HLSSWk4
Rawono1
TheVulnerableMaritimeSupplyChain-aThreattotheGlobalEconomy-SecurityWeek.pdf
By Kevin Townsend
May 18, 2022
ICS/OT
The Vulnerable Maritime Supply Chain – a Threat to the Global Economy
TREN D I N G
1 BlackCat Strikes Back: Ransomware Gang “Unseizes” Website, Vows No Limits on Targets
2 Outlook Plays Attacker Tunes: Vulnerability Chain Leading to Zero-Click RCE
3 MongoDB Confirms Hack, Says Customer Data Stolen
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
Merchant vessels and ports are extraordinarily vulnerable to
increasingly sophisticated cyberattacks against OT systems
Around 90% to 95% of all shipped goods at some stage travel by sea. This makes the global maritime industry the world’s single largest and most important supply chain. Successful cyberattacks against the maritime supply chain would have the potential to damage individual companies, national finances and even the global economy.
Attack vectors
The maritime sector includes the ports and the vessels that use them. The vessels range from small freight carriers to oil supertankers, super cargo carriers transporting in excess of 20,000 20-feet containers, and superyachts carrying high value individuals. While the port authorities are already under threat and attack by ransomware gangs, less attention has been paid to the threat of attacks against the vessels.
The merchant maritime sector functions with vessels that have been operational for anything from a few years to a few decades. The older vessels have had new
4 SMTP Smuggling Allows Spoofed Emails to Bypass Authentication Protocols
5 Xfinity Data Breach Impacts 36 Million Individuals
6 ESET Patches High-Severity Vulnerability in Secure Traffic Scanning Feature
7 Mozilla Patches Firefox Vulnerability Allowing Remote Code Execution, Sandbox Escape
8 Google Rushes to Patch Eighth Chrome Zero-Day This Year
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
technology added to improve efficiency through digitization and automation. Updating this technology can be very expensive and will depend on various criteria: opportunity, cost/risk assessments, economic strength of the company, and regulatory requirements. The result is that many ships in the merchant maritime sector are vulnerable to cyberattack.
Superyachts tend to be new and packed with the very latest gadgetry. They tend to be more secure, although successful compromise offers an attacker greater control over the vessel. For example, a successful attack could give remote control over both throttle and rudder.
John Sheehy, SVP of research and strategy at IOActive, points to three primary paths for an attacker to gain access to a vessel. “There’s WIFI; some vessels have High Frequency (HF) radio; and commercial satellite communications (SATCOM) such as Inmarsat,” he told SecurityWeek. To these we should add the USB stick - carrying insider, and earlier compromises to the vessel’s own supply chain.
The satellite communications often combine Inmarsat and GPS, and he
Business Email Address...
Subscribe
Register
Register
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Virtual Event: Cyber AI & Automation
Summit
Wednesday, December 6, 2023
Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.
Virtual Event: Cyber Insurance &
Liability Summit
Wednesday, January 17, 2024
As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.
E XPER T INS IGHT S
Every “Thing” Everywhere All at Once
Every asset in an organization’s inventory that is not accounted for and protected is a
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
considers this to be the primary threat vector – adding, “We know that a Russian APT group has the capability to remotely exploit the same types of SATCOM terminals used in maritime environments on vessels.”
Tom Van De Wiele, principal technology and threat researcher at F-Secure, adds, “Attacks aimed at communication links can be targeted at either the vessel communication links themselves using satellite communication or the port infrastructure on shore used to communicate with the vessels at sea. This is linked to the back-end systems of the shipping IT infrastructure for container and ship monitoring systems.”
A D V E R T I S E M E N T . S C R O L L T O C O N T I N U E R E A D I N G .
