Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security IT

Hackers Stole 600 Gallons of Gas From Detroit Gas Station, Report Says (gizmodo.com) 263

Posted by msmash from the making-a-living dept.
Police in Detroit are looking for two suspects who allegedly managed to hack a gas pump and steal over 600 gallons of gasoline, valued at about $1,800. From a report: The theft took place in the middle of the day and went on for about 90 minutes, with the gas station attendant unable to thwart the hackers. The theft, reported by Fox 2 Detroit, took place at around 1pm local time on June 23 at a Marathon gas station located about 15 minutes from downtown Detroit. At least 10 cars are believed to have benefitted from the free-flowing gas pump, which still has police befuddled. Here's what is known about the supposed hack: Per Fox 2 Detroit, the thieves used some sort of remote device that allowed them to hijack the pump and take control away from the gas station employee. Police confirmed to the local publication that the device prevented the clerk from using the gas station's system to shut off the individual pump.
This discussion has been archived. No new comments can be posted.

Hackers Stole 600 Gallons of Gas From Detroit Gas Station, Report Says More

Hackers Stole 600 Gallons of Gas From Detroit Gas Station, Report Says

Comments Filter:

  • Manual Shut Off? (Score:5, Interesting)

    by Drethon ( 1445051 ) on Sunday July 08, 2018 @05:54PM (#56913446)

    Seriously, I'm not big on the whole let the computer handle everything on important things, particularly something that is potentially safety critical. Manual shut off valves aren't hard.

    • Shut down the full station just to fix one bad pump? Maybe the clerk did not know how to full reboot

      • Re:Manual Shut Off? (Score:5, Insightful)

        by gnick ( 1211984 ) on Sunday July 08, 2018 @06:56PM (#56913696) Homepage

        Shut down the full station just to fix one bad pump?

        Yes! If the other option is to let gas free-flow for 90-minutes, then shut down the whole station. Of course! You think the gas station made $1,800 profit on the functioning pumps during that 90-minutes?

        • Iâ(TM)m sure he could have walked out with a plastic bag to cover the nossle or a piece of paper taped to the screen saying âoeout of serviceâ well before 90 minutes lapsed. As one person pulls away, be ready. Surely theyâ(TM)d done this sort of thing in the past when a pump was malfunctioning (like this time).

        • Emergency shutoffs are for fires and when cars crash into pumps. They are not there to stop a theft.

          • Re: Manual Shut Off? (Score:5, Insightful)

            by demonlapin ( 527802 ) on Sunday July 08, 2018 @09:20PM (#56914218) Homepage Journal
            The master on/off switch for my power to my house isn't there to stop a live wire thrown into a bathtub, but if if I had a toaster in the tub, that's the one I'd be using.
        • It depends on how busy they are and how many pumps they have. If it takes three minutes to fill a tank with 20 gallons, the store has 15 other pumps in constant use, and they make $0.20/gallon, that works out to $1800 in profit.

          There are other things to consider, though. One is that fuel is not where the profit is - it's inside sales. If customers pull up and see the pumps aren't working, they're going to go elsewhere for their fuel and, more importantly, for their high margin inside purchases like ci

      • Re:Manual Shut Off? (Score:5, Informative)

        by hawguy ( 1600213 ) on Sunday July 08, 2018 @08:19PM (#56913992)

        Shut down the full station just to fix one bad pump? Maybe the clerk did not know how to full reboot

        When I worked at a gas station, I knew where the breaker panel was and we had separate breakers for each pump.

        So, the easy solution would have been to just power off the hacked pump.

        • Shut down the full station just to fix one bad pump? Maybe the clerk did not know how to full reboot

          When I worked at a gas station, I knew where the breaker panel was and we had separate breakers for each pump.

          So, the easy solution would have been to just power off the hacked pump.

          This, exactly! I don't care what system gets hacked on the internet, turn the power off with a physical switch and there is absolutely nothing the internet can do.

      • He (she? it?) doesn't need to know how to reboot the system.

