7 ms·

Is it actually Bluetooth, or did they get their hands on keys or remotes for the dispenser? The dispensers have constant real-time communication to the forecou

Is it actually Bluetooth, or did they get their hands on keys or remotes for the dispenser? The dispensers have constant real-time communication to the forecourt controller and the attendant inside. What are they showing when this "hack" happens? Are the attackers taking the RS485 line down (which would show the pump offline immediately inside) and forcing the pump to manually dispense? I'd kill to see some more actual information than this. I am not aware of a single pump on the market with Bluetooth right now but I do remember some IR-based remotes for some old Wayne pumps.

Kye 3y ago
I've seen people getting ready for a day of working on yards fill up 30 different things each on multiple trucks. The quantity might not stand out, and the attendant(s) might not be allowed to intervene if they think something looks suspicious. A "better to lose some money than risk losing a longtime customer over a mistake or an attendant getting shot playing hero" policy makes a lot of sense.
- Razengan 3y ago
  > “an attendant getting shot playing hero" policy makes a lot of sense In the post-apocalypse or some other lawless society perhaps
  - 14 3y ago
    Here in British Columbia, Grants law was passed requiring all gas purchases to be prepaid after a gas station worker named Grant was ran over and killed as he tried to stop someone attempting to gas and dash. Back then gas was much cheaper so someone died over like $50. Doesn’t need to be a lawless society just one where someone makes a stupid choice. And we have lots of stupid people out there.
    - StrictDabbler 3y ago
      "The Law was named for Grant De Patie, a gas station worker who was killed in 2005 by an underage drunken driver ... Grant was dragged 7.5 kilometers before his body was dislodged from the white Chrysler LeBaron."
      - cj 3y ago
        "Grant was writing down the license plate number as Darnell ran over him while stealing $12 worth of gasoline." https://en.wikipedia.org/wiki/Grant%27s_Law#:~:text=Grant%20was%20writing%20down%20the%20license%20plate%20number%20as%20Darnell%20ran%20over%20him%20while%20stealing%20%2412%20worth%20of%20gasoline https://en.wikipedia.org/wiki/Grant%27s_Law#:~:text=Grant%20....
  - bumby 3y ago
    You understand you took that quote out of context right? I think the OP meant: >better to lose some money than risk losing a longtime customer...[as a] policy makes a lot of sense
  - tshaddox 3y ago
    I’m not sure what you mean. It sounds like you’re implying that in the ideal lawful society, the gas station clerk is supposed to be the one defending the gas station against theft?
    - sdwr 3y ago
      In an ideal lawful society, a disagreement over gas won't escalate into a violent confrontation. So the attendent can intervene, because they aren't in physical danger.
      - c22 3y ago
        Of course in this sort of society no one is stealing gas in the first place, so the attendant has no reason to intervene.
        tshaddox 3y ago
        Yeah, if we're dismissing the possibility of direct physical violence with the wave of a hand, why not wave the hand a second time and dismiss the possibility of gasoline theft?
        xp84 3y ago
        A robbery there would go something like: (Note: for some reason this seems to work best in a New Zealand accent) “Listen up, sir. I intend to steal the contents of that till. Be a good pal and hand it over.” “I’m afraid not. As you know, I’m duty-bound to protect this till, and I’m not about to hand it over to you.” “I’m afraid I must insist. I intend to take it, all of it. Don’t make this uncomfortable. I don’t want to use harsh language, but I’m serious.” “I’m sorry, but it’s simply out of the question. There’s policies and regulations. I can’t just give this money out to you. If we did that, do you know how many people would be in here robbing us every day? There wouldn’t really be a gas station at all, would there? May as well shut the whole thing down then.” sigh “No, I’m sorry. I should have expected you weren’t about to give me the cash. I’ll leave. Obviously I’m not about to use physical force, and it’s clear you’re not budging on this one.”
    - 3y ago
  - shadowgovt 3y ago
