Slashdot Mirror
Hackers Actively Targeting Gas Pumps
An anonymous reader writes: Security researchers from Trend Micro wondered what kind of cyberattacks might target one of our most common and vital pieces of infrastructure: gas pumps. So, they set up some honeypots to find out if and how gas pumps were being attacked. The researchers ended up getting more than they bargained for. Between February and July, there were at least 23 distinct attacks on their honeypots alone (PDF). This included identifications, modifications, and DDoS attacks. "In their research, they found that a DoS or DDoS attack could disrupt inventory control and distribution, which means gas stations may not have enough supply on hand. Changing pump names could result in the wrong fuel being added to a tank—such as putting Unleaded inside Premium, or vice versa. Drivers wouldn't like that. Or changing the pump volume could result in tanks being underfilled."
You'd think we would see some actual disruption. Seems like pumps have adequate protection thus far.
Many of these systemsâ"earlier this year, Rapid7 identified about 5,800 of them worldwideâ"are connected to the Internet without a password
Isn't anyone held responsible for this kind of gross negligence ?
I used a very infrequently used credit card at a gas station way out in the middle of nowhere on I-10 in Florida going to Panama Beach. I check my account balances frequently, and luckily caught 25+ Xbox Live subscriptions that were opened on that card a day or two after using it at that gas station. I hadn't used that card for anything else in probably several months before those charges, so I really think my CC details got skimmed at that pump.
You would think those types of charges would trigger some type of fraud detection scheme, but no. And MS wouldn't do anything about the charges, at all. CC company reversed the charges though.
Captcha: Charge. For real.
Though this might provide a useful defence for the idiot who did it by mistake...
Who knew?...
This is why we can't have anything nice.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Try over a decade! But the banking and credit card industry had no incentive to change - until recently withe huge attacks against Target and other retailers.
And still tet're moving at a snails pace.
Even now, when something happens, it's the consumer's burden. That's why I have ONE credit card and NO debit card. And no, having one credit card has no detrimental affect on your credit score.
I worked at an unnamed gas pump producer for a while. Their concern with security was laughable. Security was the minimum amount of effort they needed to pass certification. In some cases, the passwords were stored on the server in a clear text file. Very poorly managed company. These places mainly see themselves as hardware companies that have software bonus. They haven't realized how crucial software is to their business, so they treat it with that level of respect.
I would have thought the obvious hack would be to grab card details or get free gas from self-service pumps. So far it just seems like mean pranks, not actual for-profit crime.
I used to install pump controllers and POS systems a long while back. Pump controllers would only talk to the back-end computer on a separate VLAN. The primary VLAN had the POS terminals on it. The back office PC had a dial-up VPN connection back to the Home Office. The network didn't rely on the internet but on dial-up access. To affect the station network you would have to have physical access.
It wouldn't surprise me that gas stations today have internet access for real time inventory and sales management of gas, groceries, etc. This would, as the article points out, open up the site to DDOS and other standard internet attack vectors. One way to reduce this threat is to implement ACLs, only allowing traffic back to the Home Office public IP addresses. But that only defends against basic DDOS attacks. The type of hardware/software that you would need to thoroughly protect the site is prohibitively expensive.
One defense is the fact that there are so many of them. Yes, a botnet could wreck havoc on a number of stations, but hitting them all in a region, in my opinion, would be a lot harder. Granted, maybe you only need to disrupt "enough" of them.
http://it.slashdot.org/story/15/01/23/1856201/us-gas-stations-vulnerable-to-internet-attacks
Give 'em a break, it's only been seven months since this was last posted.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Were these honeypot pumps set up in the same way real systems would be set up? In other words, how realistic was the experiment? Were hackers able to attack these systems because they were set up to be honeypots, or does the experiment really indicate that gas pumps around the world are vulnerable?
I would. My car would ping and knock until the sensor dialled down enough that my performance would suffer and my economy would go to crap. Seen it happen. And on my motorcycle, I would notice the other way as premium has less energy, and my low compression motorcycle runs poorly on it. Just because you wouldn't notice...
Honestly, unless your almost inhuman in disregarding your brain, you'll need to have someone fill up your car without telling you the octane, and then record your observations.
We humans are correlation engines, and it would almost be proof of brain abnormality to not find a correlation, regardless of whether it's there or not.
"Security researchers from Trend Micro wondered what kind of cyberattacks might target one of our most common and vital pieces of infrastructure: gas pumps" ref
For what it's worth, the pumps themselves (the part that delivers fuel) are likely to be barely changed from the late '90s, when they were a simple embedded system with no operating system other than "while (1) dostuff();" The displays were just beginning to change then, though. Gilbarco's new LCD display ran on Linux, and you could see all the boot messages out of a diagnostic port. But there was no TCP/IP stack, just the same RS-485 link to control the display.
The stuff referred to in TFA is about the back-office stuff that runs on "real" PCs. So someone messes up the inventory management stuff that calls for a refill truck? So what? Gas pumps are still (AFAIK) pretty stupid, and customers won't stick around if no fuel comes out, so it doesn't really matter if sucking dry is bad for the pumps. Whoop-de-doo, people will have to go down the block to the next station. Hardly the apocalypse that was these guys premise before they even started.