        The yellow out of order bag that goes over the nozzle would of sufficed, with the added benefit as pointed out above of identifying anyone actively involved who bypasses the bag and pumps anyway.

      • Re: (Score:2)

        by twdorris ( 29395 )

        Shut down the full station just to fix one bad pump?

        Even if you don't feel that was appropriate in this particular situation (although as others have posted already, it seems pretty reasonable even here), the option to manually shut off everything has to be available regardless and I'm pretty sure it is by requirement for instances where a single pump catches fire!

        And let's take this hack a step further into terrorist land where you could easily picture a scenario where someone might shutdown electronic control over the pumps and start setting everything abl

    • Re:Manual Shut Off? (Score:5, Interesting)

      by Darinbob ( 1142669 ) on Sunday July 08, 2018 @06:37PM (#56913628)

      Or call the police. It shouldn't have taken 90 minutes for police to show up.

      • The cops might show up to take a report on Tuesday. Or not.

        Cops mostly take reports of crimes. Occasionally, they accidentally catch a criminal. Very rarely do they stop a crime in progress.

      • When living in Santa Fe, New Mexico, I called the police about multiple break-ins at a place I was renting. I had nothing worth stealing, but the guy that lived in the connected apartment from mine did. The shortest time it took the cops to get there was 45 minutes. The longest time I stopped counting after 3 hours. My house was broken into 3+ times, and I didn't really care since the rent was cheap, and if any of the little punks tried it when I was around someone would have been calling a coroner instead

        • Except this was an ongoing crime. If they police had shown up they could have made easy arrests, boosting their quotas, looking good to the citizens, etc.

          • I can tell, you've not called the police have you?

            I called 911 once because the car I was driving burst into flames in the middle of a major city and almost within visual distance of the fire station. It took almost 10 min for the police to arrive and another 10 for the fire department. For 20 min, the car burned. I'm guessing this was faster than normal because the car was blocking the major east/west road though town.

            In another instance, there was an automobile accident in the middle of a major city

            • Re: (Score:2)

              by Pascoea ( 968200 )
              Bumfuck Minnesota (Ok, Monticello. Population 12k, about 20 miles from Minneapolis) I got in a fairly significant accident, effectively reducing the intersection to one lane. (some dipshit turned left in front of me, smoked him doing about 40) No injuries, but the cops were still there within 5 minutes of calling 911. Just offering my anecdotal story.

              • Remember... The original story was in Detroit where money for police is in short supply. My guess is their average response time is quite a bit higher in Detroit than the middle of nowhere Minnesota...

                Both of my examples where in major metropolitan areas, the first in Raleigh NC and the second in Garland TX (The third largest city in the Dallas-Fort Worth area) and all happened over 20 years ago now. Back when there was money for public services.

      • Inside job? At least ten cars over ninety minutes.... THEN call the po-po? Something is missing here.

    • Or, how about simply covering the pump with an “Out of Order” sign/bag/covering like they would for any other malfunction? No need to even shut it off when cutting off access to it is sufficient.

      • Re: (Score:3, Funny)

        by Chris Mattern ( 191822 )

        Or, how about simply covering the pump with an âoeOut of Orderâ sign/bag/covering like they would for any other malfunction? No need to even shut it off when cutting off access to it is sufficient.

        I'm sure the "please don't take the free gas" sign would've solved everything.

    • My father ran a service station with two islands of two pumps each. Each island had it's own circuit breaker. I'd be surprised if this has changed much, so he should have been able to shut off the power to just a single island.

  • All gas stations are required to have a big emergency button mounted on the wall inside of the building that will immediately cut off the flow of fuel to the gas pumps when pushed.

    I think that button is also required to be accessible to the public, i.e not hidden behind the counter.

    Push that button and no fuel is dispensed until the system is reset.

    If the attendant somehow didn't know about that button, then that's a hazardous situation right there.

    • Re: (Score:3)

      by OzPeter ( 195038 )

      If the attendant somehow didn't know about that button, then that's a hazardous situation right there.