    It's pretty standard policy in most retail places. Stories abound of staff at Walmart and Target being fired for attempting to enforce store shoplifting policies (https://www.ksl.com/article/14319284/4-walmart-employees-fired-after-disarming-gunman-caught-shoplifting https://www.ksl.com/article/14319284/4-walmart-employees-fir...). Broadly speaking, the risk of injury to other employees and customers, the risk of lawsuit if their staff misinterpret the law in the moment and overstep the authority each state gives them (a patchwork of law that stores are not interested in training its staff on), and mostly, the risk of brand harm if these stores gain a reputation for being a place where fights break out between employees and the public, regardless of reason, are far costlier than the opportunity cost of being unable to sell lossage. Instead, companies just track lossage and sales, and if a given neighborhood proves to have too many shoplifters, they pull up stakes and close the store.
    - anonylizard 3y ago
      Its not necessarily good that they just losses happen and close up store. I guess it gives room for small business owners, who are willing to shield themselves behind bullet barriers, willing to defend their own property with guns, and don't care whatsoever about bad PR.
      - c22 3y ago
        I think it has to get really bad before they pull the store (a store takes a lot of money to install). Usually they just offset the losses by raising prices.
        evanmoran 3y ago
        Yes, but it’s 100% that bad and they are closing stores because of it: https://www.kiro7.com/news/local/90-target-workers-be-displaced-when-2-seattle-stores-close-this-month/KEE6RMAPOJBQBIZXBSQCGX4EKY https://www.kiro7.com/news/local/90-target-workers-be-displa...
        qingcharles 3y ago
  - t-3 3y ago
    > In the post-apocalypse or some other lawless society perhaps > Detroit man steals 800 gallons > Detroit Jokes aside, it's common policy pretty much everywhere for cashiers and other employees who are not specifically security personnel to never confront shoplifters or other thieves, always comply with robbers, etc. Insurance covers material losses as long as reasonable precautions are taken.
    - ibejoeb 3y ago
      Detroit has really come up in the past 5 years. I recommend folks visit and check it out. Motor City's downtown actually has decent public transit via bus and light rail, and it's very walkable* during the nice season. Lots of entertainment. * oh but watch out for bird/lime/lyft/uber scooters literally everywhere and everyone's drunk
      - rainclouds 3y ago
        Detroit downtown is nice, the Lions win games, what alternate reality is this?
        red-iron-pine 3y ago
        pendulum swings back it seems
      - henvic 3y ago
        I'm really into driving and all, but I've been in Detroit a year ago and it sucked. The only good thing about it was the Henry Ford Museum and the fact that Canada is just across the border.
        gs17 3y ago
        You probably don't know how it used to be (which is also very different from my grandfather's idea of "how it used to be"). I was there last year, but I was also there for 25 of the past 30 years and the change from when I was a kid is startling. "I recommend folks visit and check it out" is not something someone would have said about Detroit unironically for a long while.
  - iepathos 3y ago
    Or you know... just the united states today. Gas station attendants get shot here without them even trying to play hero. At least a few every year.
    - trimethylpurine 3y ago
      Murder rate in the UK is roughly the same. It's lowest in countries with low immigration rates per capita. Considering the lax immigration process in the US the crime rate is exceptionally low.
      - ed_elliott_asc 3y ago
        Are you sure? I had us murder rate as about 6 per 100k and Uk at 11 per million so much less than us. [1] https://www.macrotrends.net/countries/USA/united-states/murder-homicide-rate#:~:text=U.S.%20murder%2Fhomicide%20rate%20for,a%201.14%25%20increase%20from%202018 https://www.macrotrends.net/countries/USA/united-states/murd.... [2] https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/articles/homicideinenglandandwales/march2022#:~:text=Longer%20term%20trends%20in%20homicide,health%20restrictions%20(Figure%201) https://www.ons.gov.uk/peoplepopulationandcommunity/crimeand....
        trimethylpurine 3y ago
        Yes. It's 1.6/100k vs 6/100k. That's pretty damn close. https://en.m.wikipedia.org/wiki/List_of_countries_by_intentional_homicide_rate https://en.m.wikipedia.org/wiki/List_of_countries_by_intenti... And let's not compare a slice of the US the size of the UK or it will be zero. Maybe the better comparison is US vs EU. Or would that be too unfavorable for your argument?
      - webnrrd2k 3y ago
        your statement that "the murder rate... is lowest in countries with low immigration rates per capita" is largely bullshit. Even the laziest of googling "crime and immigration rates per capita" shows that. At best, the relationship is weak, and not well understood.
  - rmilejczz 3y ago
    Or Florida
  - HumblyTossed 3y ago
