Hacker News Reader

Comment by tromp | Hacker News Reader

What good reason is there for a pump to release gas for free through some Bluetooth interface? This hack proves you cannot rely on unauthorized people not able to learn how to interface or guess a (default) password. Setting up a proper public key infrastructure so that only authorized technicians can make use of the feature is probably not practically or economically feasible. It would be better to simply not have this feature at all.

View on HN

If your job is to maintain the pump you should have a measured container, then you dispense 1 gallon, check that what came out was one gallon - if not adjust various "things" until it is. They then dump the gasoline back in the tank. This is carefully regulated and checked by the state who does random checks as well. (it is also possible they do other chemical checks on the fuel - most just trust the refinery to do everything and have enough turn over that the fuel is close enough to fresh but there might be some exception)

I'm not sure if the station themselves do the above check, or someone else. Based on other equipment I've worked on I'd expect this to be done weekly by the station, but I don't actually know what the service intervals on a gas pump is.

I have no idea how this hack is done/no insider knowledge but reading between the lines, I suspect that they're altering the pump in a manner that sets the cost per gallon to zero or near-zero.

It could be a MITM device between the flow sensor and the controller. It could adjust the flow reading to read much less than what is actually coming out or possibly zero. The controller doesn't have any way to verify the number and it's expected that the flow can change based on the condition of the pump and filters so a very slow reading isn't unreasonable. Add Bluetooth to the device and you can turn the hack on or off at will so it will go unnoticed. Clearly this guy took so much gas that someone did notice. Steal a candy bar from a 7/11 every week and no one will notice, steal the entire candy aisle once and they definitely will.

Reply on news.ycombinator.com