      I actually read TFA and it seems that the attendant tried all sorts of ways through his normal systems to shut the gas off, but failed. It appears that he finally used the emergency shutoff, but that is not clear in TFA.

    • Re:Fire Emergency shut-off (Score:5, Insightful)

      by Junta ( 36770 ) on Sunday July 08, 2018 @06:06PM (#56913484)

      I wager the attendant didn't catch on for a while. Generally nowadays the systems are *supposed* to only dispense if the customer has given payment info or the attendant has turned it on. In fact, most of the time when I go to a gas station now, I've set up payment before I even leave the car and just get out and pump. A station attendant may have a hard time distinguishing someone paying by mobile from someone who made it dispense gasoline otherwise, depending on how it works. Note it says it went on for 90 minutes, then he shut it down, *then* he called police. It also says he "got an emergency kit"., which may have been how he was describing the fuel shut off (his English may not have been the best). Him describing the system being non-responsive doesn't mean he sat there for a long time trying to overcome the situation, it just speaks to his surprise.

    • My guess is he desired to shut off the hacked pump, and not shut down all the pumps. If those buttons trigger an emergency response (someone enlighten me) then that might have played into it as well.

    • Re: (Score:2)

      by SeaFox ( 739806 )

      All gas stations are required to have a big emergency button mounted on the wall inside of the building that will immediately cut off the flow of fuel to the gas pumps when pushed....Push that button and no fuel is dispensed until the system is reset.

      If the attendant somehow didn't know about that button, then that's a hazardous situation right there.

      Even ignoring this, the theft went on for 90 minutes. Was there some reason the attendant couldn't get the cops to come out in less than an hour and a half and stop people from filling up?

      • Was there some reason the attendant couldn't get the cops to come out in less than an hour and a half and stop people from filling up?

        You think the police care about a small non-violent property crime?

      • Pre-paid pump systems work without any action from the attendant. So he may not have noticed anything wrong unless he looked carefully. Then he would have tried to disable the pump from his console, and found it didn't work. With that, it seems he did use either the big red button, or the pump's circuit breaker, to disable it.

      • Even ignoring this, the theft went on for 90 minutes. Was there some reason the attendant couldn't get the cops to come out in less than an hour and a half and stop people from filling up?

        You're assuming the attendant figured out that it was happening immediately.

        The pump dispensing free gas is going to look all that different from the other pumps at a glance, since presumably it has a pay-at-the-pump system. It probably took a while to notice no one was paying.

  • Gas? (Score:4, Funny)

    by ickleberry ( 864871 ) <web@pineapple.vg> on Sunday July 08, 2018 @06:10PM (#56913500) Homepage
    What kind of gas was this? Butane? Propane? Methane?

    • Re: (Score:2)

      by antdude ( 79039 )

      Farts. :P

    • What kind of gas was this? Butane? Propane? Methane?

      The kind referred to as such from coast to coast in a country who's farts (pun intended) are bigger than European countries.

  • Of course, people will be looking for another round of shield-and-sword war with hackers.

    What happened to

    Zwei Dinge erfüllen das Gemüt mit immer neuer und zunehmender Bewunderung und Ehrfurcht, je öfter und anhaltender sich das Nachdenken damit beschäftigt: Der bestirnte Himmel über mir, und das moralische Gesetz in mir

  • would of made more with an cc skimmer vs maybe a few free full ups.

  • Hackers steal 600 gallons of gas in Detroit... (Score:5, Funny)

    by Narcocide ( 102829 ) on Sunday July 08, 2018 @06:39PM (#56913636) Homepage

    ...then ironically don't use it to leave Detroit.

  • The math from TFS ... (Score:3)

    by CaptainDork ( 3678879 ) on Sunday July 08, 2018 @06:42PM (#56913638)

    ... because I didn't read TFA:

    Given:

    - $1,800 USD
    - ~ 10 cars
    - 600 gallons

    Then:

    $1800/10 car = $180/car

    $1,800/600 gallons = $3/gallon

    600 gallons/10 cars = 60 gallons/car????