The only real concern is when people get gas for free. And the pump has to be told by the site controller equipment to turn on for each and every sale. Even then, there's a mechanical flow counter on the pump that can be checked to see if the pump is giving away free gas due to some sort of shenanigans on the site controller side.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
I thought you were talking about natural gas pumping stations. Jeremy Clarkson on American English.
Actually, we call it gasoline. We can't help it if people choose to use an abbreviated version that happens to overlap with a scientific state of matter.
Also note that gasoline is dispensed as a liquid (with vapor (gas) capturing devices), but is burned as a gas.
If you are not allowed to question your government then the government has answered your question.
FTA: "..Or changing the pump volume could result in tanks being underfilled"
Yeah, because Hackers would never do the opposite.
What is a pump volume? Do they mean the rate of flow through the pump? Or do they mean the volume of the tank from which the pump gets the gasoline?
If you are not allowed to question your government then the government has answered your question.
"such as putting Unleaded inside Premium"
I hate to be the one to break it to you, but premium IS unleaded gas. Gas hasn't contained lead for a very long time now.
BeauHD. Worst editor since kdawson.
Maybe they meant the hackers 'pump up the volume', where they play Country-Rap crossover music so loud that you drive away before your tank is completely full.
John
23 on their honeypot? Are they sure it is not just another the NSA? And I assume we talk about http://www.trendmicro.co.uk/ who sell online security.
Sounds like a standard 'buy stuff from us' marketing campaign to me.
Don't fight for your country, if your country does not fight for you.
One of my first tech jobs was working for a large oil company. Roughly once a week we had a franchise we busted and shut down for hacking their own pumps. Never buy gas from a designed franchise!
That was about two decades ago. Reason to do so was to reduce the amount sold to rip off two parties - the customer and the oil company. By slightly reducing the amount delivered to the customer they could cut the royalties paid to the oil companies.
The thieves that sold the chips knew that state inspectors used 5 and 10 gallon tanks so they would always correctly deliver those amounts (if in doubt pump that amount). The oil companies knew this as well so they set up their inspection cars to use tanks with odd sizes (12 gallons etc.).
They run their own inspections and when they got a hit they would run follow up inspections to confirm. That was where I came in, they needed to work with a tech to arrange the technical end of the inspection for back end sales systems.
They would get evidence of skimming and then come back with a tanker truck, electrician and a sign company truck. They would then literally de-sign the store where they pumped the gas out of the tanks and took the sign off the franchise on the spot. When the owner would protest they would be reminded that if they chose to challenge in court that they risked going to prison for a very long time. From what I was told no station owner ever challenged the process. We were pretty thorough about evidence and corruption was rampant.
I would imagine that oil companies and other franchises continue this type of practice of quietly shutting down thieving franchisees to this day. They really, really don't want their franchisees ripping of the public, it's bad for the entire brand.
I could tell the difference between 'good' 87 octane and bad. Back when Amoco still existed, I had an older car that was starting to knock on regular 87. Amoco's always fixed that issue. When ever I got anything else the car knocked. It really was 'better' gas as this was over multiple years of observation.
People in cars cause accidents....accidents in cars cause people
Knocking *is* directly related to octane levels, so it's no surprise to find observable correlations there. Also, knocking is not a subtle problem liable to selection bias.
The question is whether *higher* octane gas than required for an engine (engines can be tuned for high octane gas) improves performance. And the gas manufacturers themselves don't claim that. (In their ads, the benefits are all quite nebulous: "better for your engine")
But it's a pretty widespread belief that high octane gasoline has "subtle" improvements (my in-laws swear they get substantially better mileage, including for the month that I was buying regular gas for their car :-)) or better acceleration, etc.. As I said, the gasoline manufacturers don't make that or other measurable claims.
Yet, because of the general association, it's almost impossible *not* to notice the car performance being better when we think there's "better" fuel in the tank, which is what I was trying to point out.
Most modern cars have knock sensors and retard the timing when knocking is detected so you won't notice knocking. You will get fewer miles to the gallon since this is less efficient.
I don't read your sig. Why are you reading mine?
It can. If your car has a knock sensor, it works by retarding the timing when knocking is detected (usually before you can detect it by ear while sitting in the drivers seat); this reduces performance. If your spark plugs are dirty or there's other problems with the ignition system, you might get more knock with regular than premium, so you could have a loss of power that is "fixed" by moving to premium.
A properly operating engine tuned for regular won't show increased performance with premium. It won't "see" the premium and advance the timing.
This was a 92 Infiniti so I'm assuming it was not exactly a 'modern' car in the sense you're describing
People in cars cause accidents....accidents in cars cause people
Safeway uses windows 95 at a lot of their stations. Yes, windows 95. No, really windows 95. Surprised the crap out of me too. I don't use Safeway anymore.
of gas in this discussion
My ism, it's full of beliefs.