Gas pumps happen to be about as insecure as your typical router

https://myfox8.com/news/north-carolina/high-point/its-apparently-easy-to-bypass-a-gas-pump-and-steal-400-gallons-or-more/

by homarp • 4 years ago

322 200 4 years ago

myfox8.com

prettyStandard• 4 years ago

Once I scanned barcodes from a competing store rewards program into a PointOfSale terminal of a grocery store. The machine promptly shutdown. Sometimes I wonder if that was a failure mode to prevent attacks or a lack of sanitizing inputs.

isoprophlex• 4 years ago

In the early days of our local rfid-powered public transport payment system, i tried scanning a random misc rfid card from my wallet instead of the correct payment card.

The gate locked up and started screeching its "i scanned a card" chime on loop.

It was hilarious... and i guess a matter of poorly sanitized inputs.

Hamuko• 4 years ago

Sounds like a pretty easy way to do a denial-of-service attack against a grocery store if you can just shut down a bunch of terminals with a barcode. I guess you'll stand out a fair bit if you move from PoS to PoS, scanning a barcode.

flerchin• 4 years ago

I suppose it would be considered vandalism. "but i just scanned a barcode" will not amuse the judge.

fortran77• 4 years ago

You can shut down all sorts of things with the EICAR string encoded as a QR code.

See: https://en.wikipedia.org/wiki/EICAR_test_file

and this video https://www.youtube.com/watch?v=cIcbAMO6sxo where all the gates at a parking garage are rendered inoperable because someone scanned a QR code that encoded EICAR

pessimizer• 4 years ago

You could stick the barcode on tons of random items in the store.

Maursault• 4 years ago

The barcode register attack was explored in a episode of The X-Files titled Duane Barry (2x05; 14 Oct 1994), when Special Agent Dana Scully scans a chip (that had been found implanted in her neck and subsequently removed) at a grocery store checkout scanner, and iirc all the registers went berserk. So this is definitely a thing.

throwaway48375• 4 years ago

You could just print them on stickers and put them on random items.

ct0• 4 years ago

Similar to airplane phone in the late 90's using a calling card. While the asked for a calling card number, the system didn't actually confirm that there was any money on the card itself and just connected to the person you were calling.

exikyut2• 4 years ago

That actually makes sense, the logic there would be that the on-plane system just captured the card number and an on-the-ground system was responsible for checking and billing.

Given that 747s (IIRC) are still using floppy disks (https://google.com/search?q=747+floppy+disks) the chances are the billing was probably done by some equally byzantine process.

Yes, I'm saying that, despite the fact that

"capture calling card number for later using on-plane PBX, establish satellite call directly to dialed number"

and

"establish satellite call directly to on-ground PBX, which asks for calling card number and forwards call"

both ultimately return TRUE for "but users can trigger our satellite uplink to initiate connections just by picking up the phone!!1"... but the latter approach actually blocks illegitimate use and is thus measurably better, and skips the need for an on-plane PBX too.

I can't help but wonder if there was some sort of "capture the number first before initiating the call" initiative early on (which totally makes sense), only for the calling-card billing integration to fall through at some point rendering the whole approach moot.

Naturally I'm making a lot of assumptions here, the biggest being that the plane isn't just making a direct-to-ground connection the moment you pick up the phone, with an on-ground system accepting then forgetting the calling card number. That would be even more stupefying but I do doubt that's what was happening.

Mountain_Skies2• 4 years ago

Most of the stores where I live allow you to scan other stores rewards cards. You don't get points on your account but you still get whatever sale prices that are reserved for reward card holders. Wonder if in your case the store supported this function but there was a null or something similar in the record for that card type.

heywire• 4 years ago

Most retailers use the same ranges for their rewards cards, UPC-A barcodes starting with 4. So even if not intentional, if their system is configured to allow an unregistered card to receive discounts, doesn't validate registration at all, or the number collides with a legitimate rewards card, you'll receive the sale pricing. Similarly, if you simply use a common phone number like xxx-867-5309, 800-555-1212, the store's phone number, etc., you'll probably get discounts too.

flir• 4 years ago

The machine promptly shutdown.

I have a credit card that bluescreens (some) PoS terminals. I theorize the upstream server is returning a rare error code when it's used in contactless mode, because that account's never been approved for contactless. In that case I'm going with lack of sanitizing inputs.

MBCook• 4 years ago

That’s quite strange. There s a very rigorous certification process such terminals are supposed to go through.

myself2483• 4 years ago

Lack of sanitizing inputs. Barcode scanners are hilariously bad, look up "scan tags" for why.

