Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Crime Security The Almighty Buck

French Gas Stations Robbed After Forgetting To Change Gas Pump PINs (zdnet.com) 102

Posted by BeauHD from the exploited-vulnerabilities dept.
An anonymous reader quotes a report from ZDNet: French authorities have arrested five men who stole over 120,000 liters (26,400 gallons) of fuel from gas stations around Paris by unlocking gas pumps using a special remote. The five-man team operated with the help of a special remote they bought online and which could unlock a particular brand of gas pumps installed at Total gas stations. The hack was possible because some gas station managers didn't change the gas pump's default lock code from the standard 0000. Hackers would use this simple PIN code to reset fuel prices and remove any fill-up limits.

Crooks would operate in small teams of two to three individuals who visited gas stations at night using two vehicles. A man in a first car would use the remote to unlock the gas station, and then a second car, usually a van, would come along seconds later to fill a giant tanker installed in the back of the vehicle with as much as 2,000 or 3,000 liters in one go. The group advertised the fuel they stole on social media, providing a time and place where customers could come and refuel their vehicles or pick up orders for gasoline and diesel at smaller prices. Police uncovered the scheme in April 2018, when they arrested a suspect in possession of a remote used in the hack. "Five men, part of the same gang, were arrested on Monday, according to Le Parisien, who first reported the scheme last November," the report adds.
This discussion has been archived. No new comments can be posted.

French Gas Stations Robbed After Forgetting To Change Gas Pump PINs More

French Gas Stations Robbed After Forgetting To Change Gas Pump PINs

Comments Filter:

  • Please do not call them hackers (Score:3, Insightful)

    by Squiddie ( 1942230 ) on Wednesday March 27, 2019 @11:35PM (#58345680)
    There is nothing clever about this. This is just security failing because of the incompetency of the gas station managers. Nothing about this could be called a hack.
    • There has to be a way we could work AI and blockchain in here to make it more secure...

    • Re:Please do not call them hackers (Score:4, Informative)

      by hcs_$reboot ( 1536101 ) on Thursday March 28, 2019 @12:08AM (#58345774)
      So, the guys bought a remote (like this one [intesettech.com] [good product btw]), had the remote learn the protocol, and then tried the default '0000' ; quite a hack actually.

      • Re: (Score:2)

        by AmiMoJo ( 196126 )

        I think it was a special RF remote. In Europe petrol pumps usually won't dispense until authorized by a staff member who sits in the payment kiosk watching what is happening on CCTV. When someone pulls up to the pump they check they are not on the banned list or trying to fill up 20 jerry cans and use an RF remote to turn on the pump.

        Most people don't even realize it's happening.

        • Re: (Score:1)

          by Anonymous Coward

          You have lists of people who are banned from buying petrol?

          What's wrong with filling up 20 jerry cans? ...So many rules that you just swallow unquestioningly...

          • What's wrong with filling up 20 jerry cans? ...So many rules that you just swallow unquestioningly...

            Nothing, until you jump back in the car and speed off.

          • Re: (Score:2)

            by PPH ( 736903 )

            What's wrong with filling up 20 jerry cans?

            Fire regulations. Imagine the inferno when some Canadian fills up 20 jerry cans at Costco and gets in a wreck on I-5 heading back to Vancouver.

      • quite a hack actually.

        HACK THE PLANET!!!!

    • They'll do EVERYTHING for CLICKS (Score:1)

      by Anonymous Coward

      Idiot "editors", that is. So it's hackers! Hacking! With hacks! Even if this is patently false. Because hackers! Hacking! With hacks! The clicks are the reward.

    • There is nothing clever about this. This is just security failing because of the incompetency of the gas station managers. Nothing about this could be called a hack.

      But what is the car analogy? It's like filling your car with stolen fuel....wait.

      • There has been a car analogy where the entry code (in the remote control) for the alarm system was unmodified allowing the default code to disable the alarm on many cars of the same model.

        And as the late Richard Feynman once recounted about his time at Los Alamos working on the atomic bomb, 20% of the safes he verified were still on factory settings,

    • Re: (Score:1)

      by nadass ( 3963991 )

      There is nothing clever about this. This is just security failing because of the incompetency of the gas station managers. Nothing about this could be called a hack.

      You literally just described a security hack. The failing on one behalf allows another behalf to take advantage of by way of adopting an additional tool or device. The scenario is literally a "hack," unless you're referring to yourself as being a "hack" of a security expert.

