20 ms·

Detroit man steals 800 gallons using Bluetooth to hack gas pumps at station

294 points by mikece 3y ago

Retric 3y ago
Meanwhile your license plate is captured on camera. This is identical to someone hitting pay inside then driving off. Edit: Looks like pump then pay is more regional than I assumed. Yes it’s still a thing in some parts of the US in 2023.
- mikece 3y ago
  Except that hitting "Pay Inside" probably activates the "get high res photos" function because that's a known fraud profile. If the pump is tricked into giving gasoline for free how long does it take for the gas station employee(s) to notice something went wrong?
  - Retric 3y ago
    Yea it’s less automated but this bit: “when the clerks inside try to stop it - they can’t.” suggests it’s very obvious.
  - jjkaczor 3y ago
    Interesting - in Canada, if you want to "Pay Inside", you have to go in and actually pay - they authorize the maximum transaction, and it unlocks the pump and sets it to a maximum amount. If you pump less than that amount, you pay only for what you use. But, OTOH - Canada seems a bit ahead of the US when it comes to Interac/debit-card transactions in general (... but also a little "behind" Europe and AU/NZ...)
    - mikece 3y ago
      A lot of places in the US are either pay by credit card at the pump or pre-pay inside only. I've also seen where "pay inside after" only works if you leave your driver's license with the attendant inside before the pump is activated.
      - throwbadubadu 3y ago
        Huh, interesting.. the usual default in most of Europe is pump then pay, with nothing required beforehand, they have your license plate on video anyway?
        salad-tycoon 3y ago
        It used to be like this in the US too. Now we have “upgraded customer interactive digital displays” that stream ads, TikTok, “cheddar news” , and propaganda into your brain while you pump and I haven’t seen a pump then pay in some years.
        willcipriano 3y ago
        You can't buy a toothbrush without calling a attendant where I live, no way they let you pump $100 of gas without paying first. Pay after was the norm when I was a kid though.
        opello 3y ago
        I recently learned that you can mute some of these! I've had success with the top right or second from the top on the right button near the screen. No reason not to try them all if you're a captive audience anyway...
        fuzzzerd 3y ago
        I spam all the buttons on any pump to attempt to mute it, and like you have had success with top right, or second from top on the right having the highest success. In my area, I'm only about 1/4 in being able to mute it, but when it works, usually top right.
        olyjohn 3y ago
        I wonder if I could just get a powerful electromagnet and use it to rip the coil out of the speaker. Would be a benefit to society.
    - ziddoap 3y ago
      >in Canada, if you want to "Pay Inside", you have to go in and actually pay - they authorize the maximum transaction, and it unlocks the pump and sets it to a maximum amount. I'm in a good-sized city, and every gas station I've been to lets you pay inside after filling up. The only ones that require pre-pay (either by going inside as you described, paying for a max amount, or by CC) are the farthest pumps away from the store.
      - deleted 3y ago
        [deleted]
      - pizzaknife 3y ago
        this is insane to me. I have not been to a single station in the continental united states in the last 7 years where "pay inside" does not equate to "pay first" That being said - perhaps its an "attendant" state? Several states have laws which restrict motorists from pumping their own gas, is this the scenario which you are talking to? edit: grammar
        ziddoap 3y ago
        I'm in Canada, not the US. But no, no attendant. You fill up for $X, then walk into the store and say "I filled up on pump 3", then you pay.
        pizzaknife 3y ago
        thank you! This pattern essentially disappeared from the US with the exception of perhaps the very smallest and remote locations (public accessible) seemingly since the late 1990s (I do remember this pattern as you have described, just not in the last 20years)
        matsemann 3y ago
        Laws saying you can't pump your own gas? Having to prepay inside? Wow, I'm flabbergasted, and it's a bit funny you're thinking it's insane the other way around. I guess it's what you're used to. When tanking before paying, I also used to get into the car and move it so that someone else could fill while I was inside(it would start a new transaction when you put the nossle back), probably to you look like a dash from the bill. Then walk inside saying "hundred and fifty something on pump 3 is mine". But I haven't seen a pump not accepting card in what, 20 years, here? So haven't used anything else for ages (and now got an electric car anyways)
    - complianceowl 3y ago
      This comment is kind of confusing; maybe others have had a different experience, but I live in the Midwest and what you're speaking of has been the norm for like the last decade. I've been driving for 13+ years and don't have any memories of being able to pump gas without first paying at the pump, or paying inside and my pump automatically stopping at the amount I paid for.
      - bluGill 3y ago
        I starting driving in 1990 - back then there was no pay at the pump so the norm everywhere was to pump gas then go inside and wait in line to pay. You knew you were in a bad neighborhood if you had to pay for your gas before you pumped it (you probably already knew you were in a bad neighborhood, but this confirmed it). About 15 years ago stations started to realize that nearly everyone was paying at the pump even if they were going to come inside for something else - which made it much more likely anyone not paying at the pump was trying to steel gasoline and so they went to pay first as few were inconvenienced. I do not miss at all standing in line behind someone who couldn't figure out which lottery ticket they wanted to buy.
    - dghlsakjg 3y ago
      As an American living in Canada: that’s exactly how it works on both sides of the border.
    - cactusplant7374 3y ago
      It’s more efficient to pay after you’ve completely filled your tank. I guess there is a trust issue, which is why it isn’t common in the US anymore.
      - salawat 3y ago
        Nope! It's actually because there's a financial standard transaction flow for things like pumps! -Confirm account: super small test move to confirm liveness of endpoint -Place hold: (locks $⁷5 worth of funds attached to an account) Finalize transaction -Finalize transaction for final amount -Release hold This is actually a really troublesome thing for people who have trouble keeping their account balances positive, because you can end up locking them out of further financial activity until the hold is expired/released. It's one of those things you don't really think about but are all over the place, and are a big part of making the world turn the way it does.
        sethhochberg 3y ago
        Similar problem for people this close to the financial edge: saying "I want exactly $23.46 worth of gas" because thats all the cash they have, a penny more wouldn't fly. Much easier and safer to ask the attendant to preload the pump with that amount and run it down to zero than to try and get as close as you can with the trigger without going over.
    - ajford 3y ago
      That was normal in Texas ~15-20yrs ago. But in the intervening time, I've seen that become less common. I've run into places that won't let you pay after and will instead just ask you to prepay (full transaction) and come back in to get the difference refunded. But I've also ran into plenty of places that if you hit "pay inside" on the pump will simply just turn the pump on, or will call you via the pump intercom (is that common everywhere?) and tell you they're turning the pump on for a max of XX gallons and to prepay or use the card at the pump if that's not enough.
      - bluGill 3y ago
        The pump intercom is done because then you know someone inside actually saw you and is expecting you. If you drive off without paying they are much more likely to notice and call the police in time for the police to catch you. Or at least that is what they want you to think.
        ajford 3y ago
        Yeah, I figured the intercom call was to get you thinking that they're watching closely, even though they're usually too busy with other customers to really be watching someone on the chance they drive off.
  - londons_explore 3y ago
    Presumably they find out within a week when they reorder gas and the filling truck has to fill substantially more than expected. They probably start investigating for a fuel leak, pull the data from all the pumps, and then realise the number of gallons pumped and the number of gallons paid for don't match up, and then check the CCTV.
    - djtango 3y ago
      Depends really. Most businesses will assume some amount of shrinkage. If you fly beneath the radar eg only hit the station once a month or every other month. You might get away with it.
      - zmgsabst 3y ago
        Completely agree. Also, volume is huge. If a gas station averages 1 car at all times across a month, you’re talking 400,000+ gal. Even just 1 hour of pumping each day is 18,000 gal. Are they really going to bother if one person swipes 20 gal a month?
        brookst 3y ago
        Not to mention the margin of error. Do fuel delivery quantities really exactly align with sold gas, to within a gallon or so? Or is there natural variation from each transaction being +/- $0.01, plus evaporation, plus any other rounding/physics considerations?
      - jareklupinski 3y ago
        > Most businesses will assume some amount of shrinkage in the gas trade, they use the term "evaporation" ;P
  - jacquesm 3y ago
    Here in NL it's 'pay inside' or 'pump then pay' by default unless you're in a border region where there are a lot of scammers. And judging by some recent foreign trips pretty much the same happens in other countries in the North of Europe.
- behringer 3y ago
  In my state they sure as heck don't let you pay after pumping! That's only really a thing in small towns
  - deleted 3y ago
    [deleted]
- ziddoap 3y ago
  It's not exactly difficult to obfuscate a license plate for the few minutes needed to fill up.
- rtkwe 3y ago
  My memory is that pay inside was a forced prepay option? My entire adult driving time has been after the advent of card readers being on basically every gas pump so I'm going off vague childhood memories of going in to pay for my parents.
  - Retric 3y ago
    Depends on the station but pump then pay is still a thing, but seems to be regional as this post from 2023 shows. https://www.cleverdude.com/content/4-things-you-need-to-know-about-prepaying-for-gas/ https://www.cleverdude.com/content/4-things-you-need-to-know...
  - gadders 3y ago
    Pump then pay is the default in the UK, but card readers on pumps are becoming more common.
    - mhandley 3y ago
      And in most places, what they lose on fuel theft, they more than make up on sales in the petrol station shop which is where they really make their money, so they have little incentive to change.
  - jstarfish 3y ago
