Slashdot Mirror
Hackers Stole 600 Gallons of Gas From Detroit Gas Station, Report Says (gizmodo.com)
Police in Detroit are looking for two suspects who allegedly managed to hack a gas pump and steal over 600 gallons of gasoline, valued at about $1,800. From a report: The theft took place in the middle of the day and went on for about 90 minutes, with the gas station attendant unable to thwart the hackers. The theft, reported by Fox 2 Detroit, took place at around 1pm local time on June 23 at a Marathon gas station located about 15 minutes from downtown Detroit. At least 10 cars are believed to have benefitted from the free-flowing gas pump, which still has police befuddled. Here's what is known about the supposed hack: Per Fox 2 Detroit, the thieves used some sort of remote device that allowed them to hijack the pump and take control away from the gas station employee. Police confirmed to the local publication that the device prevented the clerk from using the gas station's system to shut off the individual pump.
Seriously, I'm not big on the whole let the computer handle everything on important things, particularly something that is potentially safety critical. Manual shut off valves aren't hard.
All gas stations are required to have a big emergency button mounted on the wall inside of the building that will immediately cut off the flow of fuel to the gas pumps when pushed.
I think that button is also required to be accessible to the public, i.e not hidden behind the counter.
Push that button and no fuel is dispensed until the system is reset.
If the attendant somehow didn't know about that button, then that's a hazardous situation right there.
If you're a zombie and you know it, bite your friend!
What kind of gas was this? Butane? Propane? Methane?
You really don't know much about Detroit. The police wont even show up for shootings unless there are two bodies. Stealing gas doesn't even register.
Only the State obtains its revenue by coercion. - Murray Rothbard
...then ironically don't use it to leave Detroit.
... because I didn't read TFA:
Given:
- $1,800 USD
- ~ 10 cars
- 600 gallons
Then:
$1800/10 car = $180/car
$1,800/600 gallons = $3/gallon
600 gallons/10 cars = 60 gallons/car????
It little behooves the best of us to comment on the rest of us.
One or three guys came up with the "hack", fired it up, filled their 15 gallon tanks for free, then couldn't figure out how to turn the hack off. People kept coming in, filling their tanks, either not realizing nor not caring the gas was free. Some of them called their buddies, who came and filled up cuz it was free.
Meanwhile the dudes that did the "hack" are either laughing their asses off that they got $50 of gas for free, freaking out because if everyone gets free gas someone will notice, or they were script kiddies $Someone was using as a test case for an attack.
The cops might show up to take a report on Tuesday. Or not.
Cops mostly take reports of crimes. Occasionally, they accidentally catch a criminal. Very rarely do they stop a crime in progress.
Some people listen to their moral voice, and other just Kant.
What happened to
Verjährt.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
The attendant, supervisor or owner park one or more cars to block the pump?
That would not surprise me. Off the top of my head, in order of effectiveness:
1) Park your car at the pump in question.
2) Put a "Out of Order" sign on the pump in question. This way, anyone using the pump is obviously in cahoots with the hackers.
3) Master emergency switch. In 90mn, no gas station makes nearly $2,000 pure profit.
4) Call the police... maybe the response time for property crimes is high, but still.
No good deed goes unpunished...
I used to write code to talk to gas pumps 20 years ago, and they really aren't much different today, aside from having better screens and needing to deal with chip cards. (I have seen only a single station so far with what appeared to be chip-ready card readers! Isn't that cut-over only a year or two away? But there are restaurants that over two years later still have tape over the chip reader.)
First of all, the pump (the part that gives you fuel while measuring it) is completely separate from the terminal on top. They both talk to a computer in back over an RS-485 link. The computer in back, even if it's a crappy one from the pump manufacturer, takes payment information from the terminal (and commands from the POS inside the store), then enables the pump, possibly with a preset limit. When you hang up the hose, the computer sees that status in the pump, reads the dispensed amount, and finishes the transaction.
The back-end computer could certainly have bad programming. I once had to do a site visit for a beta site, and found out that the authorizer (the part that says "this card is okay, turn on the pump" and handles the billing) was saying yes to ANY card. Not my code, of course. Fortunately, people were using the membership card of the club store (they probably thought it would be automatically billed), which meant they could be tracked down if necessary.
One thing that could be done is to open up the pump, and flip its configuration switches to set it into a manual mode. That still won't stop the fuel counters inside the pumps, so it won't match inventory with the back room computer later on. But you have to open it up first. Not only is there a key to deal with, but these days there are tamper stickers on the door because so much inside can be fucked with, not just the pump.
Another thing that could be done is someone with inside knowledge of the system could create a management card that makes the computer give free gas. That would be noticed eventually too, but the big problem is you have to have access to the back end. This could possibly be done for a RFID keyfob, but that means you still need a way to get the keyfob ID into the system, and it would still be an inside job.
If the deed was done wirelessly, as implied, I'm going to guess that means that someone had a wireless connection like WiFi on the same network as the back-end computer, and it wasn't encrypted, etc. It could also be a keyfob or NFC, but other than that, I haven't heard of any kind of wireless technology that would need to go into the pump. It's always possible that there was some kind of stupid buffer overflow bug on something wireless.
As to what could have been done to shut it down, if the person at the store knew this was happening, um, yeah. Unless he called a manager who told him to not turn it off (fuel is a good way to get customers to buy your overpriced sodas and snacks), the E-Stop button would have been enough. An "out of order" sign would probably have worked too, simple psychology, nobody would have bothered to use the pump. It's also possible that the POS had a way to shut pumps off. And I wouldn't be surprised if nobody understood how to use such features.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Exactly what I was thinking.
Hacking == theft == covered by insurance.
Malfunction: not covered.
The real "Libtards" are the Libertarians!
Given the thieves' appearance, I wouldn't assume Russian Mafia.
And no, not because they're black. Stop being all racist.
Microsoft leads to Bluescreen; Bluescreen leads to downtime; downtime leads to suffering.
Back when gas hit close to $5 a gallon some thieves modified a horse trailer by cutting out parts of the bottom. Then they would install pumps and large tanks.
They would pull the modified trailer over access caps, where they fill the underground tanks, where they would pretend to have truck problems. While two men would be under the hood acting like they where trying to fix the truck, their accomplices in the trailer would remove the access cap and lower a hose down to the underground tank.
Once the tanks where full, the truck would suddenly be fixed, and they would drive off.
I read at +2. If your post doesn't reach that level I will not see or respond to it.