    You can't honestly feel the attendant should run out there and try and stop a thief. You just can't.
  - bratgpttamer 3y ago
    This is SOP among most chain stores' loss prevention policies. Sub out "not worth an employees' life" with "not worth an expensive assault/false imprisonment lawsuit" if you're extra cynical.
    - hnburnsy 3y ago
      Maybe fear of litigation from a liability lawsuit if the employee is injured or killed.
- hollander 3y ago
  [flagged]
  - dang 3y ago
    Please don't post nationalistic flamebait. It leads to nationalistic flamewars, which are nasty and avoidable. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- Fatnino 3y ago
  Most pumps I see will only dispense 75 dollars and then cut off. In one case it was 100 and then cut off.
  - tomjakubowski 3y ago
    $75 at California's gas prices right now doesn't go very far!
    - Fatnino 3y ago
      I filled a van with 2 rounds of $75 today. Could have squeezed in a bit more but it was already taking way too long so I left after 2 rounds.
  - voakbasda 3y ago
    This is set by the card issuer. Different cards will have different limits. I have been told that you can call your bank and have them adjust this limit.
    - Fatnino 3y ago
      Same card, different stations, different limits.
  - matt-attack 3y ago
    Yep mine cuts off at $100. Really annoying since I can’t even fill up entirely with that.
mmd45 3y ago
maybe its an nfc hack. pretty scary how wide open it is/was: https://www.youtube.com/watch?v=eV76vObO2IM https://www.youtube.com/watch?v=eV76vObO2IM
jacquesm 3y ago
[flagged]
- lcfcjs 3y ago
  [dead]
- sudofox 3y ago
  Here is some info on this idiom: https://www.onestopenglish.com/your-english/your-english-idioms-kill/555342.article#:~:text=If%20you%20would%20kill%20for,nice%20cold%20drink%20right%20now https://www.onestopenglish.com/your-english/your-english-idi...'. He is not being over the top.
  - dylan604 3y ago
    [flagged]
    - hmmstedaa 3y ago
      [dead]
    - morkalork 3y ago
      This is a weird hill to die on (pun intended!). Idioms and colloquialism are the spice that make language fun and interesting instead of bland and clinical.
- BoxOfRain 3y ago
  If this is a language thing it's a neutral idiom, compare it with 'kill two birds with one stone' for something that deals with multiple issues at once or 'kill some time' to occupy yourself while you wait for something. If I say I'd kill for decent documentation I'm going to be reaching for a text editor rather than a rifle!
obituary_latte 3y ago
In the article one of the attendants says "I hit stop on Pump 3 and nothing happens" so they are at least seeing the pump is on and running. Whatever is happening must be either locking the attendant out or is leaving the attendants machine in a bad state with the pump running switch "on" so to speak. I wonder if it's actually NFC. It'd be interesting to see what a Flipper Zero would come up with.
- yellow_postit 3y ago
  I can imagine a lot of Flipper Zero owners heading out to explore pumps now.
  - deleted 3y ago
    [deleted]
- SoftTalker 3y ago
  Agree, sounds like some kind of poorly-protected function has been discovered that's putting the pump into a "maintenance" or "test" mode where it will dispense fuel without a prepay having been completed.
  - wyldfire 3y ago
    > "Every time we push Pump Three stop, it wasn’t doing anything," he said. "We have to shut off the whole pumps - we have emergency stops." Whew - sanity prevails! When I read the part about not stopping, I was a bit worried that the e-stop somehow was not a simple mechanical failsafe.
Affric 3y ago
If the attack were better understood by people who didn’t perform the hack then it wouldn’t have happened. I don’t think any engineer in the last 20 years would put IR on the thing. At the same time I wonder “who would put Bluetooth on the embedded controller for such a machine?”
- yetanotherloss 3y ago
  With so many multifunction SOC embedded controllers out there it's possible some one just didn't cut the lines to the radio built into the board that was selected for other reasons. Would not surprise me to see a lot of control boards that expected firmware or dip switches to disable unneeded functionality versus having a different line for similar boards if they weren't being made to a specific end customer anyway.
nekoashide 3y ago
Bluetooth controlled? The device sure, for all we know it's just kicking over the dispenser. The clerk isn't looking but I'm sure if they look at the pump on the register it's counting. It's still all serial based comms, but unless the attendant is trained or aware they might just think someone is pumping. It will show up on the daily report when the dispenser report doesn't match the sales report.