Q: This barcode scanner has a million options, how do we configure them?

A: By showing configuration barcodes to it!

Eduard3• 4 years ago

Looked up "scan tags", didn't find anything. Can you clarify?

_pmf_• 4 years ago

Barcode scanners are hilariously bad

Aren't they just USB HID (previously: serial) devices that literally just output key codes for the numbers detected?

driverdan2• 4 years ago

Seems like this is blogspam of https://myfox8.com/news/north-carolina/high-point/its-appare...

stefan_• 4 years ago

Which is blocked outside the US: https://archive.is/WFiU4

exikyut2• 4 years ago

FWIW that website loads fine for me in AU.

emj2• 4 years ago

CNX does have a lot of good embedded news, and this fits the bill perfectly.

It's interesting how can we make this easier to secure, as embedded developer perhaps there should be an security by default, making it harder to circumvent that and making installs like this.

driverdan2• 4 years ago

"Embedded news" is an interesting term for blogspam. If they find interesting news they should post a blurb and link to it instead of copying its content without adding anything new.

dang• 4 years ago

Ok, URL changed to that from https://www.cnx-software.com/2022/03/19/gas-pumps-insecure-t.... Thanks!

emj2• 4 years ago

That's a bad idea, now we can't read it anymore!

jonnycomputer2• 4 years ago

So ..

- should I be depressed at how shoddy our infrastructure is

- elated that despite the low hanging fruit of these vulnerabilities, they aren't exploited nearly as often or as devastatingly as they could be

micromacrofoot• 4 years ago

The payoff isn’t worth the risk, you could at best get what? a thousand bucks of free gas? downside is federal prison

alternatively you can phish a credit card without leaving your house and get a way better return for lower exposure

oliv__2• 4 years ago

Would be funny if someone figured out a way to remotely set all gas pumps in the country to "release mode" simultaneously: I'm sure this would make for a memorable experience.

robocat• 4 years ago

a thousand bucks of free gas?

You could set up payments via anonymous cryptocurrency.

From article: “At the time of the study, Kaspersky said around 29% of gas stations in India, and 27% in the US were connected to the Internet.”.

That had the potential for a lot more than $1000 before getting fixed, although you would want your opsec to be pretty good.

_3u10• 4 years ago

Exactly. You have to drive up with plates that identify where the car is from. You ain’t stealing shit, unless you already stole the car in which case steal the guys wallet too.

Gas and dash isn’t a new idea.

jonnycomputer2• 4 years ago

Reading the article it seemed like there was more potential vulnerabilities than free gas.

seanp2k23• 4 years ago

yea; card skimmers are more appealing because stealing gas requires physical presence of a heavy and hazardous substance. CC skimmers require a 10-second installation then they just send CCs via cell networks for a week or until they're discovered. Do it right and they're basically untraceable, and the stolen CCs can be charged for thousands per skimmer.

ultra_nick• 4 years ago

Is my router insecure?

______-_-______• 4 years ago

If you haven't flashed OpenWRT or something similar… most probably yes.

kQq9oHeAz6wLLS2• 4 years ago

But my homebrew OpenBSD router isn't supported by OpenWRT!

wepple• 4 years ago

Yes. And OpenWRT is hardly an improvement.

Luckily, every other hop you traverse across the internet is untrustworthy too, so having a bad router shouldn’t worry you. Treat your home wifi like you treat Starbucks wifi.

fulafel4• 4 years ago

There's some terminology confusion about internet routers. The devices that sit in a telco rack and have lots of fibers running in and out of them and decide what pipe to send your IP packets down to are the more routery kinds of routers. The wifi ap + nat box + cable modem thing you have in your house is doing mostly other things than routing and is called your CPE or Customer Premises Equipment. (Also NAT is not routing, the router requirements RFC forbids touching the address fields).

zokier2• 4 years ago

Router is a device that routes packets between two or more networks. CPE routes packets between the customers lan and the isps network, and as such is a router.

fulafel4• 4 years ago

Sure, it is technically a trivial one along with other functions. But it doesn't feel sensible to call it a router because that's not its defining charcteristic. And the business of nontrivial routing that goes on in the devices whose full-time job is to be routers is different, involving routing protocols and stuff.

zokier2• 4 years ago

Also NAT is not routing

   The term "transparent routing" is used throughout the document to
   identify the routing functionality that a NAT device provides.  This
   is different from the routing functionality provided by a traditional
   router device in that a traditional router routes packets within a
   single address realm.