    When I still had a motorcycle (early 2000s), I'd find a lot of rural stations didn't have modern tech on the pumps, and there were a lot of stations that still allowed pump-then-pay. Some stations just have shitty tech. A station near me fails open if you initiate a credit card transaction, take the pump off the hook, and then abort the transaction.
- pbmonster 3y ago
  The interesting question is how often they notice, and whether the pump keeps logs. Because not everybody is stupid enough to invite their entire neighborhood to a free-for-all. Just drive up, unlock pump, fill up, lock pump, leave. I would not be surprised if the pump doesn't have a time-stamped log of Bluetooth service function calls. And even if it does, how long can you run this scam before they notice missing inventory from their underground tanks? How long do they keep CCTV footage?
  - ethbr1 3y ago
    They could correlate by absence of a matching receipt. Strip out every timestamp correlated with a sale. Strip out no object at a pump. Scan through the remainder.
    - pbmonster 3y ago
      You're talking about running image detection on the video footage and correlate with payment system receipts? You could probably hack that together in python in 15 minutes, but I doubt there's commercial software offering that functionality. Which means nobody (outside a digital forensics firm) is doing that, and certainly not for $60 worth of gas. And still, that requires the station even noticing missing inventory. I really wonder how long people have been using that hack, you'd probably check for leaks in the underground tank before checking whether your pumps have been compromised...
      - dylan604 3y ago
        >You're talking about running image detection on the video footage and correlate with payment system receipts? Or, do what has been done since the beginning of video recordings used in investigations...have a human sit in front of the screen scanning the footage.
        ClumsyPilot 3y ago
        You are potentially paying a human to watch mutple days of video footage to detect $60 of gas. Even at minimum wage, that could be a loss. And then you find out the car was a white Toyota corolla and it's missing a number plate, now what?
- gambiting 3y ago
  >>Edit: Looks like pump then pay is more regional than I assumed. The only place I have ever seen the requirement to pay first was in some tourist resorts in Spain, I guess to prevent theft. Weirdest thing ever, it's like....lady I have no idea how much fuel this rental car will take, how can I possibly prepay you.
  - adra 3y ago
    All the credit cards have a reserved amount they can pre-allocate so that once the final bill is due, you're required to pay at most X dollars (the max that you chose at the pump). It's fraud proof. Like it or not, it'll likely be deployed everywhere eventually because it should be able to cut down on fraudulent purchases significantly.
    - gambiting 3y ago
      ....is it common that people fill up and drive away without paying where you live? I have literally never heard of that happening, ever - I guess if you tried you wouldn't get very far, police would be called and they'd find you quickly with the reg plate.
      - bluGill 3y ago
        What do you mean by common. The vast majority of people do not do this every. However even in the best areas someone will do it (I'm guessing a few times per month). In really bad areas it happens several times per hour. Generally the police are good at finding who did it when this happens, but only if the station notices in the first place - they don't always.
      - gruez 3y ago
        >I have literally never heard of that happening, ever How would you hear about it? Unless you're friends with a gas station owner/employee, how would you know? The amount is small enough that it'll never show up in local media, just like the local teenager shoplifting wouldn't show up on local media.
- pard68 3y ago
  Same man. I don't know of a single pump within 40 miles of me that even has a card reader. It's all pump-then-pay.
- Mister_Snuggles 3y ago
  In Alberta, it's required by law to pay before you pump. This happened after an attendant was killed during a gas-and-dash robbery.
- NoMoreNicksLeft 3y ago
  Last week I had some idle time, and I was looking up whether they sold multi-color e-ink displays in a 6"x12" size. My state doesn't even emboss plates anymore. If I did mount one and kept my real tag number on it, could anyone even tell? I'm boring as shit, so I don't know why I'd have a James Bond gadget on my car... > Looks like pump then pay is more regional than I assumed. Yes it’s still a thing in some parts of the US in 2023. I haven't seen this in forever. Even the shitty little gas stations where I grew up, I thought those were all upgraded ages ago. The EPA tends to frown on tanks that have been in the ground a long time, and since that's the biggest cost, they tend to get the electronics upgraded too so that it's pay at the pump. No idea why anyone with cash wouldn't be forced to pay first.
  - yomlica8 3y ago
    There was a post on here where some one mentioned a lot of people just install bike racks to block the plate and said Amazon sells lots of plate hiding stuff. I'd definitely seen plastic covers that obviously made the plate very hard to read in the wild but I'd never really thought about using different kinds of luggage racks to obscure plates. Of course, my state used a bunch of bad paint on license plates for a number of years so you could just peel off all the paint removing any contrast from a legit plate and you'd look no different than most people's unreadable plates anyway.
    - Retric 3y ago
      Which is all well and good until someone aims a camera to capture the VIN number near your drivers side dash. That’s the thing it’s easy to say something is a perfect crime, it’s harder to prove.
- Aurornis 3y ago
  > Meanwhile your license plate is captured on camera If the thieves are going to such lengths as to hack the pumps, they're likely taking the 60 seconds necessary to tape over their license plate. This is an extreme premeditated attack, not someone running off with gas on a whim.
  - sethhochberg 3y ago
    Hell, if you're doing it all with Bluetooth anyways, get one of those electronic license plate cover devices that have become a plague with all of the worst drivers in every town who try and avoid tolls and red light cameras...
    - pierat 3y ago
      Holy shit, you weren't joking. Search Scamazon for "license plate flipper" https://www.amazon.com/Universal-Electric-Rust-Proof-Weather-Proof-Automatic/dp/B0BWY3NTKQ https://www.amazon.com/Universal-Electric-Rust-Proof-Weather... Verified Purchaser: "I like that I don't have to pay for tolls"
    - adolph 3y ago
      That sounds expensive/complicated compared to the ubiquitous paper plate. How Texas Paper Tags Became a $200M Criminal Enterprise: https://www.nbcdfw.com/investigations/how-texas-paper-tags-became-a-200m-criminal-enterprise-nbc-5-investigates/2808043/ https://www.nbcdfw.com/investigations/how-texas-paper-tags-b...
- coin 3y ago
  > Meanwhile your license plate is captured on camera Depends on if local police and district attorneys actually acts on it
- c22 3y ago
  Around here I've been noticing an alarming number of vehicles being driven around with deeply expired tabs, dubious bits of paper tacked in the license plate area, or frequently no plates at all ever since the pandemic. Depending on where you live this just might not be enforced very much at the moment.
olzhas 3y ago
3028.33L
- londons_explore 3y ago
  If that's all in one vehicle, this guy either drives a massive tractor or the fraud has been going on for years.
  - prmoustache 3y ago
    Just read the article.
  - notpushkin 3y ago
    It's in his vehicle plus everybody who went in for free gas after them. He didn't lock up the pump afterwards.
  - dclowd9901 3y ago
    Sounds like a social media thing. He does it somewhere and tells folks about it because they start lining up there. Modern day Robin Hood, kinda.
  - bluGill 3y ago
    That is only 16000 miles at 20mpg. The average American drives 12000 miles per year. It isn't clear over what time period this was done over, but it is only a bit over average if this is in a year. The article seems to imply per incidence, but even then you only need 50 friends. Or you can cover you tracks just by making the change, then letting an hour go by before going to fill you tank - making it seem like you were one of the lucky ones to get the cheap fuel.
jan_Sate 3y ago
That's exactly why it's a bad idea to use IoT on everything! Most companies working on this kind of product doesn't give a shit about security.
- Obscurity4340 3y ago
  Just nice to see it used against someone other than the little people for once
  - huytersd 3y ago
    It’s stealing from gas pump owners who are still very much the little people.
    - mattgeo_j 3y ago
      Last I heard, gas station "owners" make such a minuscule amount of money from the gas pumps and really rely on what they sell
      - gottorf 3y ago
        Barely making a profit on gas sales doesn't mean you're OK losing $3,000 of gas.
        quesera 3y ago
        It's actually worse. Having a zero-margin product stolen, means that your loss is 100% of the sale price.
    - jjkaczor 3y ago
      Depends on if it is a direct corporate owned location, or franchised - but yes, I would argue that it hits many of the average small/medium business owners. Things will be "interesting" over the next 10-20 with the switch to electrification - yet another entire sector that may no longer be viable for small/medium independent owners. (but, time marches on - we don't see many people lamenting the "buggy whip manufacturers" from days of old)
Justsignedup 3y ago
This is why you need to not visit the same pump multiple times. They don't know they are being stolen from. So... fill up your car. Then leave. Then use a diff station next time. Rinse, repeat.
- deleted 3y ago
  [deleted]
- wildzzz 3y ago
  There's an added device inside the pump allowing the theft to take place. The Bluetooth feature allows you to disable it when you're done stealing gas so no one notices.
mrweasel 3y ago
The article seems a little light on details. I don't expect them to explain exactly how it works, but is this a bug/feature in the pump design? If you can just roll up to the pump and communicate with it over Bluetooth, then I'd argue that it's a design flaw and the manufacturer should be held accountable as this seems like a gross laps in security.
- ohduran 3y ago
  yeah, I opened it just in case they explained how it's done. For research purposes of course.
- bgroins 3y ago
  The article is poorly written. "Scammers are using cellphone's Bluetooth option to hack the pump - and get it for free." is all the detail you get. My cellphone's Bluetooth doesn't have that option.
  - dylan604 3y ago
    You have to enable the DevTools, but that requires a $99 annual fee. If you can't afford gas, it's not likely you can afford that fee too. So it's kind of a perfect catch-22
    - monkpit 3y ago
      If you steal gas you can afford lots of things, so this logic doesn’t really track. Also, you assume that someone wouldn’t just sell the gas they stole, which is probably very much worth the small investment in tools.
      - adolph 3y ago
