7 ms·

Gas stations are probably considered 'Critical Infrastructure' by the US government as they are part of 'Transportation Systems' infrastructure. Tampering with

by _wldu 5y ago

Gas stations are probably considered 'Critical Infrastructure' by the US government as they are part of 'Transportation Systems' infrastructure. Tampering with their computer systems (even just out of curiosity) is probably a bad idea. https://en.wikipedia.org/wiki/Critical_infrastructure https://en.wikipedia.org/wiki/Critical_infrastructure You could end up with a felony conviction.

kzrdude 5y ago
Instead of the punitive angle, if they are critical infrastructure, what are the authorities of government doing to protect them?
- _wldu 5y ago
  A lot. Pen tests, red teams, simulations, etc. The point is, if they want someone poking around these systems, they'll contract with them to do that. You should not tamper with them just out of curiosity. Convicted felons have a hard time finding jobs.
  - krnlpnc 5y ago
    Which is nonsense, what was the purpose of punitive action (jail) when a person will be punished for the rest if their life via stigma and ineligibility for jobs. How is that “correcting” a persons behavior?
    - hedora 5y ago
      It makes sure you never stop correcting them. Once a customer of the penal system, always a customer. They've worked hard to get their retention / repeat business numbers up this high. Why take that away from them?
    - mbreese 5y ago
      The punishment isn’t only a punishment for the individual. It’s a deterrent to keep the next person from doing whatever it was that was illegal. You can argue if that’s right or wrong, but that’s one of the points of many sentences — to send a “message” to others who might commit a crime.
      - akerl_ 5y ago
        “Don’t do crime, but if you do, I guess keep doing crimes forever because we’re going to make it hard for you to get a real job” isn’t really a compelling strategy.
        AnthonyMouse 5y ago
        That's the business model of the prison industrial complex.
        akerl_ 5y ago
        Let’s be clear where the blame sits. The “prison industrial complex” isn’t creating this. Private enterprise is set up to profit from incarceration rates and thus recidivism, but the reason that people can’t get jobs after they finish their sentence is the fault of all of us. Every company that refuses to hire somebody with a record is contributing to the problem, as is every person who looks down on somebody for having been incarcerated.
        lupire 5y ago
        If there are fewer jobs than people, some people will not have jobs and theus be tempted into criminal behavior. If there are more jobs than people, felons will be hired.
        akerl_ 5y ago
        This is pretty intensely reductive of the actual state of the world. It only works if all people are competing for all jobs, which they are not. To pick a boring example, see the multitude of companies complaining about labor shortages and also the number of felons who are struggling to find jobs.
        lobocinza 5y ago
        It's optimized for retention and not for reintegration.
  - ClumsyPilot 5y ago
    'The point is, if they want someone poking around these systems, they'll contract with them to do that' You plebs have no business poking around and find out what people in power are doing or find out if they've done their job properly. If they wanted someone holding them to account, they'd contract them to do thay'
  - sha256sum 5y ago
    > A lot. Pen tests, red teams, simulations, etc Okay, I call bullshit. That which can be claimed without evidence can also be refuted without evidence. That said, if you’re feeling like finding out do heed caution because I’m sure the Man will love to make an example of the first person we figures out how to pump their gas at $0.01 per gallon.
    - freedomben 5y ago
      > Okay, I call bullshit. That which can be claimed without evidence can also be refuted without evidence. Aside from the extreme rudeness, what evidence are you looking for? Do you want GP to attach sensitive or classified pen tests results here in public forum? GP's claim is so obviously true that I don't see why they would need to provide "evidence," but you can find a mountain of it yourself with a single duck: https://duckduckgo.com/?q=us+government+penetration+tests&atb=v314-2&ia=web https://duckduckgo.com/?q=us+government+penetration+tests&at... Pen tests are a requirement for any vendor doing business with the gov. Check out NIST 800-53 and the FedRAMP security process. It's much more intensive than SOC2 which is the standard in the commercial world. I think your information is about 10 to 20 years out of date.
