Exposed US Gas Station ATG Systems Threaten Critical Infrastructure

A recent security assessment has revealed that over 900 Automatic Tank Gauge (ATG) systems in the United States are currently exposed to the public internet, leaving them vulnerable to unauthorized access and manipulation. These systems, which are integral to the operation of fuel and chemical storage facilities, lack basic authentication mechanisms, allowing remote actors to alter configurations, manipulate inventory data, and potentially cause physical or environmental harm. Globally, the number of exposed systems exceeds 5,800, according to BleepingComputer.

Technical Analysis of ATG Vulnerabilities

Automatic Tank Gauges are specialized industrial controllers used to monitor fuel levels, temperature, and the presence of water in underground storage tanks. They are also responsible for leak detection and triggering environmental alarms. Traditionally, these systems were isolated from external networks; however, the shift toward remote management has led many operators to connect them to the internet using serial-to-Ethernet converters or cellular gateways.

The primary technical issue resides in the use of legacy protocols, such as Serial-over-IP, which often default to port 10001. Many of these systems do not require a password for remote access. An attacker who discovers these systems via mass-internet scanning can send simple text-based commands to the device. This lack of authentication is a systemic issue within the CVE database history for industrial control systems, where legacy hardware was never designed with internet connectivity in mind.

While no specific CVE is associated with this general exposure, the TTP used by threat actors involves scanning for open ports and identifying ATG signatures. Once connected, an attacker can modify high-level alarm setpoints, disable leak detection, or spoof fuel inventory levels. Such manipulation could lead to tank overflows during deliveries or hide the theft of fuel by masking decreasing volume levels.

Impact on Critical Infrastructure

The exposure extends beyond retail gas stations. ATGs are deployed across various critical sectors, including emergency services, hospitals, airports, and military installations. The risks of exposed fuel monitoring systems include economic disruption and physical safety hazards. For instance, by triggering a false leak alarm, an attacker could force an automatic shutdown of fuel pumping operations, causing significant operational downtime for essential services.

Furthermore, the manipulation of sensor data could prevent the SOC or onsite personnel from identifying actual environmental hazards. If a real leak occurs but the system has been tampered with to show normal levels, the resulting environmental contamination could lead to severe regulatory fines and ecological damage. This type of incident would typically be logged by a SIEM if the systems were properly integrated into a monitored security architecture, but many remain siloed and unmanaged.

How to Secure ATG Systems from Remote Attacks

Securing these legacy industrial systems requires a move away from direct internet exposure toward a Zero Trust or perimeter-based security model. Organizations should prioritize the following automatic tank gauge security best practices to mitigate the risk of exploitation:

Network Segmentation and Isolation

The most effective defense is to ensure that ATG systems are never directly reachable from the public internet. Security teams should deploy firewalls to block all inbound traffic to common ATG ports (e.g., 10001) from unauthorized IP addresses. Ideally, these systems should reside on an isolated OT network segment that is physically or logically separated from the corporate IT environment to prevent Lateral Movement.

Secure Remote Access

If remote monitoring is required for maintenance or inventory management, it must be conducted through a secure encrypted tunnel. Implementing a VPN with multi-factor authentication is the industry standard for securing remote access to industrial hardware. This ensures that even if an attacker identifies the system’s IP address, they cannot interact with the serial interface without valid credentials.

Firmware Management and Configuration Hardening

While many legacy ATGs do not support modern authentication, newer models often have optional password features that are disabled by default. Administrators should review manufacturer documentation to enable any available security controls. Furthermore, regular audits of system configurations should be conducted to ensure that alarm thresholds and notification settings have not been altered by unauthorized parties.