        It's better to just return it to a different gas station. Selling gas is more difficult than you might think because of rampant dilution/adulteration in the secondary market. Can't just go door to door saying "Hey I bought too much gas" or "My car only takes 93 octane" -- nobody trusts anyone anymore. When you make a return without a receipt you generally just get store credit instead of cash. If you don't need some chips and tallboys, you can typically sell the credit to someone behind the station for .3 to .4 of the face value. That isn't great but since the gaming machines only take cash its a solid way to get liquid.
tromp 3y ago
What good reason is there for a pump to release gas for free through some Bluetooth interface? This hack proves you cannot rely on unauthorized people not able to learn how to interface or guess a (default) password. Setting up a proper public key infrastructure so that only authorized technicians can make use of the feature is probably not practically or economically feasible. It would be better to simply not have this feature at all.
- mdip 3y ago
  I have no idea how this hack is done/no insider knowledge but reading between the lines, I suspect that they're altering the pump in a manner that sets the cost per gallon to zero or near-zero.
  - wildzzz 3y ago
    It could be a MITM device between the flow sensor and the controller. It could adjust the flow reading to read much less than what is actually coming out or possibly zero. The controller doesn't have any way to verify the number and it's expected that the flow can change based on the condition of the pump and filters so a very slow reading isn't unreasonable. Add Bluetooth to the device and you can turn the hack on or off at will so it will go unnoticed. Clearly this guy took so much gas that someone did notice. Steal a candy bar from a 7/11 every week and no one will notice, steal the entire candy aisle once and they definitely will.
- bluGill 3y ago
  If your job is to maintain the pump you should have a measured container, then you dispense 1 gallon, check that what came out was one gallon - if not adjust various "things" until it is. They then dump the gasoline back in the tank. This is carefully regulated and checked by the state who does random checks as well. (it is also possible they do other chemical checks on the fuel - most just trust the refinery to do everything and have enough turn over that the fuel is close enough to fresh but there might be some exception) I'm not sure if the station themselves do the above check, or someone else. Based on other equipment I've worked on I'd expect this to be done weekly by the station, but I don't actually know what the service intervals on a gas pump is.
userbinator 3y ago
What are the pumps even using Bluetooth for? I suspect it might've been something like a default feature of the embedded PC that they didn't bother to disable, so you can "plug in" a BT keyboard / mouse and take control of the system.
- asynchronous 3y ago
  This seems like a likely answer.
- 34679 3y ago
  They could be keeping logs of unique identifiers to sell to location data brokers.
  - spicybright 3y ago
    Not wrong. Retail stores do that with wifi (and probably bluetooth now) all the time.
    - brookst 3y ago
      Is that still a thing in the era of randomized MAC addresses?
      - spicybright 3y ago
        I'd be quite surprised if they didn't come up with other identification techniques. Even if you couldn't pin point an individual anymore, I'm sure you can still learn a lot if you could somehow get version numbers from devices, wifi signal strength, etc. (especially when you can just dump it all into an AI now) The industry is too huge to just give up.
    - gymbeaux 3y ago
      On a related note, I recently went out of town and received several spam calls from phone numbers in that area. Some app on my phone seems to be selling my location data to these spam callers.
trackflak 3y ago
I'm not too bothered about their loss, given that gas pumps now have advertising screens installed. Let the ad revenue make up for it.
- ejb999 3y ago
  [flagged]
  - megabless123 3y ago
    Their comment is more substantive than your comment.
- netsharc 3y ago
  Hah, I'm going to make a startup that shows ads in the in-car display, "this gallon of fuel is brought to you by McDonald's. Try our new quad-cheeseburger, a drive-through is coming up 2 miles ahead!".
  - adhesive_wombat 3y ago
    That was a thing, they raised millions: https://www.businessinsider.com/4screen-in-car-marketing-startup-raises-23-million-2023-4 https://www.businessinsider.com/4screen-in-car-marketing-sta...
  - vel0city 3y ago
    Imagine if your GPS would automatically add an extra stop at Starbucks in the morning and McDonald's around lunch and dinner time. You try and punch in directions to one grocery store and it reroutes you past a competitor who paid for placement.
    - fuzzzerd 3y ago
      Thanks, I hate it.
    - netsharc 3y ago
kotaKat 3y ago
Is it actually Bluetooth, or did they get their hands on keys or remotes for the dispenser? The dispensers have constant real-time communication to the forecourt controller and the attendant inside. What are they showing when this "hack" happens? Are the attackers taking the RS485 line down (which would show the pump offline immediately inside) and forcing the pump to manually dispense? I'd kill to see some more actual information than this. I am not aware of a single pump on the market with Bluetooth right now but I do remember some IR-based remotes for some old Wayne pumps.
- Kye 3y ago
  I've seen people getting ready for a day of working on yards fill up 30 different things each on multiple trucks. The quantity might not stand out, and the attendant(s) might not be allowed to intervene if they think something looks suspicious. A "better to lose some money than risk losing a longtime customer over a mistake or an attendant getting shot playing hero" policy makes a lot of sense.
  - Razengan 3y ago
    > “an attendant getting shot playing hero" policy makes a lot of sense In the post-apocalypse or some other lawless society perhaps
    - 14 3y ago
      Here in British Columbia, Grants law was passed requiring all gas purchases to be prepaid after a gas station worker named Grant was ran over and killed as he tried to stop someone attempting to gas and dash. Back then gas was much cheaper so someone died over like $50. Doesn’t need to be a lawless society just one where someone makes a stupid choice. And we have lots of stupid people out there.
      - StrictDabbler 3y ago
        "The Law was named for Grant De Patie, a gas station worker who was killed in 2005 by an underage drunken driver ... Grant was dragged 7.5 kilometers before his body was dislodged from the white Chrysler LeBaron."
mikece 3y ago
I'm annoyed that the "sample code" hasn't been published to Github yet.
daoboy 3y ago
Another update for the Jolly Roger's Cookbook
stratigos 3y ago
while im completely against theft, theft is as old as economies of any kind. It is utterly irresponsible for the developers of such software system to have no/little defensive measure or protection against intrusion. This is article is like saying the bank teller has some kind of responsibility to mitigate an armed thief emptying out the bank vault when the bank vault has no lock, no door, and no real form of security. Up until now, the technology firms which creative this software have pushed the responsibility of security unfairly (and, imo, criminally negligent) onto their customers. This article just represents that the respective technologists need to actually do their job.
- londons_explore 3y ago
  This thief was caught though. There may be no security on the bluetooth, but there were cameras and accountants who noticed a discrepancy in the sales figures. In a way, it's better to have 'system level security' (ie. auditors and CCTV) than to secure just the fuel pump - after all, another thief might be around the back lowering his own pump into the big storage tanks, bypassing the bluetooth entirely...
  - Kye 3y ago
    Maybe it's a Georgia thing, but I always see the ports for filling the tanks in front near the pumps in clear view of people inside the store. I think an attendant would notice someone with a pump where the fuel trucks usually park.
    - bratgpttamer 3y ago
      I wonder how much fuel a white hard hat, safety vest, and clipboard could net one with a service truck/van.
  - gs17 3y ago
    > after all, another thief might be around the back lowering his own pump into the big storage tanks And that's apparently very common. According to the podcast I linked to in another comment, the deliveries are often done when no one is around, so the hatches to the tanks are often left unlocked overnight.
jmclnx 3y ago
Well like everything else, do not blame shoddy security, blame the people who discovered it. I am sure the people who did this will get hefty prison sentences and hefty fines. While the large companies that do all they can to avoid paying for expert security get a "I and disappointed in you" from the Government and "lets go after the small guy". I almost think we should make cracking of Large Companies Legal, that will force these companies to use good security practices. FWIW, I doubt this is a ma&pa gas station. In the US, in most cases, ma&pa stations charge more for gas and make their money from Auto Services. Most Stations in the US are owned by the large Oil Companies or other large corporations.
- dahfizz 3y ago
  Do you also think that Large Companies should be able to hire their own armies and make their own laws? The entire point of living in a society is that the government maintains a monopoly on force, and therefore can provide security to it's people. If the government can't enforce its own laws, what the fuck do we pay taxes for?
  - ToucanLoucan 3y ago
    The entire point of police was to socialize the costs of securing business properties and assets onto the taxpayer while calling it public safety. That's why just about the only thing cops are consistently decent at is intervening in property theft or vandalism and why the #1 type of theft is actually wage theft, by orders of magnitude, yet you never see cops raiding business owners' homes like they do for 2 ounces of meth. I'm not even saying pro or against here, that's just the facts of it. Police aren't here to protect you, they've established in court, in fact, that they do not need to intervene in a situation where you're in danger. That they also occasionally do some good for the community (or kill people in cold blood for trivial offenses) is a knock on effect, not the purpose.
    - mminer237 3y ago
      > That's why just about the only thing cops are consistently decent at is intervening in property theft or vandalism Property theft seems like the most-ignored type of crime these days. Police often do little more than fill out a report unless the thief is still there and stole a huge dollar amount. They obviously prioritize violent crime much higher than vandalism. > the #1 type of theft is actually wage theft This is a myth. Retail theft is much higher than wage theft.
jehb 3y ago
The headline says "Detroit man" but the article goes on to provide zero indication that the thief is a man or from Detroit.
- mdip 3y ago
