In the recent years, an increasing number of cyber attacks have been targeting critical infrastructure, especially since the war in Ukraine has started. Automated Tank Gauging (ATG) systems are critical components in the infrastructure of fuel storage and distribution across various sectors, including commercial gas stations, military facilities, and emergency services. These systems monitor fuel levels, detect leaks, and ensure regulatory compliance, but they also present an alarming attack surface when exposed to the Internet and, by their very nature, an interesting target for malicious actors.
This presentation will cover the findings of both past and recent investigations, which identified multiple critical vulnerabilities in ATG systems from various vendors, as well as our quest to physically damage such systems remotely.
We will explore how these vulnerabilities can be exploited to alter system behaviors, disrupt fuel supply chains, potentially cause significant physical and environmental damage, as well as other out of the box scenarios.
We will show global prevalence data from our latest scans, and talk about both our coordination with CISA in order to responsible disclose all these vulnerabilities and our efforts to try to mitigate these risks at a wider scale, in several fronts - one of which is raising awareness within the infosec community.

This session is for cybersecurity professionals, industrial system operators, and anyone interested in the security of critical infrastructure. Attendees will leave with a deeper understanding of the risks posed by ATG systems and how to secure them against potential attacks.