Dispatches from The War Against Retail Petroleum

by Rich Morahan, Richard Morahan Associates

I wrote in the April issue of Oil and Energy Magazine about gas dispenser fuel thefts that manipulated dispenser pulsars in Delaware, Nevada and Texas. Not surprisingly, the pulsar campaign has widened. The latest skirmishes have popped up in Connecticut, Pennsylvania, Nebraska, and Florida. And in Florida, pump manipulation devices aren’t even illegal. According to Senior Special Agent Roger Fuentes of the Orlando Secret Service, the pump manipulation device used in a recent attack is currently legal and appears to be designed by someone very familiar with the pulser, the sensor that measures gallons to dollars spent at the pump. Investigators report that station video surveillance shows thieves inserting the device into a gas pump in less than a minute. How did they get in? According to Orlando’s News6, “gas station video surveillance shows thieves inserting the device, which is roughly 5 inches high and 5 inches wide, into a gas pump in less than a minute. It is believed they have keys that allow them to access the pumps or in some cases, they pry the pumps open.”

Again, we can see that video surveillance is a powerful investigative tool. Unfortunately, it’s not a deterrent. The warning here is that sophisticated devices often rely on old time tactics, such as “universal” or cheap keys or poorly secured access points.

Pulsar attacks are no longer under the radar, of course. Jesse Lee, owner of PetroDefense, a distributor of pulsar security covers, reports that his sales are now nationwide, with increasing numbers of installations in northeast truck stops.

Pulsar thefts are at last getting showcased in some courtrooms as well.

In June in East Texas, Duniesky Gonzalez pled guilty to engaging in a wide string of fuel thefts that manipulated a fuel pulsar. State investigator Mick Kimbrow, a corporal for the northeast region of the Texas Comptroller of Public Accounts, explained how the gang inserted pulsar devices to alter the fuel pumps in the operation. As in Florida, the attack started with a key or a crowbar. Aggressive investigation by the Texas Comptroller of Public Accounts drove the investigation. Cases such as these suggest that the industry isn’t being attacked by opportunists looking for a quick score, but with organized gangs with shared intelligence.

If the pulsar thief relies on low tech entry on the ground to insert its sophisticated device, the other battlelines are in the air. According to the online Cybernews.com, “Thousands of exposed gas pumps invite cyberwarriors. . . And like so many other components of critical infrastructure, pumping gas relies on digital components such as controllers – the electronic devices that manage fuel dispensing. The Cybernews research team has discovered thousands of exposed gas station pump controllers, mainly in the US, that are dangerously open for attackers to abuse.”

Service stations are connected with networks, and gangs hack networks to control dispensers.

To protect gas station pump controllers from exploitation, Cybernews states that it is crucial to implement a comprehensive security strategy, which includes measures such as:

• Regular software updates and security patches to fix known vulnerabilities;
• Strong network security to protect against remote attacks;
• Physical security measures to prevent unauthorized physical access;
• Intrusion detection and monitoring systems to identify and respond to suspicious activity;
• Employee training to recognize and prevent social engineering attacks;
• Compliance with industry standards and regulations for payment card security (such as PCI DSS) and overall security.

It’s important to limit access to keys and passwords, to replace factory set passwords and upgrade shipper locks. And just as with a computer, it’s important to implement device updates to software and firmware. These are simple low cost steps that can have as big an impact as motion lights and door alarms.

The battlefield is always changing, and closing the enemy’s window of opportunity with motion lights and alarms can increase your protection, at additional cost, of course. Training your staff and installing high security locks can improve your odds at a much lower cost.

Pulsar covers, door shackles, network security, lights, and alarms. All powerful, but costly deterrents. The most cost-effective device might still be the simplest: start with a high security key system. Deter the attack at the access point.

In every pulsar bypass, someone had to get past the door. Even if you consider pulsar covers for all your pumps to be beyond your budget, a high security lock provides a perimeter defense against all but the most professional gangs. Some of those gangs are going down, but it’s going to be a long campaign.

Rich Morahan is a marketing consultant for Lock America, Inc. who writes frequently about security and marketing for a number of industries, including information management, petroleum and propane distribution and self-storage. You can contact him at 617-240-0372 or rmwriteg@gmail.com, or visit www.rmorahan.com.

Related Posts