Slashdot Mirror
Hackers Stole 600 Gallons of Gas From Detroit Gas Station, Report Says (gizmodo.com)
Police in Detroit are looking for two suspects who allegedly managed to hack a gas pump and steal over 600 gallons of gasoline, valued at about $1,800. From a report: The theft took place in the middle of the day and went on for about 90 minutes, with the gas station attendant unable to thwart the hackers. The theft, reported by Fox 2 Detroit, took place at around 1pm local time on June 23 at a Marathon gas station located about 15 minutes from downtown Detroit. At least 10 cars are believed to have benefitted from the free-flowing gas pump, which still has police befuddled. Here's what is known about the supposed hack: Per Fox 2 Detroit, the thieves used some sort of remote device that allowed them to hijack the pump and take control away from the gas station employee. Police confirmed to the local publication that the device prevented the clerk from using the gas station's system to shut off the individual pump.
Seriously, I'm not big on the whole let the computer handle everything on important things, particularly something that is potentially safety critical. Manual shut off valves aren't hard.
All gas stations are required to have a big emergency button mounted on the wall inside of the building that will immediately cut off the flow of fuel to the gas pumps when pushed.
I think that button is also required to be accessible to the public, i.e not hidden behind the counter.
Push that button and no fuel is dispensed until the system is reset.
If the attendant somehow didn't know about that button, then that's a hazardous situation right there.
If you're a zombie and you know it, bite your friend!
"Wasn't driving the car at the time; aka Dundu nuffin"
What kind of gas was this? Butane? Propane? Methane?
Of course, people will be looking for another round of shield-and-sword war with hackers.
What happened to
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
stop.
You really don't know much about Detroit. The police wont even show up for shootings unless there are two bodies. Stealing gas doesn't even register.
Only the State obtains its revenue by coercion. - Murray Rothbard
would of made more with an cc skimmer vs maybe a few free full ups.
*dindu
It little behooves the best of us to comment on the rest of us.
Some high tech hacking skills are required to put a magnet on a relay.
...then ironically don't use it to leave Detroit.
... because I didn't read TFA:
Given:
- $1,800 USD
- ~ 10 cars
- 600 gallons
Then:
$1800/10 car = $180/car
$1,800/600 gallons = $3/gallon
600 gallons/10 cars = 60 gallons/car????
It little behooves the best of us to comment on the rest of us.
One or three guys came up with the "hack", fired it up, filled their 15 gallon tanks for free, then couldn't figure out how to turn the hack off. People kept coming in, filling their tanks, either not realizing nor not caring the gas was free. Some of them called their buddies, who came and filled up cuz it was free.
Meanwhile the dudes that did the "hack" are either laughing their asses off that they got $50 of gas for free, freaking out because if everyone gets free gas someone will notice, or they were script kiddies $Someone was using as a test case for an attack.
Instead of staring there open-mouthed because the cut-offs don't work, why not walk out to the pump and wrap a standard yellow Out of Order sign on it?
It doesn't sound as though there was some kind of organized operation involved. It sounds like one of the usual idiots installed the device, got gas themselves, and drove off giggling. The rest were probably just average schmoes getting gas and assumed they were getting a hell of a deal. If I got charged $.50 a gallon, I wouldn't look that particular gift horse in the mouth.
The clerk knew people were pumping gas. S/he knew it was billing at an incorrect price. Time to put an Out of Order sign on it. I've driven up to many a gas pump with one of those and have declined to attempt to use it on that basis. I've no idea why any of them were non-functional, you just don't use them because it says they're broken.
If someone uses the appropriately-marked pump, take down their license plate number (or use the security footage) and report a drive-off or theft, whichever is applicable.
Color me unsurprised, however. Having seen what passes for convenience store (and many other low-skill) employees in the last decade, I doubt many of them would have thought of the simple expedient of an Out of Order sign.
"Boss says me turn it off. It not turn off. Me not know what to do. Duh"
Microsoft leads to Bluescreen; Bluescreen leads to downtime; downtime leads to suffering.
The cops might show up to take a report on Tuesday. Or not.
Cops mostly take reports of crimes. Occasionally, they accidentally catch a criminal. Very rarely do they stop a crime in progress.
At least hide your hack so the exploit can be used by others.
My ism, it's full of beliefs.
First, eliminate these causes before blamimg "hackers": employee pilferage, employee mistake, broken equipment, software bug.
Bruce Perens.
The attendant, supervisor or owner park one or more cars to block the pump?
Or 256 tablespoons?
