900 Fuel Tanks Left Unguarded: The Wolves Are Sniffing Around Your Petrol Pasture
I want you to sit with this for a moment. Over 900 automatic tank gauge systems, monitoring actual physical fuel storage at critical infrastructure sites across the United States, are sitting exposed on the open internet. No fence. No tunnel. Nothing. Just a blinking port and an invitation.
I have seen some things in my career. I have seen the Flock click on fake grain disguised as a Nigerian prince. I have seen the Shepherds approve a "bring your own device" policy and then go play golf. But this. This is a special category of negligence.
An automatic tank gauge system is not a novelty. It monitors fuel levels, temperature, and leak detection at gas stations and chemical storage facilities. Physical infrastructure. The kind that, when it fails catastrophically, makes the evening news. And someone decided the correct architecture was to connect it to the internet and then, apparently, wander off.
In my day, these systems talked to a technician who drove out in a truck. Slow? Yes. Compromised by a Wolf sitting in a basement in Minsk? Absolutely not.
The researchers found over 900 of these systems with no meaningful authentication. The Wolves do not even need to be clever here. They do not need a hole in the fence. The gate is simply open, propped wide, with a welcome mat.
The Sky Pasture crowd will tell you that "connected infrastructure enables real-time monitoring and operational efficiency." Yes. It also enables a motivated Coyote to manipulate fuel readings, trigger false alarms, or, in a worst case I will not spell out because I value my blood pressure, do something considerably worse.
The Shepherds, predictably, are not quoted in any of this research. They are presumably in a meeting about Q3 synergies.
Remediation
I will keep this brief because the fixes are not complicated. They are simply unpopular.
First: Get these systems off the public internet. Run them through a proper Sheep Tunnel if remote access is genuinely required. "Genuinely required" is doing heavy lifting in that sentence. Question whether it is.
Second: If a system has no authentication, it does not belong on a network. This is not a 2024 insight. This was true in 1987.
Third: Audit your critical infrastructure exposure. Shodan will find it if you do not. The Wolves already use Shodan. I promise you they are not waiting for your quarterly review cycle.
Fourth: Apply your ointment. Patch these systems. I know they are old. I know vendors are slow. Do it anyway.
Somewhere, a dial-up modem is spinning in its grave.
Original Report: https://www.bleepingcomputer.com/news/security/over-900-us-gas-station-tank-gauge-systems-exposed-to-attacks/