Iran Suffered A Cyber Attack Shutting Down Smart Gas Stations With Hacked Electronic Signs Allegedly Mocking The Supreme Leader
Iran’s President Ebrahim Raisi acknowledged a massive cyber attack that disrupted gas stations across the country, blaming it on an unnamed country allegedly seeking to create disorder and disruption.
The attack disabled a system that allows consumers to buy subsidized fuel with government-issued electronic cards.
The semi-official ISNA news agency reported that buyers encountered a cryptic message reading, “cyberattack 64411.” The numbers represent a telephone hotline to Iran’s Supreme Leader Ayatollah Ali Khamenei that answers questions on Islamic law.
ISNA later withdrew the report claiming it was also a victim of a cyber attack, a tactic frequently used to avoid offending the powerful clergy.
Observers noted that the attack occurred close to the second anniversary of the deadly protests sparked by hikes in fuel prices in November 2019.
According to President Raisi, the incident highlighted the need for his country’s cyberwar preparedness.
Most Iranian gas stations resume operations after a devastating cyber attack
The state-run IRNA news agency reported that 80% of gas stations would be operational by Nov 27 morning.
Reuters reported that half of the Iranian gas stations had resumed operation manually on Nov 27 after the cyber attack that compromised their smart systems, causing disruptions.
The attack coincided with social media videos alleged to show electronic hacked electronic signs that read “Khamenei, where is our gasoline?” Others hacked signs reportedly showed “Free gas in Jamaran gas station.” The late Supreme Leader Ayatollah Ruhollah Khomeini hails from the region.
Iran’s cyber attack caused long queues and price hike rumors
According to the local media, the attack caused long queues at gas stations across Iran. A senior Iranian official stated that the attack disrupted all the 4,300 gas stations in the country. State television also broadcasted long lines of cars waiting to fill up at a gas station in Tehran.
However, the ministry of oil claimed that the attack only affected gas stations accepting smart cards for subsidized fuel, and motorists could buy gas at high prices from other stations. It also allayed fears of rising gasoline prices.
International sanctions leave Iran vulnerable to cyber attacks
Iran has faced multiple sanctions from the international community over its nuclear ambitions. These sanctions have made it difficult for the country to acquire new technology to protect its infrastructure, leaving it vulnerable to cyber attacks.
However, the country insists that it’s on high alert for online attacks originating from its traditional adversaries.
No group has admitted to being responsible for the attack. However, the secretary for Iran’s Supreme Council of Cyberspace Abolhassan Firouzabadi was confident that it was carried out by a foreign country.
“I haven’t previously seen an attack on the pumps of gas stations themselves, which this appears to be (the “cyberattack” message appearing on the pumps would most likely have to be loaded into the software that runs the distribution/pumps or card verification network),” said Jonathan Couch, Senior Vice President Strategy at ThreatQuotient. “The approach is unique in my experience and I am hoping more information is disclosed on where the attack actually targeted. This doesn’t appear to be an attack against the OT (extraction, production, or distribution) networks that supply the gas stations.”
“I think this attack could be the actions of a nation-state looking to undermine government confidence, but my gut is telling me that this might just be activists within the country. It will be interesting if any more information comes out around the attack: is there any kind of cybercrime angle to the attack where money was actually made and it was made to look like activists?”
The U.S. and its allies have historically blamed Iran for multiple cyber attacks against government infrastructure. Similarly, Iran has counter-accused its enemies the U.S. and Israel of being responsible for multiple cyber attacks.
“It would be interesting to see who claims responsibility for this attack,” said Steve Daniels, Head of vCISO at Cyvatar. “It appears to be politically motivated and for me highlights the need to effectively manage the security of critical national infrastructure.”
Earlier this year, Iran’s transport ministry and train services suffered cyber attacks in July. The hackers also posted Iran’s Supreme Leader’s number as the helpline for more information.
These incidents bore the hallmarks of the latest attack on Iran gas stations that read cyberattack 64411, a number associated with Khamenei.
“There is a possibility that the attack, like a previous one on the railway system, has been conducted from abroad,” Firouzabadi noted.
Israeli cybersecurity firm Check Point attributed the latest cyber attack to a hacking group named Indra, the Hindu god of war. Misattribution of a cyber attack could lead to retaliation on the wrong opponent, further escalating tensions in the Middle East, which are always close to the tipping point.
“It’s still very early in the incident timeline, and information on the root cause and details of this incident are going to remain scarce for a while,” said Tim Erlin, VP of Strategy at Tripwire. “We should expect that Iran will only share the information they deem advantageous and that there will be a lot of conjecture about what actually happened here.
“Ultimately, it’s hard to take much away from this incident today other than a growing body of evidence that infrastructure is the next big cyberattack surface. Organizations that manage critical infrastructure should ensure their systems are hardened, as this helps to safeguard the integrity of digital assets and protect against threats and vulnerabilities.”