Kye 3y ago

I've seen people getting ready for a day of working on yards fill up 30 different things each on multiple trucks. The quantity might not stand out, and the attendant(s) might not be allowed to intervene if they think something looks suspicious. A "better to lose some money than risk losing a longtime customer over a mistake or an attendant getting shot playing hero" policy makes a lot of sense.

Razengan 3y ago
> “an attendant getting shot playing hero" policy makes a lot of sense In the post-apocalypse or some other lawless society perhaps
- 14 3y ago
  Here in British Columbia, Grants law was passed requiring all gas purchases to be prepaid after a gas station worker named Grant was ran over and killed as he tried to stop someone attempting to gas and dash. Back then gas was much cheaper so someone died over like $50. Doesn’t need to be a lawless society just one where someone makes a stupid choice. And we have lots of stupid people out there.
  - StrictDabbler 3y ago
    "The Law was named for Grant De Patie, a gas station worker who was killed in 2005 by an underage drunken driver ... Grant was dragged 7.5 kilometers before his body was dislodged from the white Chrysler LeBaron."
    - cj 3y ago
      "Grant was writing down the license plate number as Darnell ran over him while stealing $12 worth of gasoline." https://en.wikipedia.org/wiki/Grant%27s_Law#:~:text=Grant%20was%20writing%20down%20the%20license%20plate%20number%20as%20Darnell%20ran%20over%20him%20while%20stealing%20%2412%20worth%20of%20gasoline https://en.wikipedia.org/wiki/Grant%27s_Law#:~:text=Grant%20....
- bumby 3y ago
  You understand you took that quote out of context right? I think the OP meant: >better to lose some money than risk losing a longtime customer...[as a] policy makes a lot of sense
- tshaddox 3y ago
  I’m not sure what you mean. It sounds like you’re implying that in the ideal lawful society, the gas station clerk is supposed to be the one defending the gas station against theft?
  - sdwr 3y ago
    In an ideal lawful society, a disagreement over gas won't escalate into a violent confrontation. So the attendent can intervene, because they aren't in physical danger.
    - c22 3y ago
      Of course in this sort of society no one is stealing gas in the first place, so the attendant has no reason to intervene.
      - tshaddox 3y ago
        Yeah, if we're dismissing the possibility of direct physical violence with the wave of a hand, why not wave the hand a second time and dismiss the possibility of gasoline theft?
      - xp84 3y ago
        A robbery there would go something like: (Note: for some reason this seems to work best in a New Zealand accent) “Listen up, sir. I intend to steal the contents of that till. Be a good pal and hand it over.” “I’m afraid not. As you know, I’m duty-bound to protect this till, and I’m not about to hand it over to you.” “I’m afraid I must insist. I intend to take it, all of it. Don’t make this uncomfortable. I don’t want to use harsh language, but I’m serious.” “I’m sorry, but it’s simply out of the question. There’s policies and regulations. I can’t just give this money out to you. If we did that, do you know how many people would be in here robbing us every day? There wouldn’t really be a gas station at all, would there? May as well shut the whole thing down then.” sigh “No, I’m sorry. I should have expected you weren’t about to give me the cash. I’ll leave. Obviously I’m not about to use physical force, and it’s clear you’re not budging on this one.”
  - 3y ago
- shadowgovt 3y ago
  It's pretty standard policy in most retail places. Stories abound of staff at Walmart and Target being fired for attempting to enforce store shoplifting policies (https://www.ksl.com/article/14319284/4-walmart-employees-fired-after-disarming-gunman-caught-shoplifting https://www.ksl.com/article/14319284/4-walmart-employees-fir...). Broadly speaking, the risk of injury to other employees and customers, the risk of lawsuit if their staff misinterpret the law in the moment and overstep the authority each state gives them (a patchwork of law that stores are not interested in training its staff on), and mostly, the risk of brand harm if these stores gain a reputation for being a place where fights break out between employees and the public, regardless of reason, are far costlier than the opportunity cost of being unable to sell lossage. Instead, companies just track lossage and sales, and if a given neighborhood proves to have too many shoplifters, they pull up stakes and close the store.
  - anonylizard 3y ago
    Its not necessarily good that they just losses happen and close up store. I guess it gives room for small business owners, who are willing to shield themselves behind bullet barriers, willing to defend their own property with guns, and don't care whatsoever about bad PR.
    - c22 3y ago
      I think it has to get really bad before they pull the store (a store takes a lot of money to install). Usually they just offset the losses by raising prices.
