Slashdot Mirror
French Gas Stations Robbed After Forgetting To Change Gas Pump PINs (zdnet.com)
An anonymous reader quotes a report from ZDNet: French authorities have arrested five men who stole over 120,000 liters (26,400 gallons) of fuel from gas stations around Paris by unlocking gas pumps using a special remote. The five-man team operated with the help of a special remote they bought online and which could unlock a particular brand of gas pumps installed at Total gas stations. The hack was possible because some gas station managers didn't change the gas pump's default lock code from the standard 0000. Hackers would use this simple PIN code to reset fuel prices and remove any fill-up limits.
Crooks would operate in small teams of two to three individuals who visited gas stations at night using two vehicles. A man in a first car would use the remote to unlock the gas station, and then a second car, usually a van, would come along seconds later to fill a giant tanker installed in the back of the vehicle with as much as 2,000 or 3,000 liters in one go. The group advertised the fuel they stole on social media, providing a time and place where customers could come and refuel their vehicles or pick up orders for gasoline and diesel at smaller prices. Police uncovered the scheme in April 2018, when they arrested a suspect in possession of a remote used in the hack. "Five men, part of the same gang, were arrested on Monday, according to Le Parisien, who first reported the scheme last November," the report adds.
Crooks would operate in small teams of two to three individuals who visited gas stations at night using two vehicles. A man in a first car would use the remote to unlock the gas station, and then a second car, usually a van, would come along seconds later to fill a giant tanker installed in the back of the vehicle with as much as 2,000 or 3,000 liters in one go. The group advertised the fuel they stole on social media, providing a time and place where customers could come and refuel their vehicles or pick up orders for gasoline and diesel at smaller prices. Police uncovered the scheme in April 2018, when they arrested a suspect in possession of a remote used in the hack. "Five men, part of the same gang, were arrested on Monday, according to Le Parisien, who first reported the scheme last November," the report adds.
There is nothing clever about this. This is just security failing because of the incompetency of the gas station managers. Nothing about this could be called a hack.
You used to have to have cables and set them from inside. Most of the old hardware is this way. These remote ones are "new", "better" and "improved" version that the manufacturers push on customers. Much like amazon pushing remotes with an always on microphone and moving from bluetooth to wifi
1. Have human staff on duty when the gas station is operational.
2. Have human staff look at the "van" and the amount of fuel and the price of that fuel.
3. Make people walk from the gas pumps to a cashier with a computer display showing pump used, price and amount of fuel.
4. Pay for the fuel.
5. Human staff on duty will see huge numbers never seen before from any average "van" on the computer display? Thats not normal.
Have the computer alert to totally unexpected numbers.
6. Lots of quality CCTV for face, passengers face and gait.
7. Remove anything automated that can allow your gas station to pump fuel for free at any time.
Domestic spying is now "Benign Information Gathering"
If some thief steals donuts and coffee it is a simple theft. But here the gas station lost control of a hazardous substance and there were rickety vans with leaky tanks with 3000 liters of gasoline sloshing about. These crooks most likely do not understand the effects of fluid being transported in un-baffled tanks. It was a disater waiting to happen. Safety of hundreds of people has been endangered.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Quick, change my pin to "1234"!
I use 9999, because it's the most secure PIN because it's the last one to get guessed.
You start with 0000, then 0001, 0002 and so on...9999 will be the last one the haxxors get to!
Factory defaults are designed to be easy so the manual can say 'enter 0000, then press change PIN).' It is also usually designed with a factory reset in mind in case the PIN is lost or forgotten (which would require direct hardware access, usually behind an alarmed key lock).