More specifically, the controller is at the heart of the station and if an intruder finds a way to take over the box, the results could be catastrophic. It was an embedded box running a Linux-based controller unit that was installed with a tiny httpd server.Īccording to its manufacturer, the controller’s software is a site automation device that is responsible for managing every component of the station, including dispensers, payment terminals and more. The device we investigated was not just a tiny web interface. Further details of this research will be shared in early March at the Security Analyst Summit 2018 in Cancun. The story was covered recently by Motherboard VICE, and here we will share some of the technical details behind it. When our suspicions turned out to be true, we reported them to the vendor. What we found was a simple purple web interface that was in fact a link to a real-life gas station, and we suspected this link made the station remotely hackable.Īmihai Neiderman, then working for Azimuth security, and I investigated the findings. A few months ago, while undertaking unrelated research into online connected devices, we uncovered something surprising and realized almost immediately that we could be looking at a critical security threat.

Kaspersky deals