   Transparent routing refers to routing a datagram between disparate
   address realms, by modifying address contents in the IP header to be
   valid in the address realm into which the datagram is routed.
   Section 3.2 has a detailed description of transparent routing.

Section 2.2 https://datatracker.ietf.org/doc/html/rfc2663

NAT is still routing, even if it is different than "traditional" routing.

fulafel4• 4 years ago

That's an "informational" rfc by an individual that doesn't represent the IETF position. Whereas the router requirements is a standards track document.

(And the reason it's a informational RFC is that IETF didn't want to encourage NAT)

jtsiskin• 4 years ago

https://datatracker.ietf.org/doc/html/rfc2663

ctrl +f “NAT router”

_wldu2• 4 years ago

Gas stations are probably considered 'Critical Infrastructure' by the US government as they are part of 'Transportation Systems' infrastructure. Tampering with their computer systems (even just out of curiosity) is probably a bad idea.

https://en.wikipedia.org/wiki/Critical_infrastructure

You could end up with a felony conviction.

kzrdude• 4 years ago

Instead of the punitive angle, if they are critical infrastructure, what are the authorities of government doing to protect them?

_wldu2• 4 years ago

A lot. Pen tests, red teams, simulations, etc.

The point is, if they want someone poking around these systems, they'll contract with them to do that. You should not tamper with them just out of curiosity. Convicted felons have a hard time finding jobs.

maxerickson• 4 years ago

The way the legal system works, the safe option is to not do anything with systems that you don't own or have authorization to use.

Like public facing websites that advertise they are meant to have users are pretty safe, but after that, explicit authorization is a good idea vs deciding for yourself whether it might be critical infrastructure.

Terry_Roll• 4 years ago

I was going to suggest, why not buy your own gas pump's and do a hackathon!

amelius• 4 years ago

Or just wear a white hat.

mojosam• 4 years ago

I don’t think the Russians are going to care about a felony conviction. The major security holes in embedded devices that are part of our critical infrastructure are national security threats.

Despite Putin’s bluster about nuclear weapons, cyberattacks are the easiest way for Russia to inflict pain on the US and Western Europe in response to economic sanctions and our support for Ukrain militarily. And those could do a lot of damage, both in terms of our economies and even civilian American/European lives.

1-6• 4 years ago

Virtual Private Networks always existed long before today’s internet VPNs or proxies. It used to be known as a ‘Friend in Russia.’

tormock2• 4 years ago

I would probably hack the camera system first...

cbanek• 4 years ago

I think this is actually done at least on ATMs. I have read it's a good way to get the pin number for a card, as you might be able to see someone typing it in. Some of the skimmers I want to say even had a camera aimed at the keypad?

cyberpunk3• 4 years ago

They mostly have their own network available, and easily enough crackable. If you're really determined you can pay some kids to break the cameras and wait for the tech to arrive to fix it over the next days and then capture all her network traffic..

Then find out you can control the cost/litre at the pumps via some awful soap api.. That's talking over the internet anyway..

I mean. So I've heard... (Looking at you, TOTAL)

indymike2• 4 years ago

Tampering with their computer systems (even just out of curiosity) is probably a bad idea.

I don't think the kind of people who are robbing gas really care about weather this is a bad idea. That's why sometimes the right answer is to focus on preventing the crime because...

You could end up with a felony conviction.

The crooks really don't care. It's all about not getting caught.

nsxwolf• 4 years ago

The crooks often already have a felony conviction, and are already living with the permanent consequences of that. The only remaining disincentive to crime for them is additional jail time, which can start to be seen as just a cost of doing business - X years for Y dollars.

criddell2• 4 years ago

Is there a hack to turn off the screen playing ads?

Rebelgecko• 4 years ago

Usually if you push the buttons next to the screen one of them will mute the ad

SQueeeeeL3• 4 years ago

I feel like it's such a shitty opt out system. I wonder if there's a way to mass disable the ads

krnlpnc2• 4 years ago

You can usually mute them by pressing one of the buttons next to the screen, often the second down on the right.

jeffbee3• 4 years ago

The same “hack” that has so many other benefits: don’t buy gas.

seanp2k23• 4 years ago

https://evadoption.com/are-evs-charged-mostly-by-coal-power-... while it looks like now, the majority of energy for EVs comes from renewables or natural gas (not that natural gas is actually "green"), a lot still does come from coal, so while maybe not purchasing gasoline directly, driving an EV still uses fossil fuel somewhere.

boring_twenties3• 4 years ago

The TVs are mildly annoying but the worst part is the stupid questions many now ask before you can pump any gas.

