French Gas Stations Robbed After Forgetting To Change Gas Pump PINs (zdnet.com) 102
An anonymous reader quotes a report from ZDNet: French authorities have arrested five men who stole over 120,000 liters (26,400 gallons) of fuel from gas stations around Paris by unlocking gas pumps using a special remote. The five-man team operated with the help of a special remote they bought online and which could unlock a particular brand of gas pumps installed at Total gas stations. The hack was possible because some gas station managers didn't change the gas pump's default lock code from the standard 0000. Hackers would use this simple PIN code to reset fuel prices and remove any fill-up limits.
Crooks would operate in small teams of two to three individuals who visited gas stations at night using two vehicles. A man in a first car would use the remote to unlock the gas station, and then a second car, usually a van, would come along seconds later to fill a giant tanker installed in the back of the vehicle with as much as 2,000 or 3,000 liters in one go. The group advertised the fuel they stole on social media, providing a time and place where customers could come and refuel their vehicles or pick up orders for gasoline and diesel at smaller prices. Police uncovered the scheme in April 2018, when they arrested a suspect in possession of a remote used in the hack. "Five men, part of the same gang, were arrested on Monday, according to Le Parisien, who first reported the scheme last November," the report adds.
Crooks would operate in small teams of two to three individuals who visited gas stations at night using two vehicles. A man in a first car would use the remote to unlock the gas station, and then a second car, usually a van, would come along seconds later to fill a giant tanker installed in the back of the vehicle with as much as 2,000 or 3,000 liters in one go. The group advertised the fuel they stole on social media, providing a time and place where customers could come and refuel their vehicles or pick up orders for gasoline and diesel at smaller prices. Police uncovered the scheme in April 2018, when they arrested a suspect in possession of a remote used in the hack. "Five men, part of the same gang, were arrested on Monday, according to Le Parisien, who first reported the scheme last November," the report adds.
Please do not call them hackers (Score:3, Insightful)
Re: (Score:1)
Re:Please do not call them hackers (Score:4, Informative)
Re: (Score:2)
I think it was a special RF remote. In Europe petrol pumps usually won't dispense until authorized by a staff member who sits in the payment kiosk watching what is happening on CCTV. When someone pulls up to the pump they check they are not on the banned list or trying to fill up 20 jerry cans and use an RF remote to turn on the pump.
Most people don't even realize it's happening.
Re: (Score:1)
You have lists of people who are banned from buying petrol?
What's wrong with filling up 20 jerry cans? ...So many rules that you just swallow unquestioningly...
Re: (Score:2)
What's wrong with filling up 20 jerry cans? ...So many rules that you just swallow unquestioningly...
Nothing, until you jump back in the car and speed off.
Re: (Score:1)
Re: (Score:2)
What's wrong with filling up 20 jerry cans?
Fire regulations. Imagine the inferno when some Canadian fills up 20 jerry cans at Costco and gets in a wreck on I-5 heading back to Vancouver.
Re: Not a hack! Jeez! (Score:2)
To be fair, it is little different than illegally entering modem sites in the early 1980s because they left the user/password as admin/admin (which still happens with routers today).
At least it was just gasoline and not nuclear launch codes (the infamous 00000000).
Re: (Score:2)
quite a hack actually.
HACK THE PLANET!!!!
Re:Please do not call them hackers (Score:5, Insightful)
Not even that - script kiddies are still trying to bypass security - these guys were just following the instructions on the box to see if the manager had been stupid enough to not change the factory-default passcode.
Seems to me that default passwords not being changed is a common enough security threat, across a wide range of devices, that any programmer should defend against it as a standard security precaution. Perhaps simply have the device refuse to operate at all until the password/code is changed, instead simply displaying a message demanding that the passcode be changed before proceeding.
You probably want initial setup and diagnostics to work normally, but refuse to actually pump any gas, forward any packets, or whatever else the device is supposed to do, until the code is changed.
Re: Please do not call them hackers (Score:3)
Re: (Score:2)
An excellent solution. Makes production slightly more complicated, but it shouldn't be by much.
I like the "physical button" security model for most internet-connected things as well - make sure someone has to be physically present to confirm any potentially harmful action. It seems to me that that's the single most cost-effective layer of security you can add. If it's *really* important, then you make it physically impossible to take a harmful action without that button being pushed. Then you only have
They'll do EVERYTHING for CLICKS (Score:1)
Idiot "editors", that is. So it's hackers! Hacking! With hacks! Even if this is patently false. Because hackers! Hacking! With hacks! The clicks are the reward.
Re: (Score:2)
There is nothing clever about this. This is just security failing because of the incompetency of the gas station managers. Nothing about this could be called a hack.
But what is the car analogy? It's like filling your car with stolen fuel....wait.
Re: (Score:2)
There has been a car analogy where the entry code (in the remote control) for the alarm system was unmodified allowing the default code to disable the alarm on many cars of the same model.