  Welcome to Southeast Michigan. For whatever reason, everyone within 25 miles of Detroit "lives in Detroit" even though a whole lot of us might visit the city less than once a year. The media will usually say "Metro Detroit" when referring to someone who doesn't actually live in the city[0] of Detroit and given the location of the gas station, it's probably an actual person who lives in the city. [0] In which case it could be someone living in one of three different counties.
  - hospitalJail 3y ago
    Odds are its some techbro that lives in Oakland country, went down to some pump in Detroit where people DGAF, and did their exploit. Also, I just call it south east Michigan. Detroit is subordinate to Oakland County now. Maybe we should call it Oakland-Macomb for better accuracy.
  - havblue 3y ago
    I always got the impression that it's based on not wanting to say you're from "Detroit". You say you're from Royal Oak or whatever. People get confused. You hold up your palm and point to the lower right corner. People are still confused that you just pointed to Detroit...
  - hinkley 3y ago
    Meanwhile people living within 40 miles of Chicago 'live in Chicago'. Some insist on it themselves, others are put into that box by the rest of the Midwest.
  - bluGill 3y ago
    Either you live in Detroit or you live in the UP. Sincerely everyone in the US who doesn't live in Michigan.
ughitsaaron 3y ago
I love my hometown.
spread_love 3y ago
How do you fence stolen gasoline? Is there a black market for the stuff? Even if you got away with this, you're looking at $2000-$4000 in profit? Seems hardly with the risk (even if you're not concerned with ethics). Not to mention you have to safely store 800 gallons of gas somewhere.
- willprice89 3y ago
  > "They just open the pump for them automatically," said Mo, the gas station owner. > FOX 2: "And then cars just keep coming up and filling up?" > "Yeah they meet up with them and tell them to come over here," he said. It sounds like they find paying customers, then have the customers go get the gas from the unlocked pump. So essentially they are running a black market gas station within the actual gas station.
tamimio 3y ago
This article pretty much useless, where’s the details about the hack itself, what’s the protocol, is it specific to some vendors, among other details. Will wait until someone technical investigates it.
zzzeek 3y ago
um holy shit, the headline is "Detroit man steals 800 gallons" and....they have not caught or identified the person who did this ??? what? women can't be hacker criminals ? this is a news channel with real editors who we assume graduated high school and went to college ? to be clear, when I read "detroit man does X", I assume we are going to hear about the actual person, that is, they are known. so it's jarring to follow that headline with it flipping around the terminology, in the first paragraph "Detroit man" singular becomes "scammers" - oh it's multiple people? are they all from Detroit? this is why news consumers are so stupid. "facts" are some kind of handwavy thing for nerds
- willprice89 3y ago
  The very first sentence is horribly written: > Paying at the pump is for chumps - when you can get gas for free - and illegal The whole article may have been generated and then skimmed by the "authors".
shadowgovt 3y ago
They had to change the date on Cyberpunk 2077 because 2020 arrived.
WaitWaitWha 3y ago
My hypothesis is that the construction of gas pumps were using parts that have Bluetooth features that although not used by the pump or the station, are left in for speed and cost. There are many single board computers that have BT, WiFi, and other radios enabled and forgotten. For example, try to get a laptop that does not have a built in camera. It is significantly higher price that with camera. I am guessing similar is happening in gas pump manufacturing. The firmware stack would also fall into the similar 'laziness'. "The [chip/radio/whatever] driving library is already made, why recompile it without the BT when it could be working right now"...
- ryandrake 3y ago
  Just having an unused radio on the motherboard wouldn't necessarily be a meaningful attack surface. That radio would somehow have have a software path of some sort up the stack into the application business logic that controlled the pump. Unless this was something as basic as a root shell from the BT driver, there must be some participating software in there somewhere.
- CyberDildonics 3y ago
  similar is happening in gas pump manufacturing. What are you basing that on? why recompile it without the BT when it could be working right now Why would someone recompile anything when they could just turn it off?
1970-01-01 3y ago
Does anyone else think responsible disclosure of the vulnerability would yield less than the theft of gasoline, and that might be the real problem? I hate to say it, but this is a win for both consumers and the thieves. This is old hat hacking mentality. Fix it or deal with it.
BradDavis67 3y ago
[flagged]
ChrisArchitect 3y ago
> "We don't know what kind of device was used, but we know it was an electronic device," --Detroit Police Department spokesperson Any other more stories other than all of these pulling from the Fox 2 news one?
- ChrisArchitect 3y ago
  Is it something like this manipulation device that fools the "pulser" in the pump to alter the price? Couple reports over last years from Orlando, Texas etc with a cheap homemade device being used... https://www.clickorlando.com/news/local/2022/05/24/gas-pump-manipulators-steal-millions-of-dollars-in-fuel-and-its-legal-in-florida/ https://www.clickorlando.com/news/local/2022/05/24/gas-pump-...
ChumpGPT 3y ago
Probably using a remote. https://levtech.ro/product/universal-service-remote-control-for-fuel-pumps/ https://levtech.ro/product/universal-service-remote-control-... There is also this... https://youtu.be/Bcnjp2PESqw?si=jS3QqPWw2mboWOkS https://youtu.be/Bcnjp2PESqw?si=jS3QqPWw2mboWOkS
kleiba 3y ago
> "I wish it would go back to $1.99 - it’s almost $4," said Tywanna Coleman. Yeah, and it's > $7.50 in the country I currently live in. So count yourself lucky if you live in Detroit.
- TheBigSalad 3y ago
  Everyone thinks the lowest price in the past 10 years is the "normal" price.
  - vGPU 3y ago
    The price of gas was <$3/gal 2015-2020. It WAS the normal price. Now, what happened in 2021 that sent inflation skyrocketing? I wonder. https://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=pet&s=emm_epm0_pte_nus_dpg&f=a https://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=pet&s=e...
    - vGPU 3y ago
      Source: https://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=pet&s=emm_epm0_pte_nus_dpg&f=a https://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=pet&s=e...
callalex 3y ago
Good for them, we already paid for the gas through corrupt subsidies anyway.
phkahler 3y ago
Is this possibly an exploit of a card skimmer installed in the pump? There's an article on sparkfun about REing some skimmers: https://learn.sparkfun.com/tutorials/gas-pump-skimmers/all https://learn.sparkfun.com/tutorials/gas-pump-skimmers/all Maybe another option is to use bluetooth to replay someone else's card info into the pump. Extra funny if the one exploiting the skimmer for gas is completely different from whomever installed it to steal CC numbers!
_trampeltier 3y ago
I'm pretty sure, it is something like the pumps VFD, is a new fancy one with Bluetooth (for easy maintenance) and just the inital password.
jscipione 3y ago
Like gas prices crime is out of control in all major American cities. Vote Republican to solve both problems or vote Democrat to make them worse. The choice is yours, but if you want to see who is responsible, simply look in the mirror.
cm2012 3y ago
Seems like a lot of effort. Thats like $3k retailer, fencing it will be worth less.
everyone 3y ago
Surely they have the license plate # on camera of every vehicle that took petrol without paying? Wont they all just be charged with thievery?
- bluGill 3y ago
  They paid what they thought was the correct price. Many probably just swiped their card and thought it was a station mistake. Courts might make you pay the legitimate price for the fuel (which an honest person would agree to), but they won't call it steeling/a crime unless they can show you were the one who adjusted the price.
labrador 3y ago
I absolutely hate gas pumps with screens that show advertisements. It seems to me those pumps are internet enabled to get the content for advertisements. If the hacker got into the pump this way I'd say it serves them right.
dools 3y ago
So THAT'S why they all say not to use phones while filling up ...
oniony 3y ago
What the fuck is this article? It's like it's written for two-year-olds.
- amatecha 3y ago
  hahaha, read this comment before viewing the article, saw the URL is a Fox News domain .. burst out laughing. It basically _was_ written for two-year-olds! Seriously though, the writing is shockingly poor, informal, and reads as if it's some kind of Dr. Seuss book. "And when the clerks inside try to stop it - they can’t." "if they see a big backup at a pump, or someone hanging around a little too long, they’ll call cops to check it out." .. It's like it was run through one of those scripts that changes all words to be within the top 100-200 most commonly-used words in the language. Also, "Some gas station owners are falling victim to a sophisticated scam. " .. It's not a scam. No one is being scammed. Just to clarify further, FOX appears to just be fabricating things, as the Detroit PD don't know the nature of the hack, and did not mention anything about Bluetooth: https://www.detroitnews.com/story/news/local/detroit-city/2023/09/29/police-800-gallons-of-gas-stolen-in-detroit-with-electronic-device/71001909007/ https://www.detroitnews.com/story/news/local/detroit-city/20...
amatecha 3y ago
The source article is so poor it's mind-boggling. Is this the kind of "news" people actually spend their time reading? My IQ has temporarily dropped from subjecting myself to that. There's no substantiation that Bluetooth was used, nor that the perpetrator(s) is/are from Detroit. The most detail I've found, including quote from Detroit PD, is here: https://www.detroitnews.com/story/news/local/detroit-city/2023/09/29/police-800-gallons-of-gas-stolen-in-detroit-with-electronic-device/71001909007/ https://www.detroitnews.com/story/news/local/detroit-city/20... Reading between the lines, it sounds like one person performed the hack, and numerous people then proceeded to fill up for free -- knowingly or otherwise. There's no specific assertion anywhere that one particular individual stole 800 gallons of fuel. Of course that doesn't stop dozens of news sites all over the web from reporting inaccurate "information".
- throwaway2037 3y ago
  Yet another garbage click-baity article on HN. Look at the news source: Fox News local.
oldbbsnickname 3y ago
"Bluetooth" seems to be the reporter's misnomer for unspecified RF, possibly LoRa, NFC, WiFi, or actual BT. And, more confusingly, they don't actually report if it's a pump implant with RF capabilities or there's a wireless vulnerability in the pump. Most of the time, the pumps are modified in some subtle way. I would suspect a wireless implant. Gas station owners need to apply security seals to their pump's electronic doors and check for sabotage regularly (skimmers, holes, and other damage).
nosmokewhereiam 3y ago
https://m.youtube.com/watch?v=Bcnjp2PESqw https://m.youtube.com/watch?v=Bcnjp2PESqw From a year ago. 2 9v batteries to engage the pump.

