and you could see all the boot messages out of a diagnostic port. But there was no TCP/IP stack, just the same RS-485 link to control the display.
The stuff referred to in TFA is about the back-office stuff that runs on "real" PCs. So someone messes up the inventory management stuff that calls for a refill truck? So what? Gas pumps are still (AFAIK) pretty stupid, and customers won't stick around if no fuel comes out, so it doesn't really matter if sucking dry is bad for the pumps. Whoop-de-doo, people will have to go down the block to the next station. Hardly the apocalypse that was these guys premise before they even started.
The only real concern is when people get gas for free. And the pump has to be told by the site controller equipment to turn on for each and every sale. Even then, there's a mechanical flow counter on the pump that can be checked to see if the pump is giving away free gas due to some sort of shenanigans on the site controller side.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Congratulations you actually got somewhere in this pile of paperwork welcome
heres the card first gas pump, now your accounts on E we either send the bunny ears (might get a pole smoking)
or they send the bunny suits (ex intel engineer turned poker player on his own chips)
Welcome to motherfucking life, please enjoy your stay.
"such as putting Unleaded inside Premium"
I hate to be the one to break it to you, but premium IS unleaded gas. Gas hasn't contained lead for a very long time now.
BeauHD. Worst editor since kdawson.
23 on their honeypot? Are they sure it is not just another the NSA? And I assume we talk about http://www.trendmicro.co.uk/ who sell online security.
Sounds like a standard 'buy stuff from us' marketing campaign to me.
Don't fight for your country, if your country does not fight for you.
One of my first tech jobs was working for a large oil company. Roughly once a week we had a franchise we busted and shut down for hacking their own pumps. Never buy gas from a designed franchise!
That was about two decades ago. Reason to do so was to reduce the amount sold to rip off two parties - the customer and the oil company. By slightly reducing the amount delivered to the customer they could cut the royalties paid to the oil companies.
The thieves that sold the chips knew that state inspectors used 5 and 10 gallon tanks so they would always correctly deliver those amounts (if in doubt pump that amount). The oil companies knew this as well so they set up their inspection cars to use tanks with odd sizes (12 gallons etc.).
They run their own inspections and when they got a hit they would run follow up inspections to confirm. That was where I came in, they needed to work with a tech to arrange the technical end of the inspection for back end sales systems.
They would get evidence of skimming and then come back with a tanker truck, electrician and a sign company truck. They would then literally de-sign the store where they pumped the gas out of the tanks and took the sign off the franchise on the spot. When the owner would protest they would be reminded that if they chose to challenge in court that they risked going to prison for a very long time. From what I was told no station owner ever challenged the process. We were pretty thorough about evidence and corruption was rampant.
I would imagine that oil companies and other franchises continue this type of practice of quietly shutting down thieving franchisees to this day. They really, really don't want their franchisees ripping of the public, it's bad for the entire brand.
Modern pumps with color displays, and high security run a stripped down embedded version of debian (gilbarco pumps anyway)
From the sounds of the article, they pumps were'nt the devices exposed to the internet anyway. It is the ATG (Automatic tank gauge) which is responsible for monitoring tank inventory, and leak sensors. as well as sending alerts via fax, or email when there is a an alarm ie: low product, fuel where there shouldn't be fuel, or water in the tank etc.
Granted due to the ATG having control of pumps you could shut them down, albeit for a short time. But re-labeling tanks on the ATG doesn't make a bit of difference where the driver who delivers fuel is going to put it in the ground. As all of the fill points are very clearly labeled as to what should go where (By Law)
This is old news and of minimal risk.
ref: Im a petroleum tech
Safeway uses windows 95 at a lot of their stations. Yes, windows 95. No, really windows 95. Surprised the crap out of me too. I don't use Safeway anymore.
of gas in this discussion
My ism, it's full of beliefs.