Wednesday, January 29, 2025
HomeInfosec- ResourcesGlobally Gas Stations are Extremely Vulnerable to Internet of Things ("IoT") Cyber...

Globally Gas Stations are Extremely Vulnerable to Internet of Things (“IoT”) Cyber Attacks

Published on

SIEM as a Service

Follow Us on Google News

2018 begins with the rise of the Internet of Things (” IoT “) which is based on the existence of an interconnection of all kinds of everyday objects, such as a printer, a SmartTv, a refrigerator, a smart blind, a book, a thermostat, etc.

For effective, safe and secure use, it is necessary to take into account the use of passwords to access these devices, a question that is not always fulfilled. “For example, in Spain, the safety of automatic tank meters at gas stations is in question because of the 97 gas stations or tanks located in Spain, only 1 is protected by a password.”

That is why it is important to know that any device that connects to the Internet, can involve a risk in terms of privacy and security or, always be around the question of what can happen if a cybercriminal took control of any of these devices, or simply do with the personal or public information.

Today we are going to talk about a problem that affects gas stations, which although known since 2015, the expert in computer security Claudio Chifa has investigated and is referring to the safety of the automatic tank gauges of gas stations and surprisingly not has been corrected.

These devices are used in service stations and perform various functions, such as monitoring fuel levels water, temperature, or generate alarms when appropriate. These valves are used in many service stations around the world including Spain.

Also Read: Most Important Consideration for Industrial Control System(ICS) Cyber Defense

IN-TANK INVENTORY

TANK PRODUCT             VOLUME TC VOLUME   ULLAGE   HEIGHT    WATER     TEMP
  1  DIESEL               36562     36733    19122   1307.5      0.0     9.80
  2  GAS OIL               5731      5760     9269    893.6      0.0     9.36
  3  KEROSENE              8381      8426     6620   1373.6      0.0     8.92
  4  UNLEADED             19027     19539     9777   1452.9      0.0     9.00 

Many valves have a built-in serial port for programming and monitoring. Some systems also have a TCP / IP card or even a serial adapter to TCP / IP.

These cards allow technicians to monitor the system remotely. The most common TCP port used in these systems is port 10001.

Some of these systems have the ability to be password protected, but of the 97 gas stations or tanks located in Spain, only 1 is password protected

Top Affected Countries :

Accessing these systems is relatively simple and is done via telnet. There are more than 600 commands that can be executed, some of which include the setting of alarm thresholds, the editing of sensor configurations and the execution of tank tests.

Moreover, we can see all the commands explained and detailed in the manual that the manufacturer provides for this device.

1. United States 840
2. China 472
3. Germany 447
4. Australia 188
5. Russian Federation 121
6. Canada 103
7. Spain 96
8. France 72
9. Taiwan 53
10. United Kingdom

From the Spanish Association of Internet users we call for the owners of these systems to ensure a minimum level of security to avoid both an economic loss and an ecological disaster in case someone remotely tries to manipulate these devices with bad intentions.

Some reflections on security of the Internet of Things in the industrial world

According to an IoT expert. Antonio Fernandes ,Far from being an isolated event, the Internet connection of critical devices like the case of these gas stations, is something more common than we think.

The digital transformation of the industry is leading a large part of it to growth with zero security awareness, generating a new dangerous and unstable ecosystem.

We tend to believe that cybersecurity (“IoT”) lies primarily in securing the devices and their connection to the network, and we are wrong.

As a starting point, we see that neither the securitization of the devices nor their connection to the network is currently in the minds of many industrial deployments, such as the commented case of gas stations and industrial devices.

Many management software, methods of updating or authentication of the embedded software of the devices (“IoT”) is not developed with the security of information as a determining factor for the market, this gives all kinds of classic vulnerabilities to them for that the attacker gets an intrusion in it.

But these insecure devices, are part of a fog of devices, an electronic hive that communicates in a multitude of protocols … Some of them insecure .. In many channels .. Some of them insecure …

If this were not enough, these devices usually report services that are hosted in the cloud. Therefore, this is another area to which to devote efforts in the search to have the lowest possible risk.

And to mention another important risk factor “The human being” that reviews, controls and works with these IoT infrastructures from their computers that they use for other office tasks or from mobile apps on their smartphones and tablets.

The hijacking, manipulation or destruction of critical industrial systems is more real than most people tend to believe, and it has long ceased to be a poetic license for Hollywood screenwriters.

Source & Credit: This article provided to www.gbhackers.com by Claudio Chifa , IoT Security Expert. He Would like to share his knowledge, for the readers who are interested in exploring tacts and trends.All the Content of this Article Belongs to Original Author Claudio Chifa, IoT Security Expert. www.gbhackers.com won’t take any credits.

Latest articles

Vulnerability in Airline Integration Service enables A Hacker to Gain Entry To User Accounts

A recent security vulnerability in a widely used airline integration service has exposed millions...

Hackers Seize Control of 3,000 Companies Through Critical Vulnerabilities

In a groundbreaking cybersecurity investigation, researchers identified several critical vulnerabilities in a target system,...

PoC Exploit Released for Critical Cacti Vulnerability Let Attackers Code Remotely

A critical vulnerability in the Cacti performance monitoring framework tracked as CVE-2025-22604, has been...

TorNet Backdoor Exploits Windows Scheduled Tasks to Deploy Malware

Cisco Talos researchers have identified an ongoing cyber campaign, active since mid-2024, deploying a...

API Security Webinar

Free Webinar - DevSecOps Hacks

By embedding security into your CI/CD workflows, you can shift left, streamline your DevSecOps processes, and release secure applications faster—all while saving time and resources.

In this webinar, join Phani Deepak Akella ( VP of Marketing ) and Karthik Krishnamoorthy (CTO), Indusface as they explores best practices for integrating application security into your CI/CD workflows using tools like Jenkins and Jira.

Discussion points

Automate security scans as part of the CI/CD pipeline.
Get real-time, actionable insights into vulnerabilities.
Prioritize and track fixes directly in Jira, enhancing collaboration.
Reduce risks and costs by addressing vulnerabilities pre-production.

More like this

Is this Website Safe: How to Check Website Safety – 2025

is this website safe? In this digital world, Check a website is safe is...

LegionLoader Abusing Chrome Extensions To Deliver Infostealer Malware

LegionLoader, a C/C++ downloader malware, first seen in 2019, delivers payloads like malicious Chrome...

PentestGPT – A ChatGPT Powered Automated Penetration Testing Tool

GBHackers come across a new ChatGPT-powered Penetration testing Tool called "PentestGPT" that helps penetration...