294 points by mikece 3y ago

Meanwhile your license plate is captured on camera. This is identical to someone hitting pay inside then driving off. Edit: Looks like pump then pay is more regional than I assumed. Yes it’s still a thing in some parts of the US in 2023.

mikece 3y ago
Except that hitting "Pay Inside" probably activates the "get high res photos" function because that's a known fraud profile. If the pump is tricked into giving gasoline for free how long does it take for the gas station employee(s) to notice something went wrong?
- Retric 3y ago
  Yea it’s less automated but this bit: “when the clerks inside try to stop it - they can’t.” suggests it’s very obvious.
- jjkaczor 3y ago
  Interesting - in Canada, if you want to "Pay Inside", you have to go in and actually pay - they authorize the maximum transaction, and it unlocks the pump and sets it to a maximum amount. If you pump less than that amount, you pay only for what you use. But, OTOH - Canada seems a bit ahead of the US when it comes to Interac/debit-card transactions in general (... but also a little "behind" Europe and AU/NZ...)
  - mikece 3y ago
    A lot of places in the US are either pay by credit card at the pump or pre-pay inside only. I've also seen where "pay inside after" only works if you leave your driver's license with the attendant inside before the pump is activated.
    - throwbadubadu 3y ago
      Huh, interesting.. the usual default in most of Europe is pump then pay, with nothing required beforehand, they have your license plate on video anyway?
      - salad-tycoon 3y ago
        It used to be like this in the US too. Now we have “upgraded customer interactive digital displays” that stream ads, TikTok, “cheddar news” , and propaganda into your brain while you pump and I haven’t seen a pump then pay in some years.
        willcipriano 3y ago
        You can't buy a toothbrush without calling a attendant where I live, no way they let you pump $100 of gas without paying first. Pay after was the norm when I was a kid though.
        opello 3y ago
        I recently learned that you can mute some of these! I've had success with the top right or second from the top on the right button near the screen. No reason not to try them all if you're a captive audience anyway...
        fuzzzerd 3y ago
        I spam all the buttons on any pump to attempt to mute it, and like you have had success with top right, or second from top on the right having the highest success. In my area, I'm only about 1/4 in being able to mute it, but when it works, usually top right.
        olyjohn 3y ago
        I wonder if I could just get a powerful electromagnet and use it to rip the coil out of the speaker. Would be a benefit to society.
  - ziddoap 3y ago
    >in Canada, if you want to "Pay Inside", you have to go in and actually pay - they authorize the maximum transaction, and it unlocks the pump and sets it to a maximum amount. I'm in a good-sized city, and every gas station I've been to lets you pay inside after filling up. The only ones that require pre-pay (either by going inside as you described, paying for a max amount, or by CC) are the farthest pumps away from the store.
    - deleted 3y ago
      [deleted]
    - pizzaknife 3y ago
      this is insane to me. I have not been to a single station in the continental united states in the last 7 years where "pay inside" does not equate to "pay first" That being said - perhaps its an "attendant" state? Several states have laws which restrict motorists from pumping their own gas, is this the scenario which you are talking to? edit: grammar
      - ziddoap 3y ago
        I'm in Canada, not the US. But no, no attendant. You fill up for $X, then walk into the store and say "I filled up on pump 3", then you pay.
        pizzaknife 3y ago
        thank you! This pattern essentially disappeared from the US with the exception of perhaps the very smallest and remote locations (public accessible) seemingly since the late 1990s (I do remember this pattern as you have described, just not in the last 20years)
      - matsemann 3y ago
        Laws saying you can't pump your own gas? Having to prepay inside? Wow, I'm flabbergasted, and it's a bit funny you're thinking it's insane the other way around. I guess it's what you're used to. When tanking before paying, I also used to get into the car and move it so that someone else could fill while I was inside(it would start a new transaction when you put the nossle back), probably to you look like a dash from the bill. Then walk inside saying "hundred and fifty something on pump 3 is mine". But I haven't seen a pump not accepting card in what, 20 years, here? So haven't used anything else for ages (and now got an electric car anyways)
  - complianceowl 3y ago
    This comment is kind of confusing; maybe others have had a different experience, but I live in the Midwest and what you're speaking of has been the norm for like the last decade. I've been driving for 13+ years and don't have any memories of being able to pump gas without first paying at the pump, or paying inside and my pump automatically stopping at the amount I paid for.
    - bluGill 3y ago
      I starting driving in 1990 - back then there was no pay at the pump so the norm everywhere was to pump gas then go inside and wait in line to pay. You knew you were in a bad neighborhood if you had to pay for your gas before you pumped it (you probably already knew you were in a bad neighborhood, but this confirmed it). About 15 years ago stations started to realize that nearly everyone was paying at the pump even if they were going to come inside for something else - which made it much more likely anyone not paying at the pump was trying to steel gasoline and so they went to pay first as few were inconvenienced. I do not miss at all standing in line behind someone who couldn't figure out which lottery ticket they wanted to buy.
  - dghlsakjg 3y ago
    As an American living in Canada: that’s exactly how it works on both sides of the border.
  - cactusplant7374 3y ago
    It’s more efficient to pay after you’ve completely filled your tank. I guess there is a trust issue, which is why it isn’t common in the US anymore.
    - salawat 3y ago
      Nope! It's actually because there's a financial standard transaction flow for things like pumps! -Confirm account: super small test move to confirm liveness of endpoint -Place hold: (locks $⁷5 worth of funds attached to an account) Finalize transaction -Finalize transaction for final amount -Release hold This is actually a really troublesome thing for people who have trouble keeping their account balances positive, because you can end up locking them out of further financial activity until the hold is expired/released. It's one of those things you don't really think about but are all over the place, and are a big part of making the world turn the way it does.
      - sethhochberg 3y ago
        Similar problem for people this close to the financial edge: saying "I want exactly $23.46 worth of gas" because thats all the cash they have, a penny more wouldn't fly. Much easier and safer to ask the attendant to preload the pump with that amount and run it down to zero than to try and get as close as you can with the trigger without going over.
  - ajford 3y ago
    That was normal in Texas ~15-20yrs ago. But in the intervening time, I've seen that become less common. I've run into places that won't let you pay after and will instead just ask you to prepay (full transaction) and come back in to get the difference refunded. But I've also ran into plenty of places that if you hit "pay inside" on the pump will simply just turn the pump on, or will call you via the pump intercom (is that common everywhere?) and tell you they're turning the pump on for a max of XX gallons and to prepay or use the card at the pump if that's not enough.
    - bluGill 3y ago
      The pump intercom is done because then you know someone inside actually saw you and is expecting you. If you drive off without paying they are much more likely to notice and call the police in time for the police to catch you. Or at least that is what they want you to think.
      - ajford 3y ago
        Yeah, I figured the intercom call was to get you thinking that they're watching closely, even though they're usually too busy with other customers to really be watching someone on the chance they drive off.
- londons_explore 3y ago
  Presumably they find out within a week when they reorder gas and the filling truck has to fill substantially more than expected. They probably start investigating for a fuel leak, pull the data from all the pumps, and then realise the number of gallons pumped and the number of gallons paid for don't match up, and then check the CCTV.
  - djtango 3y ago
    Depends really. Most businesses will assume some amount of shrinkage. If you fly beneath the radar eg only hit the station once a month or every other month. You might get away with it.
    - zmgsabst 3y ago
      Completely agree. Also, volume is huge. If a gas station averages 1 car at all times across a month, you’re talking 400,000+ gal. Even just 1 hour of pumping each day is 18,000 gal. Are they really going to bother if one person swipes 20 gal a month?
      - brookst 3y ago
        Not to mention the margin of error. Do fuel delivery quantities really exactly align with sold gas, to within a gallon or so? Or is there natural variation from each transaction being +/- $0.01, plus evaporation, plus any other rounding/physics considerations?
    - jareklupinski 3y ago
      > Most businesses will assume some amount of shrinkage in the gas trade, they use the term "evaporation" ;P
- jacquesm 3y ago
  Here in NL it's 'pay inside' or 'pump then pay' by default unless you're in a border region where there are a lot of scammers. And judging by some recent foreign trips pretty much the same happens in other countries in the North of Europe.
behringer 3y ago
In my state they sure as heck don't let you pay after pumping! That's only really a thing in small towns
- deleted 3y ago
  [deleted]
ziddoap 3y ago
It's not exactly difficult to obfuscate a license plate for the few minutes needed to fill up.
rtkwe 3y ago
My memory is that pay inside was a forced prepay option? My entire adult driving time has been after the advent of card readers being on basically every gas pump so I'm going off vague childhood memories of going in to pay for my parents.
- Retric 3y ago
  Depends on the station but pump then pay is still a thing, but seems to be regional as this post from 2023 shows. https://www.cleverdude.com/content/4-things-you-need-to-know-about-prepaying-for-gas/ https://www.cleverdude.com/content/4-things-you-need-to-know...
- gadders 3y ago
  Pump then pay is the default in the UK, but card readers on pumps are becoming more common.
  - mhandley 3y ago
    And in most places, what they lose on fuel theft, they more than make up on sales in the petrol station shop which is where they really make their money, so they have little incentive to change.
- jstarfish 3y ago
  When I still had a motorcycle (early 2000s), I'd find a lot of rural stations didn't have modern tech on the pumps, and there were a lot of stations that still allowed pump-then-pay. Some stations just have shitty tech. A station near me fails open if you initiate a credit card transaction, take the pump off the hook, and then abort the transaction.
pbmonster 3y ago
The interesting question is how often they notice, and whether the pump keeps logs. Because not everybody is stupid enough to invite their entire neighborhood to a free-for-all. Just drive up, unlock pump, fill up, lock pump, leave. I would not be surprised if the pump doesn't have a time-stamped log of Bluetooth service function calls. And even if it does, how long can you run this scam before they notice missing inventory from their underground tanks? How long do they keep CCTV footage?
- ethbr1 3y ago
  They could correlate by absence of a matching receipt. Strip out every timestamp correlated with a sale. Strip out no object at a pump. Scan through the remainder.
  - pbmonster 3y ago
    You're talking about running image detection on the video footage and correlate with payment system receipts? You could probably hack that together in python in 15 minutes, but I doubt there's commercial software offering that functionality. Which means nobody (outside a digital forensics firm) is doing that, and certainly not for $60 worth of gas. And still, that requires the station even noticing missing inventory. I really wonder how long people have been using that hack, you'd probably check for leaks in the underground tank before checking whether your pumps have been compromised...
    - dylan604 3y ago
      >You're talking about running image detection on the video footage and correlate with payment system receipts? Or, do what has been done since the beginning of video recordings used in investigations...have a human sit in front of the screen scanning the footage.
      - ClumsyPilot 3y ago
        You are potentially paying a human to watch mutple days of video footage to detect $60 of gas. Even at minimum wage, that could be a loss. And then you find out the car was a white Toyota corolla and it's missing a number plate, now what?
gambiting 3y ago
>>Edit: Looks like pump then pay is more regional than I assumed. The only place I have ever seen the requirement to pay first was in some tourist resorts in Spain, I guess to prevent theft. Weirdest thing ever, it's like....lady I have no idea how much fuel this rental car will take, how can I possibly prepay you.
- adra 3y ago
  All the credit cards have a reserved amount they can pre-allocate so that once the final bill is due, you're required to pay at most X dollars (the max that you chose at the pump). It's fraud proof. Like it or not, it'll likely be deployed everywhere eventually because it should be able to cut down on fraudulent purchases significantly.
  - gambiting 3y ago
    ....is it common that people fill up and drive away without paying where you live? I have literally never heard of that happening, ever - I guess if you tried you wouldn't get very far, police would be called and they'd find you quickly with the reg plate.
    - bluGill 3y ago
      What do you mean by common. The vast majority of people do not do this every. However even in the best areas someone will do it (I'm guessing a few times per month). In really bad areas it happens several times per hour. Generally the police are good at finding who did it when this happens, but only if the station notices in the first place - they don't always.
    - gruez 3y ago
      >I have literally never heard of that happening, ever How would you hear about it? Unless you're friends with a gas station owner/employee, how would you know? The amount is small enough that it'll never show up in local media, just like the local teenager shoplifting wouldn't show up on local media.
pard68 3y ago
Same man. I don't know of a single pump within 40 miles of me that even has a card reader. It's all pump-then-pay.
Mister_Snuggles 3y ago
In Alberta, it's required by law to pay before you pump. This happened after an attendant was killed during a gas-and-dash robbery.
NoMoreNicksLeft 3y ago
Last week I had some idle time, and I was looking up whether they sold multi-color e-ink displays in a 6"x12" size. My state doesn't even emboss plates anymore. If I did mount one and kept my real tag number on it, could anyone even tell? I'm boring as shit, so I don't know why I'd have a James Bond gadget on my car... > Looks like pump then pay is more regional than I assumed. Yes it’s still a thing in some parts of the US in 2023. I haven't seen this in forever. Even the shitty little gas stations where I grew up, I thought those were all upgraded ages ago. The EPA tends to frown on tanks that have been in the ground a long time, and since that's the biggest cost, they tend to get the electronics upgraded too so that it's pay at the pump. No idea why anyone with cash wouldn't be forced to pay first.
- yomlica8 3y ago
  There was a post on here where some one mentioned a lot of people just install bike racks to block the plate and said Amazon sells lots of plate hiding stuff. I'd definitely seen plastic covers that obviously made the plate very hard to read in the wild but I'd never really thought about using different kinds of luggage racks to obscure plates. Of course, my state used a bunch of bad paint on license plates for a number of years so you could just peel off all the paint removing any contrast from a legit plate and you'd look no different than most people's unreadable plates anyway.
  - Retric 3y ago
    Which is all well and good until someone aims a camera to capture the VIN number near your drivers side dash. That’s the thing it’s easy to say something is a perfect crime, it’s harder to prove.
Aurornis 3y ago
> Meanwhile your license plate is captured on camera If the thieves are going to such lengths as to hack the pumps, they're likely taking the 60 seconds necessary to tape over their license plate. This is an extreme premeditated attack, not someone running off with gas on a whim.
- sethhochberg 3y ago
  Hell, if you're doing it all with Bluetooth anyways, get one of those electronic license plate cover devices that have become a plague with all of the worst drivers in every town who try and avoid tolls and red light cameras...
  - pierat 3y ago
    Holy shit, you weren't joking. Search Scamazon for "license plate flipper" https://www.amazon.com/Universal-Electric-Rust-Proof-Weather-Proof-Automatic/dp/B0BWY3NTKQ https://www.amazon.com/Universal-Electric-Rust-Proof-Weather... Verified Purchaser: "I like that I don't have to pay for tolls"
  - adolph 3y ago
    That sounds expensive/complicated compared to the ubiquitous paper plate. How Texas Paper Tags Became a $200M Criminal Enterprise: https://www.nbcdfw.com/investigations/how-texas-paper-tags-became-a-200m-criminal-enterprise-nbc-5-investigates/2808043/ https://www.nbcdfw.com/investigations/how-texas-paper-tags-b...
coin 3y ago
> Meanwhile your license plate is captured on camera Depends on if local police and district attorneys actually acts on it
c22 3y ago
Around here I've been noticing an alarming number of vehicles being driven around with deeply expired tabs, dubious bits of paper tacked in the license plate area, or frequently no plates at all ever since the pandemic. Depending on where you live this just might not be enforced very much at the moment.