      - hn_version_0023 5y ago
        Calling bullshit on someone isn’t rude, necessarily. Certainly it can be! But passing off bullshit as fact? That’s pretty damned rude.
        imwillofficial 5y ago
        It is absolutely rude and breaks down the conversation that was being made in good faith.
        hn_version_0023 5y ago
        We’ll have to agree to disagree. Personally I think the key is to not use the word “bullshit” unless you’re already on good terms with someone. But you can call BS without using that word, if you’re certain your audience is easily offended. Not caring if you offend someone? That’s also quite rude!
maxerickson 5y ago
The way the legal system works, the safe option is to not do anything with systems that you don't own or have authorization to use. Like public facing websites that advertise they are meant to have users are pretty safe, but after that, explicit authorization is a good idea vs deciding for yourself whether it might be critical infrastructure.
- Terry_Roll 5y ago
  I was going to suggest, why not buy your own gas pump's and do a hackathon!
amelius 5y ago
Or just wear a white hat.
mojosam 5y ago
I don’t think the Russians are going to care about a felony conviction. The major security holes in embedded devices that are part of our critical infrastructure are national security threats. Despite Putin’s bluster about nuclear weapons, cyberattacks are the easiest way for Russia to inflict pain on the US and Western Europe in response to economic sanctions and our support for Ukrain militarily. And those could do a lot of damage, both in terms of our economies and even civilian American/European lives.
- deleted 5y ago
  [deleted]
- 1-6 5y ago
  Virtual Private Networks always existed long before today’s internet VPNs or proxies. It used to be known as a ‘Friend in Russia.’
tormock 5y ago
I would probably hack the camera system first...
- cyberpunk 5y ago
  They mostly have their own network available, and easily enough crackable. If you're really determined you can pay some kids to break the cameras and wait for the tech to arrive to fix it over the next days and then capture all her network traffic.. Then find out you can control the cost/litre at the pumps via some awful soap api.. That's talking over the internet anyway.. I mean. So I've heard... (Looking at you, TOTAL)
- cbanek 5y ago
  I think this is actually done at least on ATMs. I have read it's a good way to get the pin number for a card, as you might be able to see someone typing it in. Some of the skimmers I want to say even had a camera aimed at the keypad?
  - tormock 5y ago
    I don't think that they hack the existing camera system... they install their own.
tormock 5y ago
indymike 5y ago
> Tampering with their computer systems (even just out of curiosity) is probably a bad idea. I don't think the kind of people who are robbing gas really care about weather this is a bad idea. That's why sometimes the right answer is to focus on preventing the crime because... > You could end up with a felony conviction. The crooks really don't care. It's all about not getting caught.
- nsxwolf 5y ago
  The crooks often already have a felony conviction, and are already living with the permanent consequences of that. The only remaining disincentive to crime for them is additional jail time, which can start to be seen as just a cost of doing business - X years for Y dollars.
  - indymike 5y ago
    In not sure the trade is that simple. Everyone I've known that has served time did the crime for one of two reasons: Most of the people who did financial crimes: Got away with it multiple times and just assumed they wouldn't get caught. The rest: totally irrational and fueled by mental health problems. Addictions, depression, relationship problems... I wish we were as good at helping people as we are at isolating and punishing. If punishment was a good deterrent, we wouldn't have roughly .7% of the adult population in jail.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]

