4 ms·

The article seems a little light on details. I don't expect them to explain exactly how it works, but is this a bug/feature in the pump design? If you can just

The article seems a little light on details. I don't expect them to explain exactly how it works, but is this a bug/feature in the pump design? If you can just roll up to the pump and communicate with it over Bluetooth, then I'd argue that it's a design flaw and the manufacturer should be held accountable as this seems like a gross laps in security.

ohduran 3y ago
yeah, I opened it just in case they explained how it's done. For research purposes of course.
bgroins 3y ago
The article is poorly written. "Scammers are using cellphone's Bluetooth option to hack the pump - and get it for free." is all the detail you get. My cellphone's Bluetooth doesn't have that option.
- dylan604 3y ago
  You have to enable the DevTools, but that requires a $99 annual fee. If you can't afford gas, it's not likely you can afford that fee too. So it's kind of a perfect catch-22
  - monkpit 3y ago
    If you steal gas you can afford lots of things, so this logic doesn’t really track. Also, you assume that someone wouldn’t just sell the gas they stole, which is probably very much worth the small investment in tools.
    - adolph 3y ago
      It's better to just return it to a different gas station. Selling gas is more difficult than you might think because of rampant dilution/adulteration in the secondary market. Can't just go door to door saying "Hey I bought too much gas" or "My car only takes 93 octane" -- nobody trusts anyone anymore. When you make a return without a receipt you generally just get store credit instead of cash. If you don't need some chips and tallboys, you can typically sell the credit to someone behind the station for .3 to .4 of the face value. That isn't great but since the gaming machines only take cash its a solid way to get liquid.
      - thatguy0900 3y ago
        How could you return gas to a gas station? Why/how would they take it back, especially with no receipt?
        adolph 3y ago
        Just act normal and ask for the manager. Like the parent comment noted "probably very much worth the small investment in tools." Be sure to get one of the fancy black rubber hoses instead of the green ones so things look more professional.
  - extraduder_ire 3y ago
    Why would you have to enable devtools? Also, with just an unpaid icloud account, you can build, sign, and install apps to devices with an expiry time of one week.
- spelunker 3y ago
  iPhone 15 feature obviously, time to upgrade!
- pineconewarrior 3y ago
  It's a local news piece so it's not meant for a technical audience. That's why they lead with the typical "random bystander" quotation.
- extraduder_ire 3y ago
  If you're on android, there's a bunch of bluetooth-serial apps that let you send more or less whatever raw data you want. On iOS, there's nrf connect. Which is slightly more limited, but can still do BLE. I think there's other bluetooth-serial apps for iphones, but apple has a stick up their butt about bluetooth-classic not working super good unless the other device has a "made for i" chip/cert in it. If either of these don't work well enough, ESP32s can be had for <$5 and can act as a bridge between your device and whatever you want to exploit.
  - user_7832 3y ago
    > On iOS, there's nrf connect. Which is slightly more limited, but can still do BLE. I think there's other bluetooth-serial apps for iphones, but apple has a stick up their butt about bluetooth-classic not working super good unless the other device has a "made for i" chip/cert in it. Is BLE why "modern" iphones don't have issues with android/3rd party devices/accessories? I remember a long time ago when an iPhone meant you could only share bluetooth with other Apple devices. My iPhone today doesn't seem to be like that.
    - extraduder_ire 3y ago
      Kinda. From reading the docs, apple really didn't want the battery drain and software jank that came with classic bluetooth. Pretty sure bluetooth audio has been exempt most of the time though.
      - user_7832 3y ago
        Thanks!
- jiscariot 3y ago
  This sentence doesn't know if it's in the local paper or at a slam poetry reading: "Paying at the pump is for chumps - when you can get gas for free - and illegal, but it didn’t stop a Detroit man from stealing almost 800 gallons of gas at the Shell at Eight Mile and Wyoming."
  - jacamera 3y ago
    I felt like I was having a stroke multiple times while trying to get through this article.
Antipode 3y ago
Yes it's a clear design flaw but it's still theft. It's not like you're legally allowed to rob a store if the front door lock isn't installed properly and doesn't work.
- theultdev 3y ago
  No we punish the companies now, not the thieves, see Kia and Hyundai.
  - tnel77 3y ago
    Why not both? People shouldn’t steal cars and companies should probably be held accountable for gross negligence.
  - mrweasel 3y ago
    I think the point of the Kia and Hyundai cases is that customers had some expectation that the locks would actually provide a higher level of security than they actually did. Otherwise why even bother having locks? Saying that "stealing is illegal and we should pushing the thieves not the companies for failing to provide security" completely negates the point of having any security industry. If you provide a product that is intended to offer a certain level of security you should get punished when your product fails in a spectacular manor.
    - vuln 3y ago
      Glass breaks very easily. Locks don’t matter.
      - callalex 3y ago
        You can start a car by breaking glass? That’s even more impressive than the hack in the article!
        vuln 3y ago
        Is an ignition a lock? How about the wiring to the ignition…? It would be one thing if Kia and Hyundai advertised “anti theft” via an immobilizer then didn’t actually put one in. They just left it out because the company is being cheap. The cars being sold with this vuln are cheap. You get what you pay for.
nekoashide 3y ago
The pump itself is the least secure piece of technology in existence. They keys to open them are common, the communication is all serial based and hasn't changed at all in 40+ years. It wasn't more than a decade ago that I was swapping 3des pinpads out. If you had really old pump all you needed was a small screw driver to stop the meters from turning after you popped the front panel off.
JudasGoat 3y ago
https://www.directindustry.com/prod/levtech-service-production-srl/product-235457-2370555.html https://www.directindustry.com/prod/levtech-service-producti...