olzhas 3y ago

3028.33L

londons_explore 3y ago
If that's all in one vehicle, this guy either drives a massive tractor or the fraud has been going on for years.
- prmoustache 3y ago
  Just read the article.
- notpushkin 3y ago
  It's in his vehicle plus everybody who went in for free gas after them. He didn't lock up the pump afterwards.
- dclowd9901 3y ago
  Sounds like a social media thing. He does it somewhere and tells folks about it because they start lining up there. Modern day Robin Hood, kinda.
- bluGill 3y ago
  That is only 16000 miles at 20mpg. The average American drives 12000 miles per year. It isn't clear over what time period this was done over, but it is only a bit over average if this is in a year. The article seems to imply per incidence, but even then you only need 50 friends. Or you can cover you tracks just by making the change, then letting an hour go by before going to fill you tank - making it seem like you were one of the lucky ones to get the cheap fuel.

jan_Sate 3y ago

That's exactly why it's a bad idea to use IoT on everything! Most companies working on this kind of product doesn't give a shit about security.

Obscurity4340 3y ago
Just nice to see it used against someone other than the little people for once
- huytersd 3y ago
  It’s stealing from gas pump owners who are still very much the little people.
  - mattgeo_j 3y ago
    Last I heard, gas station "owners" make such a minuscule amount of money from the gas pumps and really rely on what they sell
    - gottorf 3y ago
      Barely making a profit on gas sales doesn't mean you're OK losing $3,000 of gas.
      - quesera 3y ago
        It's actually worse. Having a zero-margin product stolen, means that your loss is 100% of the sale price.
  - jjkaczor 3y ago
    Depends on if it is a direct corporate owned location, or franchised - but yes, I would argue that it hits many of the average small/medium business owners. Things will be "interesting" over the next 10-20 with the switch to electrification - yet another entire sector that may no longer be viable for small/medium independent owners. (but, time marches on - we don't see many people lamenting the "buggy whip manufacturers" from days of old)

Justsignedup 3y ago

This is why you need to not visit the same pump multiple times. They don't know they are being stolen from. So... fill up your car. Then leave. Then use a diff station next time. Rinse, repeat.

deleted 3y ago
[deleted]
wildzzz 3y ago
There's an added device inside the pump allowing the theft to take place. The Bluetooth feature allows you to disable it when you're done stealing gas so no one notices.

mrweasel 3y ago

The article seems a little light on details. I don't expect them to explain exactly how it works, but is this a bug/feature in the pump design? If you can just roll up to the pump and communicate with it over Bluetooth, then I'd argue that it's a design flaw and the manufacturer should be held accountable as this seems like a gross laps in security.

ohduran 3y ago
yeah, I opened it just in case they explained how it's done. For research purposes of course.
bgroins 3y ago
The article is poorly written. "Scammers are using cellphone's Bluetooth option to hack the pump - and get it for free." is all the detail you get. My cellphone's Bluetooth doesn't have that option.
- dylan604 3y ago
  You have to enable the DevTools, but that requires a $99 annual fee. If you can't afford gas, it's not likely you can afford that fee too. So it's kind of a perfect catch-22
  - monkpit 3y ago
    If you steal gas you can afford lots of things, so this logic doesn’t really track. Also, you assume that someone wouldn’t just sell the gas they stole, which is probably very much worth the small investment in tools.
    - adolph 3y ago
      It's better to just return it to a different gas station. Selling gas is more difficult than you might think because of rampant dilution/adulteration in the secondary market. Can't just go door to door saying "Hey I bought too much gas" or "My car only takes 93 octane" -- nobody trusts anyone anymore. When you make a return without a receipt you generally just get store credit instead of cash. If you don't need some chips and tallboys, you can typically sell the credit to someone behind the station for .3 to .4 of the face value. That isn't great but since the gaming machines only take cash its a solid way to get liquid.