When it's freezing cold outside, 1) no, I don't want a fucking car wash and 2) I really resent having to spend the couple extra seconds out in the cold to answer that question.

kevin_thibedeau• 4 years ago

Getting in and out of a vehicle when pumping gas is a fire hazard. In the winter low humidity air makes static discharge more likely.

aftbit• 4 years ago

I believe the magic word is "SiteOmat".

astura3• 4 years ago

I think the "bladder trucks" used to steal the fuel are the most interesting part of this story but there's no pictures of one. A picture of one is here - https://krebsonsecurity.com/2015/11/gas-theft-gangs-fuel-pum...

jeffbee3• 4 years ago

Hard-coded passwords are a very relevant problem in real-world security. Most of those apartment building entry systems are left with the factory password, so you can let yourself right in.

u20772• 4 years ago

Can this be used to disable auto playing ads and news?

whalesalad• 4 years ago

Press the buttons along the right hand side from top to bottom in sequence. It usually works. Only failed me once at a station who was clearly intent on wild amenities and overkill experience.

hereforphone• 4 years ago

It fails a lot more often now. They've caught on.

robbedpeter• 4 years ago

Most of the pumps I've interacted with have blank buttons near the display. In my region, the mute button is second down from the top right. Mash the unlabeled buttons though, and you'll probably find mute.

noaheverett• 4 years ago

Can confirm this too, second down from top right is the mute button (in the south-east US at least)

swarnie2• 4 years ago

Wait.... Your petrol pumps have adverts on them?

DangitBobby• 4 years ago

A lot of the new ones do, yes. Sometimes having low rates of vandalism works against you, it turns out.

u20772• 4 years ago

Yes, and at max volume of course.

bonestamp23• 4 years ago

Yes, sometimes a really annoying ad will play on the video screen once you start pumping. Other times, they will show you a funny clip from a talk show -- it's still an ad but at least it's entertaining.

joncrane• 4 years ago

People act like this is new but it's been around for at least ten years where I live (near Washington DC).

mmh0000• 4 years ago

The Arizona Petroleum Marketers Association has a pretty good document[0] on current skimmers and fuel theft methods:

[0] https://apma4u.org/wp-content/uploads/2012/06/Crompco-Update...

qualudeheart• 4 years ago

There should be an open source gas station firmware framework written in Rust. The information security industry must expand to secure this piece of national security infrastructure.

vineyardmike2• 4 years ago

I’d prefer go. Rust just has a bad name for infrastructure. Who wants rusty infrastructure? Can you imagine the news articles about rusted gas stations? Go on the other hand has a great name for vehicle infrastructure. Swift could work too.

cyberpunk3• 4 years ago

Meanwhile, I'll sit here with the elixir of life (which, isn't hydrocarbon based, but works on the kinda logic where one cucumber and tuna sandwich enables you to cycle about 80km ;)

dylan6042• 4 years ago

about the same as calling a car nova and wondering why it doesn't sell in spanish speaking places

darknavi2• 4 years ago

If you aren't sold on EVs yet, here is a perk that often isn't the main spotlight:

Never go to a gas station again.

digisign• 4 years ago

Unfortunately EV stations make a point to know their customer, extensively. Is it even possible to pay cash and not have your car identified by the charger in a significant number of stations?

fragmede• 4 years ago

Depending on your POV, the main "gas" station in your garage for an EV has either extensive knowledge of you, or ~zero knowledge of you. Outside gas stations are for use only for road trips.

TheDong• 4 years ago

Is it even possible to pay cash and not have your car identified by the charger in a significant number of stations?

The majority of the charging you do will be at your home, where you already pay for electricity. Unlike gas stations, which you go to every few weeks, you'll "fill up" away from home only infrequently, only when traveling multiple hundreds of miles away.

When you are away from home, it's sometimes possible to charge anonymously like you describe. RV campgrounds/RV parking often has a dumb electric outlet (which you'll need an adapter for) that can charge you quicker than a regular household outlet. Any place that has regular electric outlets can "trickle charge" you.

That said, you're right that EV charging when you're on a trip is more tech heavy and less anonymous than filling up at a gas station.

If your threat model doesn't allow for certain private companies to know your rough whereabouts when you're on road trips, then yeah, don't get an EV, don't use credit cards, don't use a phone, etc etc. Most people's threat models are perfectly fine with this though.

darknavi2• 4 years ago

Not that I know of but I don't see anything precluding it.

