Cloud

5/29/2018
10:41 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Over 5K Gas Station Tank Gauges Sit Exposed on the Public Net

One gas station failed its PCI compliance test due to security holes in its automated gas tank gauge configuration, researcher says.

It's been three years since researchers first discovered automated tank gauges (ATGs) at some 5,000 US gas stations exposed on the public Internet without password protection, and a recent scan found 5,635 locations were vulnerable to the same issue.

The 2015 finding led by HD Moore, then the chief research officer at Rapid7, scanned for devices with TCP port 10001 open on the Internet. Jack Chadowitz, president and CEO of BostonBase, a fuel industry technology firm, says he not only found the overwhelming number of ATG systems vulnerable to the initial flaw, but also stumbled upon another vulnerability in the Vedeer-Root TLS450 tank gauges that may have led to a New Bedford, N.H., gas station failing its PCI DSS compliance audit.

Chadowitz says the exposed gas stations' tank gauge data can be accessed by attackers as well as manipulated for fuel theft or other sabotage. When he contacted the owner of the New Hampshire gas station this spring to alert him about the exposed ATG, the owner – who had deployed password protection with his Vedeer-Root application - noted that he had recently failed his PCI test. The station was running an older version of OpenSSH 7.0 on port 22, which apparently had been set up for remote access by its third-party supplier of the ATG system for maintenance purposes.

According to BostonBase, the open port and dated version of OpenSSH used in the ATG system led to the failed PCI compliance test. "A lot of [smaller] gas stations don't do PCI testing … but that this one did is one of the reasons why I happened to come across this vulnerability. It's probably very rare, this combination of Vedeer with OpenSSH 7.0 and having the port opened," Chadowitz says.

Vedeer-Root maintains that the issue raised by Chadowitz would be nonexistent if users properly configure the devices with strong passwords and place them behind a firewall. "Users need to maintain proper network safeguards, as they would for any other Internet-connected device in order to prevent outside traffic. This includes the use of firewalls and strong passwords," says Alan English, director of brand development for Vedeer-Root.

These security issues surrounding ATGs is yet another example of security challenges with industrial Internet of Things devices. In the Vedeer-Root case, it also underscores the challenges of getting third-party suppliers on board security-wise, especially on behalf of smaller businesses like local gas stations.

ATGs provide gasoline inventory and protect groundwater from gasoline leaks, notes Chadowitz. "Anyone can go in and mess with a tank gauge" that's exposed online by altering the parameters for a high-water alarm, for example.  "How can you trust it?"

Trend Micro also conducted its own gas tank research in 2015, and found examples of hackers messing with the devices, specifically the Guardian AST gas tank monitoring systems in several locations across the US. The Trend researchers reported finding an Internet-facing tank monitoring system at a gas station in Holden, Maine, renamed "We_Are_Legion" from "Diesel," suggesting either the handiwork of Anonymous or another attacker using the group's slogan.

Mark Nunnikhoven, vice president of cloud research for Trend Micro, says the biggest threats to vulnerable ATGs today is to the gas station's business. "The most concerning is someone using manipulation of them to get free fuel, or to change gas readings, hitting the core of their [the station's] business," he says. "A director motivator is profit there, and that's the most likely scenario."

But Chadowitz says attacks could be more nefarious and destructive, causing chaos by adjusting fuel levels to appear empty at multiple stations, for example. "If they want to shut down a bunch of them, that would really cause havoc."

He recommends firewall routers in front of the ATG systems be configured with Access Control Lists (ACLs) that only allow specific IP addresses access to them, for example. "You could also put in a VPN," he says.

Gas station owners can check for the 2015 vulnerability in their ATGs on his firm's test website, kachoolie.com.

Related Content

 

 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
6/26/2018 | 6:27:03 PM
Re: hi
What's even harder, as shown in this case, is industrial equipment that wasn't necessarily built or thought of with security in mind. Many of these smaller businesses don't realize how they could be exposed via the Net.
PaulChau
50%
50%
PaulChau,
User Rank: Apprentice
6/25/2018 | 9:36:10 PM
hi
People are only now starting to realise what is happening when they are not able to secure and protect their company data and information properly. If it isn't enough that personal information of their customers are compromised then perhaps telling them that their company secrets would be leaked might help? It certainly seems that many of them aren't bothered that terrorists could swoop in on all of these supplies as it is!
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
2019 Attacker Playbook
Ericka Chickowski, Contributing Writer, Dark Reading,  12/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
[Sponsored Content] The State of Encryption and How to Improve It
[Sponsored Content] The State of Encryption and How to Improve It
Encryption and access controls are considered to be the ultimate safeguards to ensure the security and confidentiality of data, which is why they're mandated in so many compliance and regulatory standards. While the cybersecurity market boasts a wide variety of encryption technologies, many data breaches reveal that sensitive and personal data has often been left unencrypted and, therefore, vulnerable.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-1265
PUBLISHED: 2018-12-17
IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 does not validate, or incorrectly validates, a certificate. This weakness might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) techniques. IBM X-Force ID: 124740.
CVE-2017-1272
PUBLISHED: 2018-12-17
IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 124747. IBM X-Force ID: 124747.
CVE-2017-1597
PUBLISHED: 2018-12-17
IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132610.
CVE-2018-1889
PUBLISHED: 2018-12-17
IBM Security Guardium 10.0 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152080.
CVE-2018-1891
PUBLISHED: 2018-12-17
IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152082.