CISA warns of cyber attack targeting fuel tank monitoring system

CISA, FBI, NSA, Division of Power, and different U.S. authorities companions are warning that hackers are focusing on automated tank gauging (ATG) methods which are uncovered on the web and are used to watch gasoline and liquid storage tanks throughout a wide range of essential infrastructure sectors.

Cybersecurity companies say ATG methods are generally used within the vitality, chemical, meals and agriculture, and transportation methods sectors to remotely monitor storage tank ranges, temperatures, and potential leaks.

The US authorities says risk actors are focusing on uncovered units and altering system settings via command execution.

“Latest malicious cyber exercise noticed by authoring organizations (which the U.S. authorities has not but recognized as being by nation states or risk actor teams) includes cyber attackers compromising internet-exposed ATG methods after which modifying them via command execution,” the advisory states.

In keeping with these companies, attackers are gaining entry via authentication bypass vulnerabilities, hard-coded credentials, working system command execution flaws, SQL injection vulnerabilities, and privilege escalation vulnerabilities.

As soon as a system is efficiently compromised, the attacker could change community settings, product identifiers, tank capability, and pump controls. Turning off alerts may create a scenario the place operators are unable to correctly monitor tank fill ranges, rising the chance of leaks and tools failure.

The company urged organizations to dam ATG methods from the Web, restrict distant entry via firewalls, VPNs, or entry management lists, change default passwords, use robust credentials and multi-factor authentication, apply safety updates, and actively monitor methods for unauthorized modifications.

Iranian hackers have been concerned in comparable actions earlier than

The advisory doesn’t attribute the exercise to a selected attacker, nevertheless it follows CNN’s report in Could that Iranian hackers had been behind a sequence of breaches involving ATG methods at fuel stations in a number of states.

In keeping with CNN, attackers exploited ATG methods that had been linked to the web and guarded with weak or non-existent passwords, permitting them to entry and manipulate displayed values. Nonetheless, the attacker didn’t change the precise gasoline stage.

The incident reportedly didn’t trigger any bodily harm, however raised issues that an attacker might doubtlessly intrude with leak detection and different safety-related options.

CNN reported that Iran is the prime suspect due to its historical past of focusing on gasoline administration methods and different industrial management expertise.

Nonetheless, folks briefed on the investigation stated it is probably not potential to attribute the exercise to a selected attacker due to the restricted forensic proof left behind by the assault, CNN reported.

CISA and its companions stated organizations working ATG methods ought to evaluation their publicity and instantly implement really useful mitigations to cut back the chance of safety breaches.