And as the late Richard Feynman once recounted about his time at Los Alamos working on the atomic bomb, 20% of the safes he verified were still on factory settings,
Re: (Score:1)
There is nothing clever about this. This is just security failing because of the incompetency of the gas station managers. Nothing about this could be called a hack.
You literally just described a security hack. The failing on one behalf allows another behalf to take advantage of by way of adopting an additional tool or device. The scenario is literally a "hack," unless you're referring to yourself as being a "hack" of a security expert.
you don't set them from inside the store? (Score:2)
you don't set them from inside the store? But an RF or IR remote? that some can easily clone
Re: (Score:2, Informative)
You used to have to have cables and set them from inside. Most of the old hardware is this way. These remote ones are "new", "better" and "improved" version that the manufacturers push on customers. Much like amazon pushing remotes with an always on microphone and moving from bluetooth to wifi
More human security (Score:2)
2. Have human staff look at the "van" and the amount of fuel and the price of that fuel.
3. Make people walk from the gas pumps to a cashier with a computer display showing pump used, price and amount of fuel.
4. Pay for the fuel.
5. Human staff on duty will see huge numbers never seen before from any average "van" on the computer display? Thats not normal.
Have the computer alert to totally unexpected numbers.
6. Lots of quality CCTV
Re: (Score:2)
They are most likely sitting in the corner, bathroom where ever playing games or on social media on their phones. And completely oblivious to everything around them.
These smart phones for some are better than drugs or alcohol..
Just my 2 cents
Re: (Score:1)
Would be selling newspapers, magazines. Hats and sunglasses.
Food and making hot fresh coffee. Bread and snacks.
All that fuel.
Making sure vans don't steal large amounts of fuel.. would be another great reason.
Re: (Score:3)
Re "keeping tabs on operations?" Would be selling newspapers, magazines. Hats and sunglasses. Food and making hot fresh coffee. Bread and snacks. All that fuel. Making sure vans don't steal large amounts of fuel.. would be another great reason.
Well if you want your till monkeys to be security they should be paid/trained/equipped accordingly. But they want to pay some kid minimum wage and expect them to notice, give a shit or even do anything about it other than a cursory phone call to the police/manager to let them know what's happened.
Re: (Score:2)
Once electric cars take over the world, stealing gasoline might be less of a concern :-D
yeah, because then stealing electricity might be more of a concern :-)
Types of electricity (Score:2)
Engaging "Captain Obvious" mode, ruiner of quick jokes since birth of forums:
yeah, because then stealing electricity might be more of a concern :-)
Charging an e-vehicle requires at least some voltage and amps.
More than what's available on, e.g.: street lights. (Europe, that would usually be 250V with quickly is hard requirement for a heist )
The household connector (Europe, that would be 250V, between 10A and 16A depending on regions and type of connector) would be a rather slow trickle.
It's okay if you leave a vehicle *over-night* or even a couple of days. It's okay-ish if yo
Re: (Score:2)
Re: (Score:2)
1. Have human staff on duty when the gas station is operational.
This makes no sense. Any given gas station has about a 1% chance of being exploited, and figure one euro per liter and 3000 liters per hit, that is an expected loss of 30 euros. There is no way that is worth an extra full time worker just to monitor the pumps.
Here's a more cost effective solution: Change the code to something other than 0000.
Re: (Score:1)
7. Remove anything automated that can allow your gas station to pump fuel for free at any time.
Re: (Score:2)
figure one euro per liter and 3000 liters per hit, that is an expected loss of 30 euros.
Wouldn't that be 3000 Euros? And in France, gas is more expensive than 1€/l...
Re: (Score:2)
Wouldn't that be 3000 Euros?
€3000 * 1% probability = €30 expected loss
And in France, gas is more expensive than 1€/l...
Gas stations don't pay the full retail price.
Re: (Score:2)
Change the code to something other than 0000.
So you are the station manager and you do this. Given the caliber of employee you are able to hire for a minimum wage job like pump attendant, you are going to be called on a daily basis, "Uh, I forgot the code."
Until one of them gets smart and writes it on the side of the pump with a Sharpie.
Re: (Score:2)
Easier solution:
1. Have basic competence.
Done. No need for more people. In fact I'm perfectly happy with "express" petrol stations which is just a pump somewhere and no need to interact with anyone.
Re: (Score:1)
A human looking down to see the amount of fuel getting pumped in real time.
The police told of a method of crime in real time.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The need to interact with people could have stopped that van crime.
The theft happened at night. When filling stations are typically not manned, but operate with automatic credit card readers.
This allows the station's operator to capture the business at night without the staff expense.
Re: (Score:2)
Have human staff on duty when the gas station is operational.
This was done at night when the station was not operational in manual mode, but rather automatic.
People can still fill up using a credit card inserted into a slot next to the pump.
Using their magic remote, the thieves switched station into daytime mode (where you're supposed to pay inside after filling up...) , filled up the van, and switched it back to night-time mode.
Only protection here would be to give up the night business, but then the station would lose (paying) night-time customers to their neigh
Re: More human security (Score:3)
Theres the problem. Here in the US, ever since the Iraq War when gas shot up to double what it is currently is, every station makes you pay before you pump. Too many people were stealing gas.