Like others have said, most of the "gas station" is at your residence and is probably via a dumb charger.

copperx6• 4 years ago

If you're traveling, a quick stop at an EV station is an hour long. It's not all pink skies.

vel0city2• 4 years ago

I spent more time in 2021 waiting on gas pumping in my ICE than I did on my EV charging. Easily more than an hour of time going out of my way to go to fuel stations, potentially waiting for a pump, pumping gas, then getting back on my way versus 0 minutes on my EV just plugging in immediately when I pull into my garage.

I'm already at >30min on waiting for gas pumping on my ICE for 2022. I'm still at 0 minutes on my EV.

If I go on a road trip and spend an hour waiting to charge, I will still have spent less time waiting on refueling on my EV than my ICE.

Oh yea, its also almost 1/10th the energy cost driving the EV than the ICE.

BuckRogers• 4 years ago

I do believe the 'typical' home router is insecure, but mine is rather typical and has had great security updates for 4 years now.[0] It's definitely nothing special, just a $100USD unit. Asus also has an autoupdate feature so their owners don't even have to do anything. I haven't used another brand in years, I had a Buffalo router before this, but I've been following the release notes on this one and security seems top notch for a low-end home router. I do run a 3rd party firmware on this, but its downstream from Asus's.

[0]https://www.asus.com/us/Networking-IoT-Servers/WiFi-Routers/...

copperx6• 4 years ago

Getting security updates is good, but it doesn't mean the router isn't vulnerable. Most routers are vulnerable even with the latest patches.

syngrog66• 4 years ago

I've worked on the embedded software inside a major brand/model of gas pump, so this article will be interesting.

neilv2• 4 years ago

And software and hardware surely have been changed since his investigation.

That phrasing seems to imply to readers that awareness of a serious/expensive security vulnerability would result in it being fixed.

neilv2• 4 years ago

The post ID for https://news.ycombinator.com/item?id=30733337 is almost three-leet.

Animats• 4 years ago

"Researchers also found that many of the systems had “default credentials,” which means they might have similar access codes unless an employee took the time to change them."

That should be considered gross negligence. Criminal negligence for anything shipped with default credentials since ransomware became a thing.

wait_a_minute• 4 years ago

Good reason to pay for gas with cash!

Jomal_HN• 4 years ago

I'm just pleasantly surprised to find my old local news station made it to the front page of HN.

nekoashide• 4 years ago

I have first hand knowledge of this, it's been while but I remember logging into into a Ruby/Sapphire backdoor with default credentials and unmasking the credit card data if there was an issue and a credit transaction wasn't processed. This was for a large regional chain.

It's really an industry problem, everyone who works in the c-store side of things is old as dirt and doesn't understand or care about security.

pabs3• 4 years ago

Here is the article that this post was based on:

https://securelist.com/expensive-gas/83542/

mshaler• 4 years ago

I love not having to buy gas for my primary vehicle. At scale, this is scary stuff.

brunoluiz• 4 years ago

For those outside supported regions: https://web.archive.org/web/20220320011705/https://myfox8.co...

zgs• 4 years ago

I used to work for a company that made VPN routers for one of the largest pump producers. I wasn't aware of any vulnerabilities in our part of the solution. Which doesn't mean there weren't any of course.

Still there is a lot more there than a VPN router. Lots of software and likely plenty of bugs.

seanp2k23• 4 years ago

Gas pump UX is some of the worst of any computer system I have to deal with on a regular basis (ATMs are about as bad). From awful keypads that miss numbers and obscure non-secret things like your ZIP code, to tap card readers that only work with debit cards (but the magstrip works with CCs?!?), to slow ass multi-step questions, misplaced buttons, "decline car wash", "no I don't want to play the lotto today", pumps that shut down at certain times of the day, and general slowness of every single step of the process...

And the cherry on top: loud video ads that you must stand there and watch while enduring all of this. THOSE have good screens and seem capable of playing back video well enough. If only they could dedicate a fraction of that compute power to making the purchase process less awful.

100% not surprised that these were programmed probably by a junior right out of college back in the 80s then never updated.

Cederfjard• 4 years ago

Why does the gas pump ask for your ZIP code? As a security measure? How do foreigners use their cards to pay for gas?

orev• 4 years ago

ZIP code is a security measure. I’m sure many would argue it’s not a good one, but it is better than nothing.

Foreigner can pay inside directly to the attendant, or sometimes pumps accept 99999 as the ZIP code in those cases.

Gas pumps happen to be about as insecure as your typical router

Related Stories