Thousands of fuel gauges accessible on the Internet could be hacked and dangerously misused

“Experts we spoke with expressed particular concerns about the ability of an attacker to remotely change the tank settings,” the researchers said. “Alarms are very important for gas station attendants to know when the tank is almost full and have enough time to stop refueling. Without alarms, the likelihood of a leak increases significantly, which, depending on the type of fuel, can lead to a dangerous situation.”

Other attacks might involve reconfiguring the system, erasing values, or reflashing the device with faulty firmware, which would cause ATG system downtime. Attackers could also obtain information about fuel consumption patterns that could help them prepare other destructive attacks or allow them to make a tank disappear from monitoring entirely and then physically steal fuel from it.

“We were surprised that organizations affected by these new vulnerabilities include airports, government systems, manufacturing and utilities,” the researchers said. “One thing is clear when it comes to ATG systems in general and these new vulnerabilities in particular: the United States is by far the most affected country.”