Subscribe Now

* You will receive the latest news and updates on your favorite celebrities!

Trending

More then 5K Gas Station Tank Gauges are Exposed on the Public Net!
Mobile & Cloud

More then 5K Gas Station Tank Gauges are Exposed on the Public Net! 

One gas station failed its PCI compliance test due to security holes in its automated gas tank gauge configuration, researcher says.

It’s been three years since researchers first discovered automated tank gauges (ATGs) at some 5,000 US gas stations exposed on the public Internet without password protection, and a recent scan found 5,635 locations were vulnerable to the same issue.

The 2015 finding led by HD Moore, then the chief research officer at Rapid7, scanned for devices with TCP port 10001 open on the Internet. Jack Chadowitz, president and CEO of BostonBase, a fuel industry technology firm, says he not only found the overwhelming number of ATG systems vulnerable to the initial flaw, but also stumbled upon another vulnerability in the Vedeer-Root TLS450 tank gauges that may have led to a New Bedford, N.H., gas station failing its PCI DSS compliance audit.

Chadowitz says the exposed gas stations’ tank gauge data can be accessed by attackers as well as manipulated for fuel theft or other sabotage. When he contacted the owner of the New Hampshire gas station this spring to alert him about the exposed ATG, the owner – who had deployed password protection with his Vedeer-Root application – noted that he had recently failed his PCI test. The station was running an older version of OpenSSH 7.0 on port 22, which apparently had been set up for remote access by its third-party supplier of the ATG system for maintenance purposes.

OpenSSH

According to BostonBase, the open port and dated version of OpenSSH used in the ATG system led to the failed PCI compliance test. “A lot of [smaller] gas stations don’t do PCI testing … but that this one did is one of the reasons why I happened to come across this vulnerability. It’s probably very rare, this combination of Vedeer with OpenSSH 7.0 and having the port opened,” Chadowitz says.

Vedeer-Root maintains that the issue raised by Chadowitz would be nonexistent if users properly configure the devices with strong passwords and place them behind a firewall. “Users need to maintain proper network safeguards, as they would for any other Internet-connected device in order to prevent outside traffic. This includes the use of firewalls and strong passwords,” says Alan English, director of brand development for Vedeer-Root.

These security issues surrounding ATGs is yet another example of security challenges with industrial Internet of Things devices. In the Vedeer-Root case, it also underscores the challenges of getting third-party suppliers on board security-wise, especially on behalf of smaller businesses like local gas stations.

ATGs provide gasoline inventory and protect groundwater from gasoline leaks, notes Chadowitz. “Anyone can go in and mess with a tank gauge” that’s exposed online by altering the parameters for a high-water alarm, for example.  “How can you trust it?”

Trend Micro also conducted its own gas tank research in 2015, and found examples of hackers messing with the devices, specifically the Guardian AST gas tank monitoring systems in several locations across the US. The Trend researchers reported finding an Internet-facing tank monitoring system at a gas station in Holden, Maine, renamed “We_Are_Legion” from “Diesel,” suggesting either the handiwork of Anonymous or another attacker using the group’s slogan.

Mark Nunnikhoven, vice president of cloud research for Trend Micro, says the biggest threats to vulnerable ATGs today is to the gas station’s business. “The most concerning is someone using manipulation of them to get free fuel, or to change gas readings, hitting the core of their [the station’s] business,” he says. “A director motivator is profit there, and that’s the most likely scenario.”

But Chadowitz says attacks could be more nefarious and destructive, causing chaos by adjusting fuel levels to appear empty at multiple stations, for example. “If they want to shut down a bunch of them, that would really cause havoc.”

He recommends firewall routers in front of the ATG systems be configured with Access Control Lists (ACLs) that only allow specific IP addresses access to them, for example. “You could also put in a VPN,” he says.

Gas station owners can check for the 2015 vulnerability in their ATGs on his firm’s test website, kachoolie.com.

Related posts

1 Comment

  1. Scr888 singapore

    Solar power advantages and downsides are numerous but we
    can not but admit in leading time how the advantages
    outweigh the cons. In this post I shall try my best to throw light
    on the problem and help you find some ideas regarding the
    advantages and disadvantages of power. If we brood the actual matter we can find out that the solar energy is one
    of the most talked about issue with the present second.
    Governments all over our beautiful planet are leaving no stone unturned to read the residual advantages on the solar energy without paying any heed to the disadvantages that
    are very few.

    Here’s the actual way it works: The belt sends a signal to stimulate the nerves
    that govern your muscle tissues. Your muscles react to the stimulation with deep, but comfortable contractions.

    Over time, this trains muscle tissues and firms and tones your
    abs – make a difference what what you might be doing the fact.
    The scr888 has four programs with eight levels of intensity.

    It can be accepted go ahead and that solar energy is natural, simple
    and renewable. If we use solar power we certain to to help Mother Nature to live a happy life.
    It of power is abosolutely harmless and emits no gas. Hence it is certain to assure nature long span of
    life. Where there is sunlight there is solar control.
    You can easily take the devices help make matters solar power anywhere while on the earth.

    As solar power is created in an absolutely
    natural way there just isn’t chance to use fuels.
    The ray belonging to the sun is enough to produce solar electric power.

    However, anybody can open a forum (free or paid). You can’t
    really understand how knowledgeable some of the forum members is.
    Don’t assume the admin is often a guru, look at the credibility
    of this forum most important. The only thing you’ve can’t know, is the of experience these “gurus” have.

    Actually solar power is used to generate heat.
    You can make use of the solar energy to heat water, home, cooking and ventilation. If you can harness solar energy effectively
    may make steam to drive engines to create electricity identical.

    Introduce yourself in the thread for introduction of the latest members.
    Your introductory post should are brief description of your expertise as well as a explanation of why you joined the
    forum. Encourage the other members know that the main goal is to contribute
    and learn from the community.

    So, hopefully you turn out to be on to your website to buying that car of
    your dreams, or at worst one a person can have some fun within the Year.
    To help you on your pursuit here can be a list for this top 10 affordable performance cars
    from earlier great. http://ecotrends.org/__media__/js/netsoltrademark.php?d=Bbs.mumayi.net%2Fspace-uid-6127373.html

Leave a Reply

Required fields are marked *