Re: (Score:2)
every station makes you pay before you pump
In Europe, filling stations have cameras. When you just drive off when done, you'll be caught pretty quickly...
I'm not sure what happens if somebody would pull this stunt in a stolen car... never heard of any such occurrence
At night, when the card readers are in operation, you do indeed have to insert card before you start pumping (but amount is booked after you're done, obviously, as quantity pumped is not known before).
Re: (Score:2)
In Europe you can pre-authorize your credit card for, say, up to 100 Euro of fuel and then fill up, after which you are billed for the exact amount.
But these guys got around that by setting the price of fuel to 0.01 Euro/litre instead of the usual ~1.40 Euro/litre.
Re: (Score:2)
Re: (Score:2)
By every station, you mean not every station right? In major cities yes, but go to any small town in any state, they accept post-pumping payment.
Re: More human security (Score:2)
Definitely still pay inside stores in the US, as I often fill at one. The security system takes a clear shot at your plate and there are several fines for not paying including jail time. I do it when I get pre-paid gas cards from low income people I shuttle around. Usually I get 6-8 $5 or $10 cards a month and the pump readers make me insert, fill, wait, insert next card which fails if you haven't driven off but resets the reader, insert, fill another $5-10, repeat until done. Walking in they scan all I nee
Re: (Score:2)
1. Have human staff on duty when the gas station is operational. 2. Have human staff look at the "van" and the amount of fuel and the price of that fuel. 3. Make people walk from the gas pumps to a cashier with a computer display showing pump used, price and amount of fuel. 4. Pay for the fuel. 5. Human staff on duty will see huge numbers never seen before from any average "van" on the computer display? Thats not normal. Have the computer alert to totally unexpected numbers. 6. Lots of quality CCTV for face, passengers face and gait. 7. Remove anything automated that can allow your gas station to pump fuel for free at any time.
Or change the default pin used in the equipment and force customers to "prepay" for a reasonable amount of fuel by clearing the credit card in advance or requiring prepayment in cash.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
No it’s not, it’s a Station d’Essence, just like it says in the linked Parisien article. That Total publishes Brit oriented marketing materials does not force translators in the USA to use UK expressions. — let me guess: You voted Brexit, right?
Re: (Score:2)
its France so its called a fucking petrol station.
https://www.total.fr/pro/carburants/essences-sans-plomb
It might be if they didn't speak french.
But... (Score:2)
Re: (Score:2)
Re: (Score:2)
in all likelihood they could try all pin options in a matter of minutes anyway
10,000 codes in minutes? I feel bad for your thumb.
Re: (Score:2)
10,000 codes in minutes? I feel bad for your thumb.
No. The guys assume the default 0000 was changed, so they tried only 9999.
That's IoT for you. (Score:2)
Well, ok, it's not exactly IoT, but IoT is in smack-center exact the same position.
Point in case:
Just the other day I saw an elaborate public-space add for a bluetooth operated brother strip-.label printer. Totally bizar. Expensive, complicated, error prone and obsolete in 5 years. Mine is 15 years old and has a keyboard built in and doesn't need a smartphone with a certain type of bluetooth connection and accompaning software to operate. It will last longer, is cheaper, easyer to operate (I only use it onc
Re: (Score:2)
this gas-pump thing and every other new fad
Look, I'm all for reading a good anti IoT rant, but there's nothing "IoT", "new", or "fad" in using IR communications to configure equipment in the oil industry. This is literally the way it's been done for 40 years.
That's the kind of PIN... (Score:1)
...an idiot would have on his luggage!
Re: That's the kind of PIN... (Score:3)
Factory defaults are designed to be easy so the manual can say 'enter 0000, then press change PIN).' It is also usually designed with a factory reset in mind in case the PIN is lost or forgotten (which would require direct hardware access, usually behind an alarmed key lock).
5guys? (Score:2, Funny)
I'd say something about "hamberders" and Trump here, but I think I won't.
The gas station owner must be fined severely (Score:5, Interesting)
Re: The gas station owner must be fined severely (Score:1)
Lots of fluids are transported in unbaffed tanks you just need to drive carefully, furthermore if you had it completely fill I would think it would be reasonably safe as it would be incompressible and therefore wouldn't act like a mass with a changing center of mass
Re: (Score:2)
I can only imagine (Score:2)
Fast and Furious Plot (Score:2)
I guess we have the Plot for the next Fast and Furious Movie!
Re: (Score:2)
Only a moron uses "0000" as a pin! (Score:2)
Quick, change my pin to "1234"!
Re:Only a moron uses "0000" as a pin! (Score:5, Funny)
Quick, change my pin to "1234"!
I use 9999, because it's the most secure PIN because it's the last one to get guessed.
You start with 0000, then 0001, 0002 and so on...9999 will be the last one the haxxors get to!
Did police recover any yellow vests? (Score:2)
WHAT!?!?! (Score:2)
Forgetting? (Score:2)
Idocy cannot be hidden like that!