  • you don't set them from inside the store? But an RF or IR remote? that some can easily clone

    • Re: (Score:2, Informative)

      by Anonymous Coward

      You used to have to have cables and set them from inside. Most of the old hardware is this way. These remote ones are "new", "better" and "improved" version that the manufacturers push on customers. Much like amazon pushing remotes with an always on microphone and moving from bluetooth to wifi

  • 1. Have human staff on duty when the gas station is operational.
    2. Have human staff look at the "van" and the amount of fuel and the price of that fuel.
    3. Make people walk from the gas pumps to a cashier with a computer display showing pump used, price and amount of fuel.
    4. Pay for the fuel.
    5. Human staff on duty will see huge numbers never seen before from any average "van" on the computer display? Thats not normal.
    Have the computer alert to totally unexpected numbers.
    6. Lots of quality CCTV
    • You maybe assuming to much. Is the staff on hand actually paying attention and keeping tabs on operations?
      They are most likely sitting in the corner, bathroom where ever playing games or on social media on their phones. And completely oblivious to everything around them.
      These smart phones for some are better than drugs or alcohol..

      Just my 2 cents ;)

      • Re: (Score:1)

        by AHuxley ( 892839 )
        Re "keeping tabs on operations?"
        Would be selling newspapers, magazines. Hats and sunglasses.
        Food and making hot fresh coffee. Bread and snacks.
        All that fuel.
        Making sure vans don't steal large amounts of fuel.. would be another great reason.

        • Re "keeping tabs on operations?" Would be selling newspapers, magazines. Hats and sunglasses. Food and making hot fresh coffee. Bread and snacks. All that fuel. Making sure vans don't steal large amounts of fuel.. would be another great reason.

          Well if you want your till monkeys to be security they should be paid/trained/equipped accordingly. But they want to pay some kid minimum wage and expect them to notice, give a shit or even do anything about it other than a cursory phone call to the police/manager to let them know what's happened.

    • 1. Have human staff on duty when the gas station is operational.

      This makes no sense. Any given gas station has about a 1% chance of being exploited, and figure one euro per liter and 3000 liters per hit, that is an expected loss of 30 euros. There is no way that is worth an extra full time worker just to monitor the pumps.

      Here's a more cost effective solution: Change the code to something other than 0000.

      • Re: (Score:1)

        by AHuxley ( 892839 )
        1. ....
        7. Remove anything automated that can allow your gas station to pump fuel for free at any time.

      • figure one euro per liter and 3000 liters per hit, that is an expected loss of 30 euros.

        Wouldn't that be 3000 Euros? And in France, gas is more expensive than 1€/l...

        • Wouldn't that be 3000 Euros?

          €3000 * 1% probability = €30 expected loss

          And in France, gas is more expensive than 1€/l...

          Gas stations don't pay the full retail price.

      • Re: (Score:2)

        by PPH ( 736903 )

        Change the code to something other than 0000.

        So you are the station manager and you do this. Given the caliber of employee you are able to hire for a minimum wage job like pump attendant, you are going to be called on a daily basis, "Uh, I forgot the code."

        Until one of them gets smart and writes it on the side of the pump with a Sharpie.

    • Easier solution:

      1. Have basic competence.

      Done. No need for more people. In fact I'm perfectly happy with "express" petrol stations which is just a pump somewhere and no need to interact with anyone.

      • Re: (Score:1)

        by AHuxley ( 892839 )
        The need to interact with people could have stopped that van crime.
        A human looking down to see the amount of fuel getting pumped in real time.
        The police told of a method of crime in real time.

        • Re: (Score:2)

          by Sique ( 173459 )
          Setting the PIN to 1234 instead of 0000 would also have stopped that van crime. And it would have cost much less.

        • The need to interact with people could have stopped that van crime.

          The theft happened at night. When filling stations are typically not manned, but operate with automatic credit card readers.

          This allows the station's operator to capture the business at night without the staff expense.

    • Have human staff on duty when the gas station is operational.

      This was done at night when the station was not operational in manual mode, but rather automatic.

      People can still fill up using a credit card inserted into a slot next to the pump.

      Using their magic remote, the thieves switched station into daytime mode (where you're supposed to pay inside after filling up...) , filled up the van, and switched it back to night-time mode.

      Only protection here would be to give up the night business, but then the station would lose (paying) night-time customers to their neigh

      • Theres the problem. Here in the US, ever since the Iraq War when gas shot up to double what it is currently is, every station makes you pay before you pump. Too many people were stealing gas.

        • every station makes you pay before you pump

          In Europe, filling stations have cameras. When you just drive off when done, you'll be caught pretty quickly...