That would not surprise me. Off the top of my head, in order of effectiveness:
1) Park your car at the pump in question.
2) Put a "Out of Order" sign on the pump in question. This way, anyone using the pump is obviously in cahoots with the hackers.
3) Master emergency switch. In 90mn, no gas station makes nearly $2,000 pure profit.
4) Call the police... maybe the response time for property crimes is high, but still.
No good deed goes unpunished...
I used to write code to talk to gas pumps 20 years ago, and they really aren't much different today, aside from having better screens and needing to deal with chip cards. (I have seen only a single station so far with what appeared to be chip-ready card readers! Isn't that cut-over only a year or two away? But there are restaurants that over two years later still have tape over the chip reader.)
First of all, the pump (the part that gives you fuel while measuring it) is completely separate from the terminal on top. They both talk to a computer in back over an RS-485 link. The computer in back, even if it's a crappy one from the pump manufacturer, takes payment information from the terminal (and commands from the POS inside the store), then enables the pump, possibly with a preset limit. When you hang up the hose, the computer sees that status in the pump, reads the dispensed amount, and finishes the transaction.
The back-end computer could certainly have bad programming. I once had to do a site visit for a beta site, and found out that the authorizer (the part that says "this card is okay, turn on the pump" and handles the billing) was saying yes to ANY card. Not my code, of course. Fortunately, people were using the membership card of the club store (they probably thought it would be automatically billed), which meant they could be tracked down if necessary.
One thing that could be done is to open up the pump, and flip its configuration switches to set it into a manual mode. That still won't stop the fuel counters inside the pumps, so it won't match inventory with the back room computer later on. But you have to open it up first. Not only is there a key to deal with, but these days there are tamper stickers on the door because so much inside can be fucked with, not just the pump.
Another thing that could be done is someone with inside knowledge of the system could create a management card that makes the computer give free gas. That would be noticed eventually too, but the big problem is you have to have access to the back end. This could possibly be done for a RFID keyfob, but that means you still need a way to get the keyfob ID into the system, and it would still be an inside job.
If the deed was done wirelessly, as implied, I'm going to guess that means that someone had a wireless connection like WiFi on the same network as the back-end computer, and it wasn't encrypted, etc. It could also be a keyfob or NFC, but other than that, I haven't heard of any kind of wireless technology that would need to go into the pump. It's always possible that there was some kind of stupid buffer overflow bug on something wireless.
As to what could have been done to shut it down, if the person at the store knew this was happening, um, yeah. Unless he called a manager who told him to not turn it off (fuel is a good way to get customers to buy your overpriced sodas and snacks), the E-Stop button would have been enough. An "out of order" sign would probably have worked too, simple psychology, nobody would have bothered to use the pump. It's also possible that the POS had a way to shut pumps off. And I wouldn't be surprised if nobody understood how to use such features.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
gallon (gln)
n. A unit of volume in the U.S. Customary System, used in liquid measure, equal to 4 quarts (3.785 liters).
n. A unit of volume in the British Imperial System, used in liquid and dry measure, equal to 4 quarts (4.546 liters).
n. A container with a capacity of one gallon.
Source: The American Heritage Dictionary of the English Language, 4th Edition
Microsoft leads to Bluescreen; Bluescreen leads to downtime; downtime leads to suffering.
In Detroit? No.
The local Italian Mafia is very much in control of organized crime, and has not been suffering from law enforcement attention the way some other cities' families have been. Btrava and drug cartels are mostly sticking to providing specialized services (importing drugs, high quality weaponry, muscle for use against gangs who step out of line, etc.)
$2,000? Probably half went to hangerons, and the profit you can make by reselling this is less than half the value of the gas. Better if you are using it for your own fleet, but with chickenshit amounts like this, it's unlikely. This is either strictly amateur, or a small gang.
Given the thieves' appearance, I wouldn't assume Russian Mafia.
And no, not because they're black. Stop being all racist.
Microsoft leads to Bluescreen; Bluescreen leads to downtime; downtime leads to suffering.
Isn't Arizona the only state that has this law.
[($)]
Seems like a risky crime. Video evidence, probably your car license.
Did he not think of the emergency shut off valve?v My understanding is that's a physical system. A hard physical shutoff from the tanks to the pumps.
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
Surely someone with the skills to hack a gas pump can get a job that pays far more than $1800 for the same effort. Seems such a sad use of talent.
Surveillance cams?
He could have thrown a breaker and it would have went down. Kill the tank monitor and the power to the pumps.
