15 ms·
Gas pumps happen to be about as insecure as your typical router
- nekoashide 5y agoI have first hand knowledge of this, it's been while but I remember logging into into a Ruby/Sapphire backdoor with default credentials and unmasking the credit card data if there was an issue and a credit transaction wasn't processed. This was for a large regional chain. It's really an industry problem, everyone who works in the c-store side of things is old as dirt and doesn't understand or care about security.
- pabs3 5y agoHere is the article that this post was based on: https://securelist.com/expensive-gas/83542/ https://securelist.com/expensive-gas/83542/
- mshaler 5y agoI love not having to buy gas for my primary vehicle. At scale, this is scary stuff.
- brunoluiz 5y agoFor those outside supported regions: https://web.archive.org/web/20220320011705/https://myfox8.com/news/north-carolina/high-point/its-apparently-easy-to-bypass-a-gas-pump-and-steal-400-gallons-or-more/ https://web.archive.org/web/20220320011705/https://myfox8.co...
- zgs 5y agoI used to work for a company that made VPN routers for one of the largest pump producers. I wasn't aware of any vulnerabilities in our part of the solution. Which doesn't mean there weren't any of course. Still there is a lot more there than a VPN router. Lots of software and likely plenty of bugs.
- seanp2k2 5y agoGas pump UX is some of the worst of any computer system I have to deal with on a regular basis (ATMs are about as bad). From awful keypads that miss numbers and obscure non-secret things like your ZIP code, to tap card readers that only work with debit cards (but the magstrip works with CCs?!?), to slow ass multi-step questions, misplaced buttons, "decline car wash", "no I don't want to play the lotto today", pumps that shut down at certain times of the day, and general slowness of every single step of the process... And the cherry on top: loud video ads that you must stand there and watch while enduring all of this. THOSE have good screens and seem capable of playing back video well enough. If only they could dedicate a fraction of that compute power to making the purchase process less awful. 100% not surprised that these were programmed probably by a junior right out of college back in the 80s then never updated.
- Cederfjard 5y agoWhy does the gas pump ask for your ZIP code? As a security measure? How do foreigners use their cards to pay for gas?
- orev 5y agoZIP code is a security measure. I’m sure many would argue it’s not a good one, but it is better than nothing. Foreigner can pay inside directly to the attendant, or sometimes pumps accept 99999 as the ZIP code in those cases.
- prettyStandard 5y agoOnce I scanned barcodes from a competing store rewards program into a PointOfSale terminal of a grocery store. The machine promptly shutdown. Sometimes I wonder if that was a failure mode to prevent attacks or a lack of sanitizing inputs.
- ct0 5y agoSimilar to airplane phone in the late 90's using a calling card. While the asked for a calling card number, the system didn't actually confirm that there was any money on the card itself and just connected to the person you were calling.
- exikyut 5y agoThat actually makes sense, the logic there would be that the on-plane system just captured the card number and an on-the-ground system was responsible for checking and billing. Given that 747s (IIRC) are still using floppy disks (https://google.com/search?q=747+floppy+disks https://google.com/search?q=747+floppy+disks) the chances are the billing was probably done by some equally byzantine process. Yes, I'm saying that, despite the fact that "capture calling card number for later using on-plane PBX, establish satellite call directly to dialed number" and "establish satellite call directly to on-ground PBX, which asks for calling card number and forwards call" both ultimately return TRUE for "but users can trigger our satellite uplink to initiate connections just by picking up the phone!!1"... but the latter approach actually blocks illegitimate use and is thus measurably better, and skips the need for an on-plane PBX too. I can't help but wonder if there was some sort of "capture the number first before initiating the call" initiative early on (which totally makes sense), only for the calling-card billing integration to fall through at some point rendering the whole approach moot. Naturally I'm making a lot of assumptions here, the biggest being that the plane isn't just making a direct-to-ground connection the moment you pick up the phone, with an on-ground system accepting then forgetting the calling card number. That would be even more stupefying but I do doubt that's what was happening.
