Gas Stations In the Bullseye

White hats at Black Hat USA will release free honeypot tool for monitoring attacks against gas tank monitoring systems.

Researchers who earlier this year spotted potential hacktivist activity against popular gas tank monitoring systems at US gas stations say theyve been studying some real-world attacks on these systems as well as on their own honeypot set up to study and gather intelligence on the attackers and their intentions.
Kyle Wilhoit and Stephen Hilt, both with Trend Micro, at
the Black Hat USA conference in early August
plan to release a free tool called Gaspot, which allows researchers as well as gas tank operators to set up their own virtual monitoring systems to track attack attempts and threats.
Although the pair of researchers wont divulge all of their newest findings on attacks and attackers until their August presentation at Black Hat, they say they have confirmed attacks on the Guardian AST gas tank monitoring systems in several locations across the US, and found a number of these systems wide open to attack via the public Internet, vulnerable to manipulation and sabotage.
In February, they reported
finding one such Internet-facing tank monitoring system at a gas station in Holden, Maine, renamed We_Are_Legion from Diesel, suggesting either the handiwork of Anonymous or another attacker using the groups slogan.
Wilhoit and Hilts research follows that of Rapid7 chief research officer HD Moore, who
in January revealed his findings of some 5,800 Vedeer-Root automated tank gauges
, which monitor for fuel leaks and other problems with the tanks as well as fuel levels,
found sitting wide open on the Internet without password protection,
leaving more than 5,000 gas stations in the US vulnerable to attackers who could remotely alter the alarm thresholds to simulate a leak, disrupt the fuel tank operations, and worst-case, wreak havoc by shutting down the gas stations altogether, researchers say.
Moore had gotten a heads up from Jack Chadowitz, president and CEO of Kachoolie and BostonBase Inc., who first detected the problem. Rapid7s Moore then conducted an Internet scan of devices with TCP port 10001 open to the public Internet, and reported his findings publicly.
The Trend Micro researchers found similar issues with the Guardian AST, which is also sold by Vedeer-Root. The Guardian AST also provides inventory tracking of above-grand gas storage tanks, and according to Wilhoit, comes with more communications protocols -- including an RS-232 port -- than the Vedeer-Root fuel tank devices studied by Moore. The Guardian devices also are widely used on generators, Wilhoit notes.
After we saw the possible Anonymous attack [on the systems], we thought there was probably more here, Wilhoit says.
Wilhoit says he and Hilt saw a number of systems at US gas stations being attacked, as well as some overseas. The large majority were distributed throughout the US, he says.
While he wouldnt yet reveal the types of attacks, he says the types of attacks were across the board. The obvious concerns were about nation-state attackers, he says.
The Gaspot tool will allow researchers and organizations to basically deploy a script that gives them insight into whether their system is being targeted by attackers. It will allow them to assess if attackers are interested in their environment, Wilhoit says.
The vulnerable systems identified previously by Moore were only found in independent, small gas station dealer sites. Large chains affiliated with big-name petroleum companies generally arent vulnerable to the public-facing Net attacks because theyre secured via corporate networks, according to Kachoolie and BostonBases Chadowitz, whose company provides monitoring services for gas stations and other businesses. There are only so many Guardian AST systems out there, he says.
The attacks Chadowitz has seen mostly have been things like changing the products name. Thats very simple to do. I havent seen any intelligent hack yet, he says. Their understanding is very primitive now of these monitoring systems, he says of the attacks thus far.
Moore told Dark Reading earlier this year that the Vedeer-Root gas tank monitoring vulnerability issue stemmed from tank gauge vendors not instituting security by default -- namely a VPN gateway-based connection to the devices and authentication.
Vedeer-Root, which in response to Moores research in January alerted its customers about deploying security features in the product, had not yet responded to a press inquiry about the latest research as of this posting.

Last News
▸ Veritabile Defecte de Proiectare a Securitatii in Software -> Top 10 Software Security Design Flaws ◂ Discovered: 23/12/2024 Category: security	▸ Sony, XBox Targeted by DDoS Attacks, Hacktivist Threats ◂ Discovered: 23/12/2024 Category: security	▸ There are plenty of online tools for reporting bugs. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Gas Stations In the Bullseye