CNN's Sean Lyngaas back once again with a belter story: Iranian hackers are behind a series of breaches of systems that monitor the amount of fuel in storage tanks serving gas stations in multiple U.S. states.

[zackwhittaker@mastodon.social]

CNN's Sean Lyngaas back once again with a belter story: Iranian hackers are behind a series of breaches of systems that monitor the amount of fuel in storage tanks serving gas stations in multiple U.S. states.

Per Lyngaas: the hackers "exploited automatic tank gauge systems that were sitting online and unprotected by passwords."

A little louder for the folks in the back:

...."UNPROTECTED BY PASSWORDS."

https://www.cnn.com/2026/05/15/politics/iran-hackers-tank-readers-gas-stations

[ireneista@adhd.irenes.space]

@zackwhittaker this of course is one of those things that the security community has been trying to get ANYONE to care about for years and years and years.

it's one of those ....... we don't want to tell people what they're feeling, but if that were an issue we'd personally worked on, we'd be so deeply sad to have been right.

[ireneista@adhd.irenes.space]

@tully @zackwhittaker no doubt

[threatresearch@infosec.exchange]

@zackwhittaker

"The hacking campaign is also a warning to many US critical infrastructure operators who have struggled to secure their systems despite years of federal exhortations."

Feds: Put a password on it, pwetty pwease

Industry: no

[neurovagrant@masto.deoan.org]

@threatresearch @zackwhittaker

THE EXACT MANUFACTURERS AND MODELS. WE'VE KNOWN THEY'D TARGET THESE FOR AT LEAST FIVE YEARS.

FIVE YEARS.

https://news.sky.com/story/irans-secret-cyber-files-on-how-cargo-ships-and-petrol-stations-could-be-attacked-12364871

[csstrowbridge@mastodon.social]

@zackwhittaker

If it is unprotected, then it is not hacking.

[danni_storm@hachyderm.io]

@zackwhittaker No one answered at CISA because no one works there anymore. It was gutted because CISA was obviously an agent of the Biden administration to embarrass Trump. Or did Biden do that too...somehow after his term ended

[xauriel@mastodon.nz]

@zackwhittaker I mean, is it even really "hacking" at that point

[mrgrumpymonkey@mastodon.social]

@zackwhittaker I stopped reading that article after 3 paragraphs. It just turned into an opinion piece after that. I want a detailed technical description as to what is going on, mostly due to the "US officials suspect Iranian hackers" claim. It sounds like they have no proof. These systems being wide open to anyone is something I've seen working in large corporate American businesses. I'd always remark how open these systems were, and no one cared.

[mbpaz@mas.to]

@zackwhittaker "breached"? How is it "breaching" a door that was already wide open?

[theorangetheme@en.osm.town]

@threatresearch @zackwhittaker Wow what a great way to sanewash negligence.

[chrisnelsonsdog@mstdn.social]

@zackwhittaker did you even read the TOS before you posted this? Do you really want me to agree with that? Do you know how to use the word Nope in a sentence?

[spacelifeform@infosec.exchange]

@zackwhittaker

Customer to clerk: Pump x is not pumping.

Clerk goes in back. Returns.

Clerk: We are out of regular, but there is premium left.

Saw this on 2024 chistmas eve.

[decapitae@mastodon.social]

@zackwhittaker the 'competency' of the tRumpsReich regime in full view

[adamshostack@infosec.exchange]

@neurovagrant @threatresearch @zackwhittaker The newsman wept as he told us.

[philsalkie@mindly.social]

@zackwhittaker

Most industrial equipment that has an Ethernet port is completely unsafe to put naked on the Internet.

But when there's an Ethernet port, somebody's gonna hang a static IP on it and put it on the Net. Because of course they are.

Most of those systems will be the default passwords, or won't stop you just brute forcing, or will even do things like telling you the password if you ask it. (It's expecting the development environment to do the password checking.)

Newer stuff is better, but there's an awful lot of stuff out there with horrid firmware and an Ethernet port.

(Fixing this sort of mess is a big part of my job.)

[trillionb@mstdn.social]

@zackwhittaker I have zero doubt there are still stations with a Win 95 box reading a bunch of PLCs and dialing a modem to report nightly status.

And they are more secure than this bs.

[cav@infosec.exchange]

@zackwhittaker oof.

And I'm sure they already know about all of the internet facing devices that monitor and control crude oil levels in tanks and can be disrupted to stop the flow of oil going into pipelines. Protected only by default user/pass. I saw that far to many times when I was the industry.

I'm sure that won't become an issue at all at some point /s

[maddad@mastodon.world]

@zackwhittaker

Which makes me wonder if they could then initiate false readings too.

[jason@logoff.website]

@zackwhittaker I mean weev went to prison for accessing things unprotected on the web. “Breach” is a dumb word here though.