- jedberg 5y ago
- driverdan 5y agoSeems like this is blogspam of https://myfox8.com/news/north-carolina/high-point/its-apparently-easy-to-bypass-a-gas-pump-and-steal-400-gallons-or-more/ https://myfox8.com/news/north-carolina/high-point/its-appare...
- stefan_ 5y agoWhich is blocked outside the US: https://archive.is/WFiU4 https://archive.is/WFiU4
- exikyut 5y agoFWIW that website loads fine for me in AU.
- eru 5y agoSingapore, too. But archive link is always great!
- zufallsheld 5y agoProbably just blocked for the EU because they do not comply with gdpr.
- emj 5y agoCNX does have a lot of good embedded news, and this fits the bill perfectly. It's interesting how can we make this easier to secure, as embedded developer perhaps there should be an security by default, making it harder to circumvent that and making installs like this.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- jonnycomputer 5y agoSo .. - should I be depressed at how shoddy our infrastructure is - elated that despite the low hanging fruit of these vulnerabilities, they aren't exploited nearly as often or as devastatingly as they could be
- micromacrofoot 5y agoThe payoff isn’t worth the risk, you could at best get what? a thousand bucks of free gas? downside is federal prison alternatively you can phish a credit card without leaving your house and get a way better return for lower exposure
- seanp2k2 5y agoyea; card skimmers are more appealing because stealing gas requires physical presence of a heavy and hazardous substance. CC skimmers require a 10-second installation then they just send CCs via cell networks for a week or until they're discovered. Do it right and they're basically untraceable, and the stolen CCs can be charged for thousands per skimmer.
- astura 5y agoI'd imagine the scammers would just pay some homeless guy or illegal immigrant to actually steal the gas rather than doing it themselves. Same as money mules.
- oliv__ 5y agoWould be funny if someone figured out a way to remotely set all gas pumps in the country to "release mode" simultaneously: I'm sure this would make for a memorable experience.
- kQq9oHeAz6wLLS 5y agoShort term, for the consumer that sounds entertaining. Long term, I can think of no good outcomes. Stations go bankrupt, government bailouts with money from where? Etc
- ultra_nick 5y agoIs my router insecure?
- ______-_-______ 5y agoIf you haven't flashed OpenWRT or something similar… most probably yes.
- kQq9oHeAz6wLLS 5y agoBut my homebrew OpenBSD router isn't supported by OpenWRT! /s
- hedora 5y agoDid you try unplugging and plugging it back in? If that doesn't work, you should be able to find a factory reset button. Look for a hole you can stick a paper clip in, and power cycle with the button depressed. Once you do that, call your ISP and ask for the default password. /s
- wepple 5y agoYes. And OpenWRT is hardly an improvement. Luckily, every other hop you traverse across the internet is untrustworthy too, so having a bad router shouldn’t worry you. Treat your home wifi like you treat Starbucks wifi.
- fulafel 5y agoThere's some terminology confusion about internet routers. The devices that sit in a telco rack and have lots of fibers running in and out of them and decide what pipe to send your IP packets down to are the more routery kinds of routers. The wifi ap + nat box + cable modem thing you have in your house is doing mostly other things than routing and is called your CPE or Customer Premises Equipment. (Also NAT is not routing, the router requirements RFC forbids touching the address fields).
- jtsiskin 5y agohttps://datatracker.ietf.org/doc/html/rfc2663 https://datatracker.ietf.org/doc/html/rfc2663 ctrl +f “NAT router”
- zokier 5y agoRouter is a device that routes packets between two or more networks. CPE routes packets between the customers lan and the isps network, and as such is a router.
- fulafel 5y agoSure, it is technically a trivial one along with other functions. But it doesn't feel sensible to call it a router because that's not its defining charcteristic. And the business of nontrivial routing that goes on in the devices whose full-time job is to be routers is different, involving routing protocols and stuff.
- _wldu 5y agoGas stations are probably considered 'Critical Infrastructure' by the US government as they are part of 'Transportation Systems' infrastructure. Tampering with their computer systems (even just out of curiosity) is probably a bad idea. https://en.wikipedia.org/wiki/Critical_infrastructure https://en.wikipedia.org/wiki/Critical_infrastructure You could end up with a felony conviction.
