Gas Stations In the Bullseye

Researchers who earlier this year spotted potential hacktivist activity against popular gas tank monitoring systems at US gas stations say they've been studying some real-world attacks on these systems as well as on their own honeypot set up to study and gather intelligence on the attackers and their intentions.

Kyle Wilhoit and Stephen Hilt, both with Trend Micro, at the Black Hat USA conference in early August plan to release a free tool called Gaspot, which allows researchers as well as gas tank operators to set up their own virtual monitoring systems to track attack attempts and threats.

Although the pair of researchers won't divulge all of their newest findings on attacks and attackers until their August presentation at Black Hat, they say they have confirmed attacks on the Guardian AST gas tank monitoring systems in several locations across the US, and found a number of these systems wide open to attack via the public Internet, vulnerable to manipulation and sabotage. In February, they reported finding one such Internet-facing tank monitoring system at a gas station in Holden, Maine, renamed "We_Are_Legion" from "Diesel," suggesting either the handiwork of Anonymous or another attacker using the group's slogan.

Wilhoit and Hilt's research follows that of Rapid7 chief research officer HD Moore, who in January revealed his findings of some 5,800 Vedeer-Root automated tank gauges, which monitor for fuel leaks and other problems with the tanks as well as fuel levels, found sitting wide open on the Internet without password protection, leaving more than 5,000 gas stations in the US vulnerable to attackers who could remotely alter the alarm thresholds to simulate a leak, disrupt the fuel tank operations, and worst-case, wreak havoc by shutting down the gas stations altogether, researchers say.

Moore had gotten a heads up from Jack Chadowitz, president and CEO of Kachoolie and BostonBase Inc., who first detected the problem. Rapid7's Moore then conducted an Internet scan of devices with TCP port 10001 open to the public Internet, and reported his findings publicly.

The Trend Micro researchers found similar issues with the Guardian AST, which is also sold by Vedeer-Root. The Guardian AST also provides inventory tracking of above-grand gas storage tanks, and according to Wilhoit, comes with more communications protocols -- including an RS-232 port -- than the Vedeer-Root fuel tank devices studied by Moore. The Guardian devices also are widely used on generators, Wilhoit notes.

"After we saw the possible Anonymous attack [on the systems], we thought there was probably more here," Wilhoit says.

Wilhoit says he and Hilt saw a number of systems at US gas stations being attacked, as well as some overseas. "The large majority were distributed throughout the US," he says.

While he wouldn't yet reveal the types of attacks, he says the types of attacks were across the board. "The obvious concerns were about nation-state attackers," he says.

The Gaspot tool will allow researchers and organizations to basically deploy a script that gives them insight into whether their system is being targeted by attackers. "It will allow them to assess if attackers are interested in their environment," Wilhoit says.

The vulnerable systems identified previously by Moore were only found in independent, small gas station dealer sites. Large chains affiliated with big-name petroleum companies generally aren't vulnerable to the public-facing Net attacks because they're secured via corporate networks, according to Kachoolie and BostonBase's Chadowitz, whose company provides monitoring services for gas stations and other businesses. "There are only so many" Guardian AST systems out there, he says.

The attacks Chadowitz has seen mostly have been things like changing the product's name. "That's very simple to do. I haven't seen any intelligent hack" yet, he says. "Their understanding is very primitive now" of these monitoring systems, he says of the attacks thus far.

Moore told Dark Reading earlier this year that the Vedeer-Root gas tank monitoring vulnerability issue stemmed from tank gauge vendors not instituting security by default -- namely a VPN gateway-based connection to the devices and authentication. 

Vedeer-Root, which in response to Moore's research in January alerted its customers about deploying security features in the product, had not yet responded to a press inquiry about the latest research as of this posting.