ohduran 3y ago

yeah, I opened it just in case they explained how it's done. For research purposes of course.

bgroins 3y ago

The article is poorly written. "Scammers are using cellphone's Bluetooth option to hack the pump - and get it for free." is all the detail you get. My cellphone's Bluetooth doesn't have that option.

dylan604 3y ago
You have to enable the DevTools, but that requires a $99 annual fee. If you can't afford gas, it's not likely you can afford that fee too. So it's kind of a perfect catch-22
- monkpit 3y ago
  If you steal gas you can afford lots of things, so this logic doesn’t really track. Also, you assume that someone wouldn’t just sell the gas they stole, which is probably very much worth the small investment in tools.
  - adolph 3y ago
    It's better to just return it to a different gas station. Selling gas is more difficult than you might think because of rampant dilution/adulteration in the secondary market. Can't just go door to door saying "Hey I bought too much gas" or "My car only takes 93 octane" -- nobody trusts anyone anymore. When you make a return without a receipt you generally just get store credit instead of cash. If you don't need some chips and tallboys, you can typically sell the credit to someone behind the station for .3 to .4 of the face value. That isn't great but since the gaming machines only take cash its a solid way to get liquid.
    - thatguy0900 3y ago
      How could you return gas to a gas station? Why/how would they take it back, especially with no receipt?
      - adolph 3y ago
        Just act normal and ask for the manager. Like the parent comment noted "probably very much worth the small investment in tools." Be sure to get one of the fancy black rubber hoses instead of the green ones so things look more professional.
- extraduder_ire 3y ago
  Why would you have to enable devtools? Also, with just an unpaid icloud account, you can build, sign, and install apps to devices with an expiry time of one week.
spelunker 3y ago
iPhone 15 feature obviously, time to upgrade!
pineconewarrior 3y ago
It's a local news piece so it's not meant for a technical audience. That's why they lead with the typical "random bystander" quotation.
extraduder_ire 3y ago
If you're on android, there's a bunch of bluetooth-serial apps that let you send more or less whatever raw data you want. On iOS, there's nrf connect. Which is slightly more limited, but can still do BLE. I think there's other bluetooth-serial apps for iphones, but apple has a stick up their butt about bluetooth-classic not working super good unless the other device has a "made for i" chip/cert in it. If either of these don't work well enough, ESP32s can be had for <$5 and can act as a bridge between your device and whatever you want to exploit.
- user_7832 3y ago
  > On iOS, there's nrf connect. Which is slightly more limited, but can still do BLE. I think there's other bluetooth-serial apps for iphones, but apple has a stick up their butt about bluetooth-classic not working super good unless the other device has a "made for i" chip/cert in it. Is BLE why "modern" iphones don't have issues with android/3rd party devices/accessories? I remember a long time ago when an iPhone meant you could only share bluetooth with other Apple devices. My iPhone today doesn't seem to be like that.
  - extraduder_ire 3y ago
    Kinda. From reading the docs, apple really didn't want the battery drain and software jank that came with classic bluetooth. Pretty sure bluetooth audio has been exempt most of the time though.
    - user_7832 3y ago
      Thanks!
jiscariot 3y ago
This sentence doesn't know if it's in the local paper or at a slam poetry reading: "Paying at the pump is for chumps - when you can get gas for free - and illegal, but it didn’t stop a Detroit man from stealing almost 800 gallons of gas at the Shell at Eight Mile and Wyoming."
- jacamera 3y ago
  I felt like I was having a stroke multiple times while trying to get through this article.

Antipode 3y ago

Yes it's a clear design flaw but it's still theft. It's not like you're legally allowed to rob a store if the front door lock isn't installed properly and doesn't work.

theultdev 3y ago
No we punish the companies now, not the thieves, see Kia and Hyundai.
- tnel77 3y ago
  Why not both? People shouldn’t steal cars and companies should probably be held accountable for gross negligence.
- mrweasel 3y ago
  I think the point of the Kia and Hyundai cases is that customers had some expectation that the locks would actually provide a higher level of security than they actually did. Otherwise why even bother having locks? Saying that "stealing is illegal and we should pushing the thieves not the companies for failing to provide security" completely negates the point of having any security industry. If you provide a product that is intended to offer a certain level of security you should get punished when your product fails in a spectacular manor.
  - vuln 3y ago
    Glass breaks very easily. Locks don’t matter.
    - callalex 3y ago
      You can start a car by breaking glass? That’s even more impressive than the hack in the article!
      - vuln 3y ago
        Is an ignition a lock? How about the wiring to the ignition…? It would be one thing if Kia and Hyundai advertised “anti theft” via an immobilizer then didn’t actually put one in. They just left it out because the company is being cheap. The cars being sold with this vuln are cheap. You get what you pay for.

nekoashide 3y ago

The pump itself is the least secure piece of technology in existence. They keys to open them are common, the communication is all serial based and hasn't changed at all in 40+ years. It wasn't more than a decade ago that I was swapping 3des pinpads out. If you had really old pump all you needed was a small screw driver to stop the meters from turning after you popped the front panel off.

JudasGoat 3y ago

https://www.directindustry.com/prod/levtech-service-production-srl/product-235457-2370555.html https://www.directindustry.com/prod/levtech-service-producti...