Online Systems of Fuel Storage Tanks Under Attack

By Netvora Tech News

The Dutch Institute for Vulnerability Disclosure (DIVD) has warned that online accessible systems used by vital organizations such as gas stations and military bases are being targeted by attackers. These systems, known as Automated Tank Gauge (ATG) systems, are used to measure the fuel level in storage tanks, track deliveries, raise alarms in case of problems, and perform leak tests.

ATG systems have been accessible from the internet without passwords for over a decade, according to the DIVD. This has allowed attackers to see the fuel level, modify information and values, and even adjust critical monitoring parameters. The organization has reported actual incidents where attackers have adjusted tank information, conducted reconnaissance, and even launched DDoS attacks against these systems.

Risks to Vital Infrastructure

The exposed systems are not only used by gas stations but also by military bases, hospitals, airports, emergency services, and power plants. This vulnerability poses a significant threat to the safety of the critical infrastructure.

Recommendations to Mitigate the Risk

The DIVD has begun scanning for online accessible ATG systems and warning their owners. It recommends placing these systems behind a VPN or using dedicated hardware to connect them. Additionally, the organization advises filtering IP addresses to allow only trusted networks to access the systems, setting passwords for serial ports, implementing firewalls, and considering the use of a mobile gateway with a private APN for monitoring.

Consequences of Ignoring the Warning

If these vulnerabilities are not addressed, the consequences could be severe. Attackers could disrupt the operations of critical infrastructure, compromising the safety of people and the environment.

The DIVD has already reported actual incidents of attackers adjusting tank information, conducting reconnaissance, and launching DDoS attacks.
The exposed systems are not only used by gas stations but also by other vital organizations.
The vulnerability poses a significant threat to the safety of the critical infrastructure.

By addressing these vulnerabilities, organizations can protect their systems and the critical infrastructure they support.