          I'm not sure what happens if somebody would pull this stunt in a stolen car... never heard of any such occurrence

          At night, when the card readers are in operation, you do indeed have to insert card before you start pumping (but amount is booked after you're done, obviously, as quantity pumped is not known before).

        • Re: (Score:2)

          by AmiMoJo ( 196126 )

          In Europe you can pre-authorize your credit card for, say, up to 100 Euro of fuel and then fill up, after which you are billed for the exact amount.

          But these guys got around that by setting the price of fuel to 0.01 Euro/litre instead of the usual ~1.40 Euro/litre.

        • Comment removed based on user account deletion

        • Re: (Score:2)

          by mtmra70 ( 964928 )

          By every station, you mean not every station right? In major cities yes, but go to any small town in any state, they accept post-pumping payment.

        • Definitely still pay inside stores in the US, as I often fill at one. The security system takes a clear shot at your plate and there are several fines for not paying including jail time. I do it when I get pre-paid gas cards from low income people I shuttle around. Usually I get 6-8 $5 or $10 cards a month and the pump readers make me insert, fill, wait, insert next card which fails if you haven't driven off but resets the reader, insert, fill another $5-10, repeat until done. Walking in they scan all I nee

    • 1. Have human staff on duty when the gas station is operational. 2. Have human staff look at the "van" and the amount of fuel and the price of that fuel. 3. Make people walk from the gas pumps to a cashier with a computer display showing pump used, price and amount of fuel. 4. Pay for the fuel. 5. Human staff on duty will see huge numbers never seen before from any average "van" on the computer display? Thats not normal. Have the computer alert to totally unexpected numbers. 6. Lots of quality CCTV for face, passengers face and gait. 7. Remove anything automated that can allow your gas station to pump fuel for free at any time.

      Or change the default pin used in the equipment and force customers to "prepay" for a reasonable amount of fuel by clearing the credit card in advance or requiring prepayment in cash.

  • With a 4 digit pincode as only 'security' it barely matters if they changed the default - in all likelihood they could try all pin options in a matter of minutes anyway

  • Well, ok, it's not exactly IoT, but IoT is in smack-center exact the same position.

    Point in case:
    Just the other day I saw an elaborate public-space add for a bluetooth operated brother strip-.label printer. Totally bizar. Expensive, complicated, error prone and obsolete in 5 years. Mine is 15 years old and has a keyboard built in and doesn't need a smartphone with a certain type of bluetooth connection and accompaning software to operate. It will last longer, is cheaper, easyer to operate (I only use it onc

    • this gas-pump thing and every other new fad

      Look, I'm all for reading a good anti IoT rant, but there's nothing "IoT", "new", or "fad" in using IR communications to configure equipment in the oil industry. This is literally the way it's been done for 40 years.

  • That's the kind of PIN... (Score:1)

    by Anonymous Coward

    ...an idiot would have on his luggage!

    • Factory defaults are designed to be easy so the manual can say 'enter 0000, then press change PIN).' It is also usually designed with a factory reset in mind in case the PIN is lost or forgotten (which would require direct hardware access, usually behind an alarmed key lock).

  • 5guys? (Score:2, Funny)

    by mark_reh ( 2015546 )

    I'd say something about "hamberders" and Trump here, but I think I won't.

  • The gas station owner must be fined severely (Score:5, Interesting)

    by 140Mandak262Jamuna ( 970587 ) on Thursday March 28, 2019 @07:26AM (#58346826) Journal
    If some thief steals donuts and coffee it is a simple theft. But here the gas station lost control of a hazardous substance and there were rickety vans with leaky tanks with 3000 liters of gasoline sloshing about. These crooks most likely do not understand the effects of fluid being transported in un-baffled tanks. It was a disater waiting to happen. Safety of hundreds of people has been endangered.

    • Lots of fluids are transported in unbaffed tanks you just need to drive carefully, furthermore if you had it completely fill I would think it would be reasonably safe as it would be incompressible and therefore wouldn't act like a mass with a changing center of mass

  • how those fuel exchanges on the side of the road went. "So, where'd you get the cheap fuel?" "It, uh, fell off the back of a truck?"

  • I guess we have the Plot for the next Fast and Furious Movie!

  • Quick, change my pin to "1234"!

  • Did the perps spend the week stealing gasoline, the spend weekends protesting gas taxes? That would be ballsy.
  • OMG, really? But I went thru the procedure and changed the it *TO* 0000, my favorite number. Let's force the manufacturer to change the default to something else so that *I* can use *MY* number without fear.

  • Idocy cannot be hidden like that!

Slashdot Top Deals

Do you suffer painful elimination? -- Don Knuth, "Structured Programming with Gotos"

Close