tromp 3y ago

What good reason is there for a pump to release gas for free through some Bluetooth interface? This hack proves you cannot rely on unauthorized people not able to learn how to interface or guess a (default) password. Setting up a proper public key infrastructure so that only authorized technicians can make use of the feature is probably not practically or economically feasible. It would be better to simply not have this feature at all.

mdip 3y ago
I have no idea how this hack is done/no insider knowledge but reading between the lines, I suspect that they're altering the pump in a manner that sets the cost per gallon to zero or near-zero.
- wildzzz 3y ago
  It could be a MITM device between the flow sensor and the controller. It could adjust the flow reading to read much less than what is actually coming out or possibly zero. The controller doesn't have any way to verify the number and it's expected that the flow can change based on the condition of the pump and filters so a very slow reading isn't unreasonable. Add Bluetooth to the device and you can turn the hack on or off at will so it will go unnoticed. Clearly this guy took so much gas that someone did notice. Steal a candy bar from a 7/11 every week and no one will notice, steal the entire candy aisle once and they definitely will.
bluGill 3y ago
If your job is to maintain the pump you should have a measured container, then you dispense 1 gallon, check that what came out was one gallon - if not adjust various "things" until it is. They then dump the gasoline back in the tank. This is carefully regulated and checked by the state who does random checks as well. (it is also possible they do other chemical checks on the fuel - most just trust the refinery to do everything and have enough turn over that the fuel is close enough to fresh but there might be some exception) I'm not sure if the station themselves do the above check, or someone else. Based on other equipment I've worked on I'd expect this to be done weekly by the station, but I don't actually know what the service intervals on a gas pump is.

userbinator 3y ago

What are the pumps even using Bluetooth for? I suspect it might've been something like a default feature of the embedded PC that they didn't bother to disable, so you can "plug in" a BT keyboard / mouse and take control of the system.

asynchronous 3y ago
This seems like a likely answer.
34679 3y ago
They could be keeping logs of unique identifiers to sell to location data brokers.
- spicybright 3y ago
  Not wrong. Retail stores do that with wifi (and probably bluetooth now) all the time.
  - brookst 3y ago
    Is that still a thing in the era of randomized MAC addresses?
    - spicybright 3y ago
      I'd be quite surprised if they didn't come up with other identification techniques. Even if you couldn't pin point an individual anymore, I'm sure you can still learn a lot if you could somehow get version numbers from devices, wifi signal strength, etc. (especially when you can just dump it all into an AI now) The industry is too huge to just give up.
  - gymbeaux 3y ago
    On a related note, I recently went out of town and received several spam calls from phone numbers in that area. Some app on my phone seems to be selling my location data to these spam callers.

trackflak 3y ago

I'm not too bothered about their loss, given that gas pumps now have advertising screens installed. Let the ad revenue make up for it.

ejb999 3y ago
[flagged]
- megabless123 3y ago
  Their comment is more substantive than your comment.
netsharc 3y ago
Hah, I'm going to make a startup that shows ads in the in-car display, "this gallon of fuel is brought to you by McDonald's. Try our new quad-cheeseburger, a drive-through is coming up 2 miles ahead!".
- adhesive_wombat 3y ago
  That was a thing, they raised millions: https://www.businessinsider.com/4screen-in-car-marketing-startup-raises-23-million-2023-4 https://www.businessinsider.com/4screen-in-car-marketing-sta...
- vel0city 3y ago
  Imagine if your GPS would automatically add an extra stop at Starbucks in the morning and McDonald's around lunch and dinner time. You try and punch in directions to one grocery store and it reroutes you past a competitor who paid for placement.
  - fuzzzerd 3y ago
    Thanks, I hate it.
  - netsharc 3y ago

kotaKat 3y ago

Is it actually Bluetooth, or did they get their hands on keys or remotes for the dispenser? The dispensers have constant real-time communication to the forecourt controller and the attendant inside. What are they showing when this "hack" happens? Are the attackers taking the RS485 line down (which would show the pump offline immediately inside) and forcing the pump to manually dispense? I'd kill to see some more actual information than this. I am not aware of a single pump on the market with Bluetooth right now but I do remember some IR-based remotes for some old Wayne pumps.

Kye 3y ago
I've seen people getting ready for a day of working on yards fill up 30 different things each on multiple trucks. The quantity might not stand out, and the attendant(s) might not be allowed to intervene if they think something looks suspicious. A "better to lose some money than risk losing a longtime customer over a mistake or an attendant getting shot playing hero" policy makes a lot of sense.
- Razengan 3y ago
  > “an attendant getting shot playing hero" policy makes a lot of sense In the post-apocalypse or some other lawless society perhaps
  - 14 3y ago
    Here in British Columbia, Grants law was passed requiring all gas purchases to be prepaid after a gas station worker named Grant was ran over and killed as he tried to stop someone attempting to gas and dash. Back then gas was much cheaper so someone died over like $50. Doesn’t need to be a lawless society just one where someone makes a stupid choice. And we have lots of stupid people out there.
    - StrictDabbler 3y ago
      "The Law was named for Grant De Patie, a gas station worker who was killed in 2005 by an underage drunken driver ... Grant was dragged 7.5 kilometers before his body was dislodged from the white Chrysler LeBaron."

mikece 3y ago

I'm annoyed that the "sample code" hasn't been published to Github yet.

daoboy 3y ago

Another update for the Jolly Roger's Cookbook

stratigos 3y ago

while im completely against theft, theft is as old as economies of any kind. It is utterly irresponsible for the developers of such software system to have no/little defensive measure or protection against intrusion. This is article is like saying the bank teller has some kind of responsibility to mitigate an armed thief emptying out the bank vault when the bank vault has no lock, no door, and no real form of security. Up until now, the technology firms which creative this software have pushed the responsibility of security unfairly (and, imo, criminally negligent) onto their customers. This article just represents that the respective technologists need to actually do their job.

londons_explore 3y ago
This thief was caught though. There may be no security on the bluetooth, but there were cameras and accountants who noticed a discrepancy in the sales figures. In a way, it's better to have 'system level security' (ie. auditors and CCTV) than to secure just the fuel pump - after all, another thief might be around the back lowering his own pump into the big storage tanks, bypassing the bluetooth entirely...
- Kye 3y ago
  Maybe it's a Georgia thing, but I always see the ports for filling the tanks in front near the pumps in clear view of people inside the store. I think an attendant would notice someone with a pump where the fuel trucks usually park.
  - bratgpttamer 3y ago
    I wonder how much fuel a white hard hat, safety vest, and clipboard could net one with a service truck/van.
- gs17 3y ago
  > after all, another thief might be around the back lowering his own pump into the big storage tanks And that's apparently very common. According to the podcast I linked to in another comment, the deliveries are often done when no one is around, so the hatches to the tanks are often left unlocked overnight.

jmclnx 3y ago

Well like everything else, do not blame shoddy security, blame the people who discovered it. I am sure the people who did this will get hefty prison sentences and hefty fines. While the large companies that do all they can to avoid paying for expert security get a "I and disappointed in you" from the Government and "lets go after the small guy". I almost think we should make cracking of Large Companies Legal, that will force these companies to use good security practices. FWIW, I doubt this is a ma&pa gas station. In the US, in most cases, ma&pa stations charge more for gas and make their money from Auto Services. Most Stations in the US are owned by the large Oil Companies or other large corporations.

dahfizz 3y ago
Do you also think that Large Companies should be able to hire their own armies and make their own laws? The entire point of living in a society is that the government maintains a monopoly on force, and therefore can provide security to it's people. If the government can't enforce its own laws, what the fuck do we pay taxes for?
- ToucanLoucan 3y ago
  The entire point of police was to socialize the costs of securing business properties and assets onto the taxpayer while calling it public safety. That's why just about the only thing cops are consistently decent at is intervening in property theft or vandalism and why the #1 type of theft is actually wage theft, by orders of magnitude, yet you never see cops raiding business owners' homes like they do for 2 ounces of meth. I'm not even saying pro or against here, that's just the facts of it. Police aren't here to protect you, they've established in court, in fact, that they do not need to intervene in a situation where you're in danger. That they also occasionally do some good for the community (or kill people in cold blood for trivial offenses) is a knock on effect, not the purpose.
  - mminer237 3y ago
    > That's why just about the only thing cops are consistently decent at is intervening in property theft or vandalism Property theft seems like the most-ignored type of crime these days. Police often do little more than fill out a report unless the thief is still there and stole a huge dollar amount. They obviously prioritize violent crime much higher than vandalism. > the #1 type of theft is actually wage theft This is a myth. Retail theft is much higher than wage theft.

jehb 3y ago

The headline says "Detroit man" but the article goes on to provide zero indication that the thief is a man or from Detroit.

mdip 3y ago
Welcome to Southeast Michigan. For whatever reason, everyone within 25 miles of Detroit "lives in Detroit" even though a whole lot of us might visit the city less than once a year. The media will usually say "Metro Detroit" when referring to someone who doesn't actually live in the city[0] of Detroit and given the location of the gas station, it's probably an actual person who lives in the city. [0] In which case it could be someone living in one of three different counties.
- hospitalJail 3y ago
  Odds are its some techbro that lives in Oakland country, went down to some pump in Detroit where people DGAF, and did their exploit. Also, I just call it south east Michigan. Detroit is subordinate to Oakland County now. Maybe we should call it Oakland-Macomb for better accuracy.
- havblue 3y ago
  I always got the impression that it's based on not wanting to say you're from "Detroit". You say you're from Royal Oak or whatever. People get confused. You hold up your palm and point to the lower right corner. People are still confused that you just pointed to Detroit...
- hinkley 3y ago
  Meanwhile people living within 40 miles of Chicago 'live in Chicago'. Some insist on it themselves, others are put into that box by the rest of the Midwest.
- bluGill 3y ago
  Either you live in Detroit or you live in the UP. Sincerely everyone in the US who doesn't live in Michigan.

