Security Problems with Gas Station Automated Tank Gauges

[HD Moore] recently posted an article on Rapid 7’s blog about an interesting security problem. They’ve been doing some research into the security of automated tank gauges (ATGs). These devices are used at gas stations and perform various functions including monitoring fuel levels, tracking deliveries, or raising alarms. [Moore] says that ATGs are used at nearly every fueling station in the United States, but they are also used internationally. It turns out these things are often not secured properly.

Many ATG’s have a built-in serial port for programming and monitoring. Some systems also have a TCP/IP card, or even a serial to TCP/IP adapter. These cards allow technicians to monitor the system remotely. The most common TCP port used in these systems is port 10001. Some of these systems have the ability to be password protected, but Rapid 7’s findings indicate that many of them are left wide open.

The vulnerability was initial reported to Rapid 7 by [Jack Chadowitz]. He discovered the problem due to his work within the industry and developed his own web portal to help people test their own systems. [Jack] approached Rapid 7 for assistance in investigating the issue on a much larger scale.

Rapid 7 then scanned every IPv4 address looking for systems with an open port 10001. Each live system discovered was then sent a “Get In-Tank Inventory Report” request. Any system vulnerable to attack would respond with the station name, address, number of tanks, and fuel types. The scan found approximately 5,800 systems online with no password set. Over 5,300 of these stations are in the United States.

Rapid 7 believes that attackers may be able to perform such functions as to reconfigure alarm thresholds, reset the system, or otherwise disrupt operation of the fuel tank. An attacker might be able to simulate false conditions that would shut down the fuel tank, making it unavailable for use. Rapid 7 does not believe this vulnerability is actively being exploited in the wild, but they caution that it would be difficult to tell the difference between an attack and a system failure. They recommend companies hide their systems behind a VPN for an additional layer of security.

[Thanks Ellery]

Bluetooth Enabled Fuel Consumption Monitor

[Malebuffy] bought himself a used boat last year. Fuel isn’t exactly cheap where he lives, so he wanted a way to monitor his fuel consumption. He originally looked into purchasing a Flowscan off the shelf, but they were just too expensive. In the interest of saving money, [Malebuffy] decided to build his own version of the product instead.

To begin, [Malebuffy] knew he would need a way to display the fuel data once it was collected. His boat’s console didn’t have much room though, and cutting holes into his recently purchased boat didn’t sound like the best idea. He decided he could just use his smart phone to display the data instead. With that in mind, [Malebuffy] decided to use Bluetooth to transmit the data from the fuel sensors to his smart phone.

The system uses an older Arduino for the brain. The Arduino gets the fuel consumption readings from a Microstream OF05ZAT fuel flow sensor. The Arduino processes the data and then transmits it to a smart phone via a Bluetooth module. The whole circuit is powered from the boat battery using a DC adapter. The electronics are protected inside of a waterproof case.

[Malebuffy’s] custom Android apps are available for download from his website. He’s also made the Arduino code available in case any one wants to copy his design.

Biodiesel equipment hacks


[Oldman] took on a biodiesel project for some friends a few years ago. A fully operational processing rig was never achieved, but he did document some of the successful hacks he came up during the project.

The idea is to reclaim the waste oil from restaurants and burn it in your modified racing motorcycle or other mode of transportation. That makes it sound easy, but have you ever seen what happens to bacon fat after it cools? Granted, we’re talking oil from vegetable sources but the same type of coagulation presents itself. Pumping it through a processing rig becomes especially tough in the winter, and that’s why [Oldman] came up with the heated pump head on the right. It’s got three connections; two are part of a loop of copper tubing, allowing 150 degree water to be circulated to liquefy the grease. The third connection sucks up the melted oil. You also need to regulate the water content of the fuel. The inset images of a salad dressing jar are his test runs with applying vacuum to dehydrate the fuel. He learned that it needs to be heated slightly to reduce foaming. He had planned to scale up this concept to apply vacuum to fuel stored in propane tanks.

Briquette press for rocket stove fuel


[Gregory] uses a rocket stove for heating when it’s cold outside. He’s been trying out all kinds of different materials as fuel when the idea of making his own briquettes from waste materials came to mind. Obviously the project works. As you can see in the image above, he has just formed a lump of fuel using a mixture of newspaper pulp and sawdust.

The orange device with the ax handle seen in the background is his own creation. You can see the device in action in the video after the break. In the video comments he also links to a CAD file if you’re interested in building your own.

If it’s a rocket stove you’re interested in there’s always the option of building your own.

Continue reading “Briquette press for rocket stove fuel”

Hybrid rocket engine uses acrylic as fuel

We are fascinated by the hybrid rocket engine which [Ben Krasnow] built and tested in his shop. It is actually using a hollow cylinder of acrylic as the fuel, with gaseous oxygen as an oxidizer. We’re already quite familiar with solid rocket propellant, but this hybrid approach is much different.

When a rocket motor using solid propellant is lit it continues to burn until all of the fuel is consumed. That is not the case with this design. The acrylic is actually burning, but if the flow of oxygen is cut off it will go out and can be ignited later. This also opens up the possibility of adjusting thrust by regulating the pressure of the oxygen feed.

[Ben] milled the test rig in his shop. It’s a fat acrylic rod through which he bored a hole. There are two aluminum plates which complete either end of the chamber. The intake has a fitting for a valve which connects to the oxygen tank. There is a nozzle on the outflow end. Check out the video after the break to see a full description. You’ll also get a look at the toll the combustion heat takes on the rig.

Continue reading “Hybrid rocket engine uses acrylic as fuel”

Rocket propellant manufactured from old newspaper

It turns out that old newsprint can be a bit explosive; at least when it’s combined with the proper ingredients. [Markus Bindhammer] worked out a way to make solid rocket propellant from newspaper. Judging from the test footage after the break the home made engines work great!

There isn’t a long list of ingredients. In addition to newspaper you’ll need some potassium chlorate (KClO3) which serves as an oxidizer, white wood glue, and PVC pipe. The KClO3 is ground with a mortar and pestle, then run through a sieve before being combined with the wood glue. This combination is painted on the newspaper which is then rolled up with a glass rod at the center. This is allowed to harden before going into the PVC. The excess is trimmed and the whole thing is baked in a convection oven at 105 C for two hours.

If this process doesn’t suit you maybe cooking up a batch of sugar-based propellant is worth a try?

Continue reading “Rocket propellant manufactured from old newspaper”

More 555 Projects to Enjoy

We love all of the projects that are coming out for the 555 design contest, so we thought we would share a couple more that have caught our collective eye.  Have a 555 project of your own? Be sure to share it with us, and keep an eye out for the contest submission dates. Read on for a few of our project picks.

Continue reading “More 555 Projects to Enjoy”