Don't pay her. :(
[($)]
Funnily enough, I worked on a project a few years ago to prevent people stealing gasoline from dispensers. Some of the tests I did (at the behest of the client) involved using various methods to break into the gas dispenser. The idea was we would use accelerometers and other sensors to detect if someone was trying to tamper with the dispenser. Needless to say they were ridiculously simple to break into; it can be done in under a minute without causing any damage to the dispenser.
Anyway, once the dispenser was open there were two main ways gas was stolen.
1. Start a valid transaction and then tamper with the flow sensor. Once you have the dispenser open you can just pull up on the flow sensor, which removes it from the stream of gas. So you end up paying, for example, $2 for 100L of gas.
2. Short the valve open and then pump all the gas you want. Generally there is a common pump that feeds all the dispensers on a site, so once the valve is open, the gas flows.
The major targets of these kinds of thefts were remote gas stations for semi-trailers that generally don't have attendants 24/7 (or at all). But given how simple it is to break into a dispenser, it's entirely possible they tampered with the valve without the attendant noticing.
Only crack the nuts that crack. You don't put the ones that don't crack in the sack.
...but there were already three cruisers in line at the hacked pump.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Pre-paid pump systems work without any action from the attendant. So he may not have noticed anything wrong unless he looked carefully. Then he would have tried to disable the pump from his console, and found it didn't work. With that, it seems he did use either the big red button, or the pump's circuit breaker, to disable it.
Prediction for end of Universe #42: Fencepost error in Quantum_bogosort.cpp
Sounds like a plan, if gas prices are what matters most to you.
L'Idiot
I'm surprised the pump itself is still there.
Every gas station I know puts the nozzle in a paper (or sometimes plastic) bag to indicate that the pump is out of service. Did this one not have bags? Just because the pump is technically working doesn't mean it can't be marked otherwise to discourage use.
I'm an old guy and old-fashioned. Whenever possible I avoid buying gas at any of the pay-ahead pumps and dealers. (Living in Canada, this isn't too difficult still.) I pump my gasoline and then go inside to pay, in cash. I almost always fill the tank and it's so hard to guess ahead of time how much gasoline I need to pay for at the pay-ahead pumps, so I avoid them. But I'm in the minority and the petroleum industry doesn't care about people like me, so they continue with their fancy new pumps based on insecure technology. It's all about marketing anyway, isn't it?
All new construction gas stations have cut off switches set up as such where they simply don't cut off the gas at the pump, but to depower the actual fuel pumping system by cutting power completely by opening an magnetic contactor.
Of course, existing gas stations usually don't have this in the first place, or else the breaker box is wired to the point of being paranoid. This code varies on strictness and/or enforcement from state to state. This is improving, but is slow.
First rule of holes; When in one, stop digging.
"...the gas station attendant unable to thwart the hackers."
Unable? An Out of Order sign and a plastic bag over the gas pump would have fucking worked fine.
This is the inherent problem with building systems that are idiot-proof; we ultimately end up building grade-A idiots to sit behind the wheel.
Back in the 80's my dad had a minor engine fire in his car. He pulled into a gas station lot and parked as far as he could from the pumps and other customers, then got out of the car and walked over to the station. He asked the attendant for a fire extinguisher, so the guy looked over at a "FIRE" button and pushed it, causing a huge amount of fire retardant to dump all over everyone pumping gas while dad's car smouldered away at the far end of the lot. Eventually the FD came and extinguished it.
I've read about similar scams going on where it's far more organized. People have been taking large SUV's, blacking out the rear windows, and turning the whole rear of the vehicle into a giant fuel tank. Then they're able to steal hundreds of gallons of gas at a time, or with just a few stops (since people might actually notice if you sat at a pump long enough to get 500-600 gallons of fuel out of it).
It creates one highly dangerous vehicle on the road .... but they do it.
My father ran a service station with two islands of two pumps each. Each island had it's own circuit breaker. I'd be surprised if this has changed much, so he should have been able to shut off the power to just a single island.
Back when gas hit close to $5 a gallon some thieves modified a horse trailer by cutting out parts of the bottom. Then they would install pumps and large tanks.
They would pull the modified trailer over access caps, where they fill the underground tanks, where they would pretend to have truck problems. While two men would be under the hood acting like they where trying to fix the truck, their accomplices in the trailer would remove the access cap and lower a hose down to the underground tank.
Once the tanks where full, the truck would suddenly be fixed, and they would drive off.
I read at +2. If your post doesn't reach that level I will not see or respond to it.