    • I bet they don't know how much was stolen, and are only estimating. There is no metering system on the main tank, only on the dispensers. So if the dispenser was tampered with, there is no way to know how much was stolen until you get the main tank refilled and do the accounts.

    • TFA says "At least 10". That likely means something like "We saw 10 people do it, so it was AT LEAST that many...but we're missing 600 gallons of gas."

      All your math shows is that since 60 gallons a car is improbable, we're probably looking at 20, 30, or more. If these were average cars filling up, probably 40 ish.

  • What probably happened (Score:3)

    by Snotnose ( 212196 ) on Sunday July 08, 2018 @06:46PM (#56913652)
    One or three guys came up with the "hack", fired it up, filled their 15 gallon tanks for free, then couldn't figure out how to turn the hack off. People kept coming in, filling their tanks, either not realizing nor not caring the gas was free. Some of them called their buddies, who came and filled up cuz it was free.

    Meanwhile the dudes that did the "hack" are either laughing their asses off that they got $50 of gas for free, freaking out because if everyone gets free gas someone will notice, or they were script kiddies $Someone was using as a test case for an attack.

  • At least hide your hack so the exploit can be used by others.

  • First, eliminate these causes before blamimg "hackers": employee pilferage, employee mistake, broken equipment, software bug.

  • It wasn't the pumps (Score:5, Informative)

    by Megane ( 129182 ) on Sunday July 08, 2018 @08:22PM (#56914004)

    I used to write code to talk to gas pumps 20 years ago, and they really aren't much different today, aside from having better screens and needing to deal with chip cards. (I have seen only a single station so far with what appeared to be chip-ready card readers! Isn't that cut-over only a year or two away? But there are restaurants that over two years later still have tape over the chip reader.)

    First of all, the pump (the part that gives you fuel while measuring it) is completely separate from the terminal on top. They both talk to a computer in back over an RS-485 link. The computer in back, even if it's a crappy one from the pump manufacturer, takes payment information from the terminal (and commands from the POS inside the store), then enables the pump, possibly with a preset limit. When you hang up the hose, the computer sees that status in the pump, reads the dispensed amount, and finishes the transaction.

    The back-end computer could certainly have bad programming. I once had to do a site visit for a beta site, and found out that the authorizer (the part that says "this card is okay, turn on the pump" and handles the billing) was saying yes to ANY card. Not my code, of course. Fortunately, people were using the membership card of the club store (they probably thought it would be automatically billed), which meant they could be tracked down if necessary.

    One thing that could be done is to open up the pump, and flip its configuration switches to set it into a manual mode. That still won't stop the fuel counters inside the pumps, so it won't match inventory with the back room computer later on. But you have to open it up first. Not only is there a key to deal with, but these days there are tamper stickers on the door because so much inside can be fucked with, not just the pump.

    Another thing that could be done is someone with inside knowledge of the system could create a management card that makes the computer give free gas. That would be noticed eventually too, but the big problem is you have to have access to the back end. This could possibly be done for a RFID keyfob, but that means you still need a way to get the keyfob ID into the system, and it would still be an inside job.

    If the deed was done wirelessly, as implied, I'm going to guess that means that someone had a wireless connection like WiFi on the same network as the back-end computer, and it wasn't encrypted, etc. It could also be a keyfob or NFC, but other than that, I haven't heard of any kind of wireless technology that would need to go into the pump. It's always possible that there was some kind of stupid buffer overflow bug on something wireless.

    As to what could have been done to shut it down, if the person at the store knew this was happening, um, yeah. Unless he called a manager who told him to not turn it off (fuel is a good way to get customers to buy your overpriced sodas and snacks), the E-Stop button would have been enough. An "out of order" sign would probably have worked too, simple psychology, nobody would have bothered to use the pump. It's also possible that the POS had a way to shut pumps off. And I wouldn't be surprised if nobody understood how to use such features.