      - evanmoran 3y ago
        Yes, but it’s 100% that bad and they are closing stores because of it: https://www.kiro7.com/news/local/90-target-workers-be-displaced-when-2-seattle-stores-close-this-month/KEE6RMAPOJBQBIZXBSQCGX4EKY https://www.kiro7.com/news/local/90-target-workers-be-displa...
        qingcharles 3y ago
- t-3 3y ago
  > In the post-apocalypse or some other lawless society perhaps > Detroit man steals 800 gallons > Detroit Jokes aside, it's common policy pretty much everywhere for cashiers and other employees who are not specifically security personnel to never confront shoplifters or other thieves, always comply with robbers, etc. Insurance covers material losses as long as reasonable precautions are taken.
  - ibejoeb 3y ago
    Detroit has really come up in the past 5 years. I recommend folks visit and check it out. Motor City's downtown actually has decent public transit via bus and light rail, and it's very walkable* during the nice season. Lots of entertainment. * oh but watch out for bird/lime/lyft/uber scooters literally everywhere and everyone's drunk
    - rainclouds 3y ago
      Detroit downtown is nice, the Lions win games, what alternate reality is this?
      - red-iron-pine 3y ago
        pendulum swings back it seems
    - henvic 3y ago
      I'm really into driving and all, but I've been in Detroit a year ago and it sucked. The only good thing about it was the Henry Ford Museum and the fact that Canada is just across the border.
      - gs17 3y ago
        You probably don't know how it used to be (which is also very different from my grandfather's idea of "how it used to be"). I was there last year, but I was also there for 25 of the past 30 years and the change from when I was a kid is startling. "I recommend folks visit and check it out" is not something someone would have said about Detroit unironically for a long while.
- iepathos 3y ago
  Or you know... just the united states today. Gas station attendants get shot here without them even trying to play hero. At least a few every year.
  - trimethylpurine 3y ago
    Murder rate in the UK is roughly the same. It's lowest in countries with low immigration rates per capita. Considering the lax immigration process in the US the crime rate is exceptionally low.
    - ed_elliott_asc 3y ago
      Are you sure? I had us murder rate as about 6 per 100k and Uk at 11 per million so much less than us. [1] https://www.macrotrends.net/countries/USA/united-states/murder-homicide-rate#:~:text=U.S.%20murder%2Fhomicide%20rate%20for,a%201.14%25%20increase%20from%202018 https://www.macrotrends.net/countries/USA/united-states/murd.... [2] https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/articles/homicideinenglandandwales/march2022#:~:text=Longer%20term%20trends%20in%20homicide,health%20restrictions%20(Figure%201) https://www.ons.gov.uk/peoplepopulationandcommunity/crimeand....
      - trimethylpurine 3y ago
        Yes. It's 1.6/100k vs 6/100k. That's pretty damn close. https://en.m.wikipedia.org/wiki/List_of_countries_by_intentional_homicide_rate https://en.m.wikipedia.org/wiki/List_of_countries_by_intenti... And let's not compare a slice of the US the size of the UK or it will be zero. Maybe the better comparison is US vs EU. Or would that be too unfavorable for your argument?
    - webnrrd2k 3y ago
      your statement that "the murder rate... is lowest in countries with low immigration rates per capita" is largely bullshit. Even the laziest of googling "crime and immigration rates per capita" shows that. At best, the relationship is weak, and not well understood.
- rmilejczz 3y ago
  Or Florida
- HumblyTossed 3y ago
  You can't honestly feel the attendant should run out there and try and stop a thief. You just can't.
- bratgpttamer 3y ago
  This is SOP among most chain stores' loss prevention policies. Sub out "not worth an employees' life" with "not worth an expensive assault/false imprisonment lawsuit" if you're extra cynical.
  - hnburnsy 3y ago
    Maybe fear of litigation from a liability lawsuit if the employee is injured or killed.
hollander 3y ago
[flagged]
- dang 3y ago
  Please don't post nationalistic flamebait. It leads to nationalistic flamewars, which are nasty and avoidable. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
Fatnino 3y ago
Most pumps I see will only dispense 75 dollars and then cut off. In one case it was 100 and then cut off.
- tomjakubowski 3y ago
  $75 at California's gas prices right now doesn't go very far!
  - Fatnino 3y ago
    I filled a van with 2 rounds of $75 today. Could have squeezed in a bit more but it was already taking way too long so I left after 2 rounds.
- voakbasda 3y ago
  This is set by the card issuer. Different cards will have different limits. I have been told that you can call your bank and have them adjust this limit.
  - Fatnino 3y ago
    Same card, different stations, different limits.
- matt-attack 3y ago
  Yep mine cuts off at $100. Really annoying since I can’t even fill up entirely with that.

