Blowing Up Gas Stations For Fun And Profit

Pedro Umbelino opens with automatic tank gauges (ATGs), industrial systems that track fuel levels, water, temperature and leaks in large storage tanks at gas stations, airports, hospitals and other sites with backup generators. He explains why they matter for inventory management and for environmental compliance, and why they are risky to scan. The older serial-over-IP protocol was publicly flagged around 2015, and the talk shows that many units are still reachable online, with more of them found than before. A brute-force check of common six-digit security codes helped estimate how many exposed units were password protected.

The middle of the talk covers newer ATG models that offer web interfaces and optional legacy protocol support. Across six products from five vendors, the research found eleven critical issues, mostly basic flaw classes such as command injection, hardcoded credentials, client-side authentication logic and direct file reads. Coordinated disclosure through a partner organization took about six months before details were made public. The speaker also looked at physical impact: altering tank capacity settings could lead to overfills and spills, and toggling relays through configuration changes could wear out components and connected equipment.

The closing section sets out recommendations. Operators should remove these devices from the internet and place them behind firewalls, manufacturers should adopt secure-by-design practices and monitor their own exposed installations, and policymakers should quantify the financial risk to drive change. In the Q&A, the speaker addressed the difficulty of patching legacy units that vendors no longer support, and a question about a compromised probe supply chain.