- kzrdude 5y agoInstead of the punitive angle, if they are critical infrastructure, what are the authorities of government doing to protect them?
- _wldu 5y agoA lot. Pen tests, red teams, simulations, etc. The point is, if they want someone poking around these systems, they'll contract with them to do that. You should not tamper with them just out of curiosity. Convicted felons have a hard time finding jobs.
- krnlpnc 5y agoWhich is nonsense, what was the purpose of punitive action (jail) when a person will be punished for the rest if their life via stigma and ineligibility for jobs. How is that “correcting” a persons behavior?
- hedora 5y agoIt makes sure you never stop correcting them. Once a customer of the penal system, always a customer. They've worked hard to get their retention / repeat business numbers up this high. Why take that away from them?
- mbreese 5y agoThe punishment isn’t only a punishment for the individual. It’s a deterrent to keep the next person from doing whatever it was that was illegal. You can argue if that’s right or wrong, but that’s one of the points of many sentences — to send a “message” to others who might commit a crime.
- criddell 5y agoIs there a hack to turn off the screen playing ads?
- Rebelgecko 5y agoUsually if you push the buttons next to the screen one of them will mute the ad
- SQueeeeeL 5y agoI feel like it's such a shitty opt out system. I wonder if there's a way to mass disable the ads
- hedora 5y agoBoycott those gas station chains (hint: the cheap gas stations don't pay to upgrade pumps), or buy an EV.
- rconti 5y agoYup. I'll leave it as a 1-star Google review (not that many people read reviews before choosing a gas station), and then going elsewhere. My second-closest station has these TVs. I forgot once or twice and returned by accident, but now I never forget.
- SQueeeeeL 5y agoGas is a commodity, so boycotts don't work, also that puts the oneous on the consumer for being annoyed and not the corporations for literally pumping ads into a mandatory part of our society (where I live, I can't function without a car)
- jabroni_salad 5y agoI'm not boycotting gas, just one particular station chain in my area that has many competitors.
- aftbit 5y agoI believe the magic word is "SiteOmat".
- astura 5y agoI think the "bladder trucks" used to steal the fuel are the most interesting part of this story but there's no pictures of one. A picture of one is here - https://krebsonsecurity.com/2015/11/gas-theft-gangs-fuel-pump-skimming-scams/ https://krebsonsecurity.com/2015/11/gas-theft-gangs-fuel-pum...
- jeffbee 5y agoHard-coded passwords are a very relevant problem in real-world security. Most of those apartment building entry systems are left with the factory password, so you can let yourself right in.
- u2077 5y agoCan this be used to disable auto playing ads and news?
- whalesalad 5y agoPress the buttons along the right hand side from top to bottom in sequence. It usually works. Only failed me once at a station who was clearly intent on wild amenities and overkill experience.
- hereforphone 5y agoIt fails a lot more often now. They've caught on.
- deleted 5y ago[deleted]
- PaulDavisThe1st 5y agoSame story. 2 years ago, 2nd button from top on right side was always "mute". Now it never works in any pump I've tried. Disappointing.
- robbedpeter 5y agoMost of the pumps I've interacted with have blank buttons near the display. In my region, the mute button is second down from the top right. Mash the unlabeled buttons though, and you'll probably find mute.
- noaheverett 5y agoCan confirm this too, second down from top right is the mute button (in the south-east US at least)
- swarnie 5y agoWait.... Your petrol pumps have adverts on them?
- mmh0000 5y agoThe Arizona Petroleum Marketers Association has a pretty good document[0] on current skimmers and fuel theft methods: [0] https://apma4u.org/wp-content/uploads/2012/06/Crompco-Updates.pdf https://apma4u.org/wp-content/uploads/2012/06/Crompco-Update...
- qualudeheart 5y agoThere should be an open source gas station firmware framework written in Rust. The information security industry must expand to secure this piece of national security infrastructure.
