Police in Detroit are looking for two suspects who allegedly managed to hack a gas pump and steal over 600 gallons of gasoline, valued at about $1,800. The theft took place in the middle of the day and went on for about 90 minutes, with the gas station attendant unable to thwart the hackers.
The theft, reported by Fox 2 Detroit, took place at around 1pm local time on June 23 at a Marathon gas station located about 15 minutes from downtown Detroit. At least 10 cars are believed to have benefitted from the free-flowing gas pump, which still has police befuddled.
Here’s what is known about the supposed hack: Per Fox 2 Detroit, the thieves used some sort of remote device that allowed them to hijack the pump and take control away from the gas station employee. Police confirmed to the local publication that the device prevented the clerk from using the gas station’s system to shut off the individual pump.
That isn’t a whole lot of information to go on. The most likely explanation seems to be that the attackers would target the fuel-management software used by the gas station. Motherboard pointed out earlier this year that at least one maker of such software was, at some point, vulnerable to attacks that would allow malicious actors to manipulate gas prices and steal fuel.
These systems have long been considered potential targets because many include web-based interfaces. Security firm TrendMicro reported in 2015 that a number of gas-monitoring systems were easy to find online using Shodan, a search engine for internet-connected devices, and other tools that can scan for open ports. Most of those systems were discovered to not be password protected, allowing anyone with enough know how to hijack the controls.
Even then, there’s a lot of unanswered questions regarding the theft, including what the device could have been and how it apparently blocked the gas station attendant from shutting down the pump. The employee described his experience during the incident to Fox 2 Detroit:
“I tried to stop it but it didn’t work,” Aziz Awadh told us. “I tried to stop it here from the screen but the screen’s not working. I tried to stop it from the system; nothing working (sic).”
Aziz says the system wouldn’t respond and it wasn’t until he says he got an emergency kit that he was able to shut the pump down, and then call police.
These types of gas thefts seem to have become a trend in the last couple months. Just a few days before the incident in Detroit, a man in Texas was accused of using a “device” to steal $800 worth of gas from a gas station after hours. Last month, it was discovered that a BP employee in New Jersey manipulated computer records for years to steal more than $300,000 worth of gas from the company.