ughitsaaron 3y ago

I love my hometown.

spread_love 3y ago

How do you fence stolen gasoline? Is there a black market for the stuff? Even if you got away with this, you're looking at $2000-$4000 in profit? Seems hardly with the risk (even if you're not concerned with ethics). Not to mention you have to safely store 800 gallons of gas somewhere.

willprice89 3y ago
> "They just open the pump for them automatically," said Mo, the gas station owner. > FOX 2: "And then cars just keep coming up and filling up?" > "Yeah they meet up with them and tell them to come over here," he said. It sounds like they find paying customers, then have the customers go get the gas from the unlocked pump. So essentially they are running a black market gas station within the actual gas station.

tamimio 3y ago

This article pretty much useless, where’s the details about the hack itself, what’s the protocol, is it specific to some vendors, among other details. Will wait until someone technical investigates it.

zzzeek 3y ago

um holy shit, the headline is "Detroit man steals 800 gallons" and....they have not caught or identified the person who did this ??? what? women can't be hacker criminals ? this is a news channel with real editors who we assume graduated high school and went to college ? to be clear, when I read "detroit man does X", I assume we are going to hear about the actual person, that is, they are known. so it's jarring to follow that headline with it flipping around the terminology, in the first paragraph "Detroit man" singular becomes "scammers" - oh it's multiple people? are they all from Detroit? this is why news consumers are so stupid. "facts" are some kind of handwavy thing for nerds

willprice89 3y ago
The very first sentence is horribly written: > Paying at the pump is for chumps - when you can get gas for free - and illegal The whole article may have been generated and then skimmed by the "authors".

shadowgovt 3y ago

They had to change the date on Cyberpunk 2077 because 2020 arrived.

WaitWaitWha 3y ago

My hypothesis is that the construction of gas pumps were using parts that have Bluetooth features that although not used by the pump or the station, are left in for speed and cost. There are many single board computers that have BT, WiFi, and other radios enabled and forgotten. For example, try to get a laptop that does not have a built in camera. It is significantly higher price that with camera. I am guessing similar is happening in gas pump manufacturing. The firmware stack would also fall into the similar 'laziness'. "The [chip/radio/whatever] driving library is already made, why recompile it without the BT when it could be working right now"...

ryandrake 3y ago
Just having an unused radio on the motherboard wouldn't necessarily be a meaningful attack surface. That radio would somehow have have a software path of some sort up the stack into the application business logic that controlled the pump. Unless this was something as basic as a root shell from the BT driver, there must be some participating software in there somewhere.
CyberDildonics 3y ago
similar is happening in gas pump manufacturing. What are you basing that on? why recompile it without the BT when it could be working right now Why would someone recompile anything when they could just turn it off?

1970-01-01 3y ago

Does anyone else think responsible disclosure of the vulnerability would yield less than the theft of gasoline, and that might be the real problem? I hate to say it, but this is a win for both consumers and the thieves. This is old hat hacking mentality. Fix it or deal with it.

BradDavis67 3y ago

[flagged]

ChrisArchitect 3y ago

> "We don't know what kind of device was used, but we know it was an electronic device," --Detroit Police Department spokesperson Any other more stories other than all of these pulling from the Fox 2 news one?

ChrisArchitect 3y ago
Is it something like this manipulation device that fools the "pulser" in the pump to alter the price? Couple reports over last years from Orlando, Texas etc with a cheap homemade device being used... https://www.clickorlando.com/news/local/2022/05/24/gas-pump-manipulators-steal-millions-of-dollars-in-fuel-and-its-legal-in-florida/ https://www.clickorlando.com/news/local/2022/05/24/gas-pump-...

ChumpGPT 3y ago

Probably using a remote. https://levtech.ro/product/universal-service-remote-control-for-fuel-pumps/ https://levtech.ro/product/universal-service-remote-control-... There is also this... https://youtu.be/Bcnjp2PESqw?si=jS3QqPWw2mboWOkS https://youtu.be/Bcnjp2PESqw?si=jS3QqPWw2mboWOkS

kleiba 3y ago

> "I wish it would go back to $1.99 - it’s almost $4," said Tywanna Coleman. Yeah, and it's > $7.50 in the country I currently live in. So count yourself lucky if you live in Detroit.

TheBigSalad 3y ago
Everyone thinks the lowest price in the past 10 years is the "normal" price.
- vGPU 3y ago
  The price of gas was <$3/gal 2015-2020. It WAS the normal price. Now, what happened in 2021 that sent inflation skyrocketing? I wonder. https://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=pet&s=emm_epm0_pte_nus_dpg&f=a https://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=pet&s=e...
  - vGPU 3y ago
    Source: https://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=pet&s=emm_epm0_pte_nus_dpg&f=a https://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=pet&s=e...

callalex 3y ago

Good for them, we already paid for the gas through corrupt subsidies anyway.

phkahler 3y ago

Is this possibly an exploit of a card skimmer installed in the pump? There's an article on sparkfun about REing some skimmers: https://learn.sparkfun.com/tutorials/gas-pump-skimmers/all https://learn.sparkfun.com/tutorials/gas-pump-skimmers/all Maybe another option is to use bluetooth to replay someone else's card info into the pump. Extra funny if the one exploiting the skimmer for gas is completely different from whomever installed it to steal CC numbers!

_trampeltier 3y ago

I'm pretty sure, it is something like the pumps VFD, is a new fancy one with Bluetooth (for easy maintenance) and just the inital password.

jscipione 3y ago

Like gas prices crime is out of control in all major American cities. Vote Republican to solve both problems or vote Democrat to make them worse. The choice is yours, but if you want to see who is responsible, simply look in the mirror.

cm2012 3y ago

Seems like a lot of effort. Thats like $3k retailer, fencing it will be worth less.

everyone 3y ago

Surely they have the license plate # on camera of every vehicle that took petrol without paying? Wont they all just be charged with thievery?

bluGill 3y ago
They paid what they thought was the correct price. Many probably just swiped their card and thought it was a station mistake. Courts might make you pay the legitimate price for the fuel (which an honest person would agree to), but they won't call it steeling/a crime unless they can show you were the one who adjusted the price.

labrador 3y ago

I absolutely hate gas pumps with screens that show advertisements. It seems to me those pumps are internet enabled to get the content for advertisements. If the hacker got into the pump this way I'd say it serves them right.

dools 3y ago

So THAT'S why they all say not to use phones while filling up ...

oniony 3y ago

What the fuck is this article? It's like it's written for two-year-olds.

amatecha 3y ago
hahaha, read this comment before viewing the article, saw the URL is a Fox News domain .. burst out laughing. It basically _was_ written for two-year-olds! Seriously though, the writing is shockingly poor, informal, and reads as if it's some kind of Dr. Seuss book. "And when the clerks inside try to stop it - they can’t." "if they see a big backup at a pump, or someone hanging around a little too long, they’ll call cops to check it out." .. It's like it was run through one of those scripts that changes all words to be within the top 100-200 most commonly-used words in the language. Also, "Some gas station owners are falling victim to a sophisticated scam. " .. It's not a scam. No one is being scammed. Just to clarify further, FOX appears to just be fabricating things, as the Detroit PD don't know the nature of the hack, and did not mention anything about Bluetooth: https://www.detroitnews.com/story/news/local/detroit-city/2023/09/29/police-800-gallons-of-gas-stolen-in-detroit-with-electronic-device/71001909007/ https://www.detroitnews.com/story/news/local/detroit-city/20...

amatecha 3y ago

The source article is so poor it's mind-boggling. Is this the kind of "news" people actually spend their time reading? My IQ has temporarily dropped from subjecting myself to that. There's no substantiation that Bluetooth was used, nor that the perpetrator(s) is/are from Detroit. The most detail I've found, including quote from Detroit PD, is here: https://www.detroitnews.com/story/news/local/detroit-city/2023/09/29/police-800-gallons-of-gas-stolen-in-detroit-with-electronic-device/71001909007/ https://www.detroitnews.com/story/news/local/detroit-city/20... Reading between the lines, it sounds like one person performed the hack, and numerous people then proceeded to fill up for free -- knowingly or otherwise. There's no specific assertion anywhere that one particular individual stole 800 gallons of fuel. Of course that doesn't stop dozens of news sites all over the web from reporting inaccurate "information".

throwaway2037 3y ago
Yet another garbage click-baity article on HN. Look at the news source: Fox News local.

oldbbsnickname 3y ago

"Bluetooth" seems to be the reporter's misnomer for unspecified RF, possibly LoRa, NFC, WiFi, or actual BT. And, more confusingly, they don't actually report if it's a pump implant with RF capabilities or there's a wireless vulnerability in the pump. Most of the time, the pumps are modified in some subtle way. I would suspect a wireless implant. Gas station owners need to apply security seals to their pump's electronic doors and check for sabotage regularly (skimmers, holes, and other damage).

nosmokewhereiam 3y ago

https://m.youtube.com/watch?v=Bcnjp2PESqw https://m.youtube.com/watch?v=Bcnjp2PESqw From a year ago. 2 9v batteries to engage the pump.