by _wldu 5y ago

kzrdude 5y ago

Instead of the punitive angle, if they are critical infrastructure, what are the authorities of government doing to protect them?

_wldu 5y ago
A lot. Pen tests, red teams, simulations, etc. The point is, if they want someone poking around these systems, they'll contract with them to do that. You should not tamper with them just out of curiosity. Convicted felons have a hard time finding jobs.
- krnlpnc 5y ago
  Which is nonsense, what was the purpose of punitive action (jail) when a person will be punished for the rest if their life via stigma and ineligibility for jobs. How is that “correcting” a persons behavior?
  - hedora 5y ago
    It makes sure you never stop correcting them. Once a customer of the penal system, always a customer. They've worked hard to get their retention / repeat business numbers up this high. Why take that away from them?
  - mbreese 5y ago
    The punishment isn’t only a punishment for the individual. It’s a deterrent to keep the next person from doing whatever it was that was illegal. You can argue if that’s right or wrong, but that’s one of the points of many sentences — to send a “message” to others who might commit a crime.
    - akerl_ 5y ago
      “Don’t do crime, but if you do, I guess keep doing crimes forever because we’re going to make it hard for you to get a real job” isn’t really a compelling strategy.
      - AnthonyMouse 5y ago
        That's the business model of the prison industrial complex.
        akerl_ 5y ago
        Let’s be clear where the blame sits. The “prison industrial complex” isn’t creating this. Private enterprise is set up to profit from incarceration rates and thus recidivism, but the reason that people can’t get jobs after they finish their sentence is the fault of all of us. Every company that refuses to hire somebody with a record is contributing to the problem, as is every person who looks down on somebody for having been incarcerated.
        lupire 5y ago
        If there are fewer jobs than people, some people will not have jobs and theus be tempted into criminal behavior. If there are more jobs than people, felons will be hired.
        akerl_ 5y ago
        This is pretty intensely reductive of the actual state of the world. It only works if all people are competing for all jobs, which they are not. To pick a boring example, see the multitude of companies complaining about labor shortages and also the number of felons who are struggling to find jobs.
      - lobocinza 5y ago
        It's optimized for retention and not for reintegration.
- ClumsyPilot 5y ago
  'The point is, if they want someone poking around these systems, they'll contract with them to do that' You plebs have no business poking around and find out what people in power are doing or find out if they've done their job properly. If they wanted someone holding them to account, they'd contract them to do thay'
- sha256sum 5y ago
  > A lot. Pen tests, red teams, simulations, etc Okay, I call bullshit. That which can be claimed without evidence can also be refuted without evidence. That said, if you’re feeling like finding out do heed caution because I’m sure the Man will love to make an example of the first person we figures out how to pump their gas at $0.01 per gallon.
  - freedomben 5y ago
    > Okay, I call bullshit. That which can be claimed without evidence can also be refuted without evidence. Aside from the extreme rudeness, what evidence are you looking for? Do you want GP to attach sensitive or classified pen tests results here in public forum? GP's claim is so obviously true that I don't see why they would need to provide "evidence," but you can find a mountain of it yourself with a single duck: https://duckduckgo.com/?q=us+government+penetration+tests&atb=v314-2&ia=web https://duckduckgo.com/?q=us+government+penetration+tests&at... Pen tests are a requirement for any vendor doing business with the gov. Check out NIST 800-53 and the FedRAMP security process. It's much more intensive than SOC2 which is the standard in the commercial world. I think your information is about 10 to 20 years out of date.
    - hn_version_0023 5y ago
      Calling bullshit on someone isn’t rude, necessarily. Certainly it can be! But passing off bullshit as fact? That’s pretty damned rude.
      - imwillofficial 5y ago
        It is absolutely rude and breaks down the conversation that was being made in good faith.
        hn_version_0023 5y ago
        We’ll have to agree to disagree. Personally I think the key is to not use the word “bullshit” unless you’re already on good terms with someone. But you can call BS without using that word, if you’re certain your audience is easily offended. Not caring if you offend someone? That’s also quite rude!

maxerickson 5y ago

The way the legal system works, the safe option is to not do anything with systems that you don't own or have authorization to use. Like public facing websites that advertise they are meant to have users are pretty safe, but after that, explicit authorization is a good idea vs deciding for yourself whether it might be critical infrastructure.

Terry_Roll 5y ago
I was going to suggest, why not buy your own gas pump's and do a hackathon!

amelius 5y ago

Or just wear a white hat.

mojosam 5y ago

I don’t think the Russians are going to care about a felony conviction. The major security holes in embedded devices that are part of our critical infrastructure are national security threats. Despite Putin’s bluster about nuclear weapons, cyberattacks are the easiest way for Russia to inflict pain on the US and Western Europe in response to economic sanctions and our support for Ukrain militarily. And those could do a lot of damage, both in terms of our economies and even civilian American/European lives.

deleted 5y ago
[deleted]
1-6 5y ago
Virtual Private Networks always existed long before today’s internet VPNs or proxies. It used to be known as a ‘Friend in Russia.’

tormock 5y ago

I would probably hack the camera system first...

cyberpunk 5y ago
They mostly have their own network available, and easily enough crackable. If you're really determined you can pay some kids to break the cameras and wait for the tech to arrive to fix it over the next days and then capture all her network traffic.. Then find out you can control the cost/litre at the pumps via some awful soap api.. That's talking over the internet anyway.. I mean. So I've heard... (Looking at you, TOTAL)
cbanek 5y ago
I think this is actually done at least on ATMs. I have read it's a good way to get the pin number for a card, as you might be able to see someone typing it in. Some of the skimmers I want to say even had a camera aimed at the keypad?
- tormock 5y ago
  I don't think that they hack the existing camera system... they install their own.

tormock 5y ago

indymike 5y ago

> Tampering with their computer systems (even just out of curiosity) is probably a bad idea. I don't think the kind of people who are robbing gas really care about weather this is a bad idea. That's why sometimes the right answer is to focus on preventing the crime because... > You could end up with a felony conviction. The crooks really don't care. It's all about not getting caught.

nsxwolf 5y ago
The crooks often already have a felony conviction, and are already living with the permanent consequences of that. The only remaining disincentive to crime for them is additional jail time, which can start to be seen as just a cost of doing business - X years for Y dollars.
- indymike 5y ago
  In not sure the trade is that simple. Everyone I've known that has served time did the crime for one of two reasons: Most of the people who did financial crimes: Got away with it multiple times and just assumed they wouldn't get caught. The rest: totally irrational and fueled by mental health problems. Addictions, depression, relationship problems... I wish we were as good at helping people as we are at isolating and punishing. If punishment was a good deterrent, we wouldn't have roughly .7% of the adult population in jail.

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]