U.S. Agencies Warn of Attacks on Internet-Exposed Fuel Tank Systems

Summary

U.S. agencies report attacks on internet-exposed automatic tank gauge systems, where weak authentication and software flaws can enable settings or alerts to be changed. They urge operators to remove internet exposure and strengthen access controls.

Key points

• CISA, the FBI, the NSA, the Department of Energy and other U.S. partners say attackers are targeting internet-exposed automatic tank gauge (ATG) systems.
• Reported access methods include authentication bypass, hardcoded credentials, command-execution flaws, SQL injection and privilege escalation.
• Attackers may alter network settings, tank volumes and pump controls, or disable alerts, potentially hindering leak monitoring and raising the risk of leaks or equipment failures.
• Agencies recommend removing ATG systems from direct internet exposure, restricting remote access, replacing default passwords, using strong credentials and multifactor authentication, applying updates, and monitoring for unauthorized changes.
• The advisory does not attribute the activity to a specific actor. CNN previously reported suspected Iranian involvement in separate gas-station ATG incidents, but said attribution may be difficult due to limited forensic evidence.

Countries

Industries