- vineyardmike 5y agoI’d prefer go. Rust just has a bad name for infrastructure. Who wants rusty infrastructure? Can you imagine the news articles about rusted gas stations? Go on the other hand has a great name for vehicle infrastructure. Swift could work too. /s
- cyberpunk 5y agoMeanwhile, I'll sit here with the elixir of life (which, isn't hydrocarbon based, but works on the kinda logic where one cucumber and tuna sandwich enables you to cycle about 80km ;)
- dylan604 5y agoabout the same as calling a car nova and wondering why it doesn't sell in spanish speaking places
- darknavi 5y agoIf you aren't sold on EVs yet, here is a perk that often isn't the main spotlight: Never go to a gas station again.
- copperx 5y agoIf you're traveling, a quick stop at an EV station is an hour long. It's not all pink skies.
- vel0city 5y agoI spent more time in 2021 waiting on gas pumping in my ICE than I did on my EV charging. Easily more than an hour of time going out of my way to go to fuel stations, potentially waiting for a pump, pumping gas, then getting back on my way versus 0 minutes on my EV just plugging in immediately when I pull into my garage. I'm already at >30min on waiting for gas pumping on my ICE for 2022. I'm still at 0 minutes on my EV. If I go on a road trip and spend an hour waiting to charge, I will still have spent less time waiting on refueling on my EV than my ICE. Oh yea, its also almost 1/10th the energy cost driving the EV than the ICE.
- digisign 5y agoUnfortunately EV stations make a point to know their customer, extensively. Is it even possible to pay cash and not have your car identified by the charger in a significant number of stations?
- fragmede 5y agoDepending on your POV, the main "gas" station in your garage for an EV has either extensive knowledge of you, or ~zero knowledge of you. Outside gas stations are for use only for road trips.
- TheDong 5y ago> Is it even possible to pay cash and not have your car identified by the charger in a significant number of stations? The majority of the charging you do will be at your home, where you already pay for electricity. Unlike gas stations, which you go to every few weeks, you'll "fill up" away from home only infrequently, only when traveling multiple hundreds of miles away. When you are away from home, it's sometimes possible to charge anonymously like you describe. RV campgrounds/RV parking often has a dumb electric outlet (which you'll need an adapter for) that can charge you quicker than a regular household outlet. Any place that has regular electric outlets can "trickle charge" you. That said, you're right that EV charging when you're on a trip is more tech heavy and less anonymous than filling up at a gas station. If your threat model doesn't allow for certain private companies to know your rough whereabouts when you're on road trips, then yeah, don't get an EV, don't use credit cards, don't use a phone, etc etc. Most people's threat models are perfectly fine with this though.
- BuckRogers 5y agoI do believe the 'typical' home router is insecure, but mine is rather typical and has had great security updates for 4 years now.[0] It's definitely nothing special, just a $100USD unit. Asus also has an autoupdate feature so their owners don't even have to do anything. I haven't used another brand in years, I had a Buffalo router before this, but I've been following the release notes on this one and security seems top notch for a low-end home router. I do run a 3rd party firmware on this, but its downstream from Asus's. [0]https://www.asus.com/us/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC66U-B1/HelpDesk_BIOS/ https://www.asus.com/us/Networking-IoT-Servers/WiFi-Routers/...
- copperx 5y agoGetting security updates is good, but it doesn't mean the router isn't vulnerable. Most routers are vulnerable even with the latest patches.
- syngrog66 5y agoI've worked on the embedded software inside a major brand/model of gas pump, so this article will be interesting.
- deleted 5y ago[deleted]
- neilv 5y ago> And software and hardware surely have been changed since his investigation. That phrasing seems to imply to readers that awareness of a serious/expensive security vulnerability would result in it being fixed.
- neilv 5y agoThe post ID for https://news.ycombinator.com/item?id=30733337 https://news.ycombinator.com/item?id=30733337 is almost three-leet.
- deleted 5y ago[deleted]
- Animats 5y ago"Researchers also found that many of the systems had “default credentials,” which means they might have similar access codes unless an employee took the time to change them." That should be considered gross negligence. Criminal negligence for anything shipped with default credentials since ransomware became a thing.
- wait_a_minute 5y agoGood reason to pay for gas with cash!
- Jomal_HN 5y agoI'm just pleasantly surprised to find my old local news station made it to the front page of HN.