mmd45 3y ago

maybe its an nfc hack. pretty scary how wide open it is/was: https://www.youtube.com/watch?v=eV76vObO2IM https://www.youtube.com/watch?v=eV76vObO2IM

jacquesm 3y ago

[flagged]

lcfcjs 3y ago
[dead]
sudofox 3y ago
Here is some info on this idiom: https://www.onestopenglish.com/your-english/your-english-idioms-kill/555342.article#:~:text=If%20you%20would%20kill%20for,nice%20cold%20drink%20right%20now https://www.onestopenglish.com/your-english/your-english-idi...'. He is not being over the top.
- dylan604 3y ago
  [flagged]
  - hmmstedaa 3y ago
    [dead]
  - morkalork 3y ago
    This is a weird hill to die on (pun intended!). Idioms and colloquialism are the spice that make language fun and interesting instead of bland and clinical.
BoxOfRain 3y ago
If this is a language thing it's a neutral idiom, compare it with 'kill two birds with one stone' for something that deals with multiple issues at once or 'kill some time' to occupy yourself while you wait for something. If I say I'd kill for decent documentation I'm going to be reaching for a text editor rather than a rifle!

obituary_latte 3y ago

In the article one of the attendants says "I hit stop on Pump 3 and nothing happens" so they are at least seeing the pump is on and running. Whatever is happening must be either locking the attendant out or is leaving the attendants machine in a bad state with the pump running switch "on" so to speak. I wonder if it's actually NFC. It'd be interesting to see what a Flipper Zero would come up with.

yellow_postit 3y ago
I can imagine a lot of Flipper Zero owners heading out to explore pumps now.
- deleted 3y ago
  [deleted]
SoftTalker 3y ago
Agree, sounds like some kind of poorly-protected function has been discovered that's putting the pump into a "maintenance" or "test" mode where it will dispense fuel without a prepay having been completed.
- wyldfire 3y ago
  > "Every time we push Pump Three stop, it wasn’t doing anything," he said. "We have to shut off the whole pumps - we have emergency stops." Whew - sanity prevails! When I read the part about not stopping, I was a bit worried that the e-stop somehow was not a simple mechanical failsafe.

Affric 3y ago

If the attack were better understood by people who didn’t perform the hack then it wouldn’t have happened. I don’t think any engineer in the last 20 years would put IR on the thing. At the same time I wonder “who would put Bluetooth on the embedded controller for such a machine?”

yetanotherloss 3y ago
With so many multifunction SOC embedded controllers out there it's possible some one just didn't cut the lines to the radio built into the board that was selected for other reasons. Would not surprise me to see a lot of control boards that expected firmware or dip switches to disable unneeded functionality versus having a different line for similar boards if they weren't being made to a specific end customer anyway.

nekoashide 3y ago

Bluetooth controlled? The device sure, for all we know it's just kicking over the dispenser. The clerk isn't looking but I'm sure if they look at the pump on the register it's counting. It's still all serial based comms, but unless the attendant is trained or aware they might just think someone is pumping. It will show up on the daily report when the dispenser report doesn't match the sales report.