    • Not only is there a key to deal with, but these days there are tamper stickers on the door because so much inside can be fucked with, not just the pump.

      The last time I actually looked at the tamper stickers on a gas pump (a few years ago), they were all broken. I pointed this out to the manager, who wasn't concerned.

    • Re: (Score:2)

      by lannocc ( 568669 )
      Is it possible an EMP type device could render the pump control logic inoperable and therefore leave it in an undetermined or last-used (i.e. enabled) state?

    • Re: (Score:2)

      by AHuxley ( 892839 )
      Re "which meant they could be tracked down if necessary."
      How many have automatic license plate readers as part of a CCTV system?

    • Re: (Score:2)

      by mysidia ( 191772 )

      One thing that could be done is to open up the pump, and flip its configuration switches to set it into a manual mode.

      Seems a pretty likely real-world attack --- if the pumps have a manual mode. Probably the cabinets have cheap or generic locks, and it's not hard for a rogue to cut through a tamper-resistant sticker and then either just ignore it later or replace with one one of their own fresh sticker after tampering with the equipment.

      Rank it second that perhaps they inserted a piece of rogue e

    • But there are restaurants that over two years later still have tape over the chip reader.

      Retailers are required to have a chip reader by the credit card processors.
      Retailers are not required to use the chip reader.

  • Surely someone with the skills to hack a gas pump can get a job that pays far more than $1800 for the same effort. Seems such a sad use of talent.

  • Surveillance cams?

  • He could have thrown a breaker and it would have went down. Kill the tank monitor and the power to the pumps.

  • Funnily enough, I worked on a project a few years ago to prevent people stealing gasoline from dispensers. Some of the tests I did (at the behest of the client) involved using various methods to break into the gas dispenser. The idea was we would use accelerometers and other sensors to detect if someone was trying to tamper with the dispenser. Needless to say they were ridiculously simple to break into; it can be done in under a minute without causing any damage to the dispenser.

    Anyway, once the dispenser w

  • ...but there were already three cruisers in line at the hacked pump.

  • I'm surprised the pump itself is still there.
  • Every gas station I know puts the nozzle in a paper (or sometimes plastic) bag to indicate that the pump is out of service. Did this one not have bags? Just because the pump is technically working doesn't mean it can't be marked otherwise to discourage use.
  • I'm an old guy and old-fashioned. Whenever possible I avoid buying gas at any of the pay-ahead pumps and dealers. (Living in Canada, this isn't too difficult still.) I pump my gasoline and then go inside to pay, in cash. I almost always fill the tank and it's so hard to guess ahead of time how much gasoline I need to pay for at the pay-ahead pumps, so I avoid them. But I'm in the minority and the petroleum industry doesn't care about people like me, so they continue with their fancy new pumps based on

  • All new construction gas stations have cut off switches set up as such where they simply don't cut off the gas at the pump, but to depower the actual fuel pumping system by cutting power completely by opening an magnetic contactor.

    Of course, existing gas stations usually don't have this in the first place, or else the breaker box is wired to the point of being paranoid. This code varies on strictness and/or enforcement from state to state. This is improving, but is slow.

  • "...the gas station attendant unable to thwart the hackers."

    Unable? An Out of Order sign and a plastic bag over the gas pump would have fucking worked fine.

    This is the inherent problem with building systems that are idiot-proof; we ultimately end up building grade-A idiots to sit behind the wheel.

  • Back in the 80's my dad had a minor engine fire in his car. He pulled into a gas station lot and parked as far as he could from the pumps and other customers, then got out of the car and walked over to the station. He asked the attendant for a fire extinguisher, so the guy looked over at a "FIRE" button and pushed it, causing a huge amount of fire retardant to dump all over everyone pumping gas while dad's car smouldered away at the far end of the lot. Eventually the FD came and extinguished it.

Slashdot Top Deals

Let the machine do the dirty work. -- "Elements of Programming Style", Kernighan and Ritchie

Close