potential attack vector that an attacker can use to gain access or move undetected. (Danelle Au)
Beyond the Noise: Appreciating the Quiet Work of Effective Doers
More often than not, we are grateful for and celebrate the wrong people. It is incumbent on
all of us to take the time to appreciate and acknowledge the doers in our lives. (Joshua Goldfarb)
Outside the Comfort Zone: Why a Change in Mindset is Crucial for Better Network Security
Stepping outside the confines of our comfort zone and embracing a mindset that prioritizes
adaptability, shared responsibility, risk- awareness, and preparedness is indispensable in fortifying defenses in the modern distributed network. (Matt Wilson)
Burn and Churn: CISOs and the Role of Cybersecurity Automation
Organizations need to listen to their CISOs and start turning to cybersecurity automation for the
qualitative benefits of employee satisfaction and well-being. (Marc Solomon)
5 Critical Steps to Prepare for AI-Powered Malware in Your Connected Asset Ecosystem
AI-powered attacks will become progressively more common, and a well-rounded security approach
involves more than simply managing incidents effectively. (Rik Ferguson)
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
Learn More About Maritime Cybersecurity at
SecurityWeek’s ICS Cyber Security Conference
Practical and theoretical effects of maritime supply chain damage
There are no known serious examples of vessel compromise, but the potential effect can be seen in genuine maritime mishaps and in theoretical analyses. Genuine mishaps would include the Torrey Canyon in 1967, and the Ever Given in 2021.
The supertanker SS Torrey Canyon ran aground on rocks off the south- west coast of the UK, spilling an estimated 100+ million liters of crude oil. The ensuing environmental catastrophe led to aircraft from the Royal Navy and the Royal Air Force bombing the wreck to ignite the spillage.
The Ever Given, a 400 meters long container ship that can carry more than 20,000 containers, ran aground in the Suez Canal in March 2021, and blocked it. The knock-on effect of this blockage was immense. Professor Kevin Jones, the executive dean of science and technology at Plymouth university (UK), comments. “Closing down one maritime supply route can cause a knock-on log jam
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
that affects the world economy at the rate of billions of dollars every day,” he told SecurityWeek.
“There have been various estimates about the cost of the Suez closure, but some of them are as high as ten or eleven billion dollars a day, and those estimates were done before it was clear how long and how expensive it would be to clear the backlog that the blockage caused. Months later, there were still ships queuing up to get into Port of Los Angeles because the whole scheduling pattern had been broken.”
Jones is the lead for the Universities Maritime Cyber Threats Research Group. He runs a cyber risk laboratory at Plymouth – and was instrumental in developing the MaCRA (marine cyber risk assessment) technology. His team did a theoretical analysis on the potential effect of closing just four major UK ports, perhaps by causing a blockage like the Ever Given. It was a thought experiment, but no less valid for that.
“If you look at things like oil reserves, fresh food reserves, and other critical things within the UK, we have some reserves but need to receive new shipments daily. The UK has about
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
11 significant ports, but most container shipments come through just four ports. If those ports were effectively jammed in the ways we’ve shown we can do for other ports, it would mean that the supply of goods coming into the UK would drop dramatically – for the sake of discussion, very close to zero.”
Removing the blocking vessels would take weeks rather than days. “Assuming the attacker could pick the conditions, coordinate the attacks in the way they want to – which is difficult, but not impossible,” he continued, “you’ve basically cut off the supply of goods to the UK: we’re not getting fresh foodstuffs and we’re not getting oil. Very quickly we’ll arrive at the point where power stations no longer have the capacity to run. There are strategic reserves that could be released, but there are consequences and logistic difficulties to doing that. So, you start losing power, you start losing freezer capacity – and frozen stores, both in homes and in bulk storage, go rotten within a week. You cascade all these effects – including loss of fuel for transport– and it is not long before you have a catastrophic failure of systems. It’s not the most likely
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
scenario, but it is a scenario that is well within the bounds of possibility.”
A similar exercise was done in the US by University of Illinois Urbana- Champaign. “They looked at closing just one port in Florida,” said Jones, “and they got to the point in their thought experiment where people on the east coast were shooting each other quite quickly. The general principle is that we are highly dependent on pretty much real-time resupply via shipping. Cut that out for a while, and you’ve got a real problem.”
Attacker motivations, means and threat scenarios
Motivations for attacking the maritime sector are fundamentally no different to those for any other industry sector. They include ethical/political (hacktivists), financial (cybercriminal gangs), and geopolitical (nation states). Hacktivism may appear the least likely, but there is no technical reason to prevent an attack against a vessel by a determined and well- resourced hacktivist group.
The nation-state threat is perhaps the most concerning, which currently includes but goes beyond the
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
Russia/Ukraine war. “For a number of years, it’s been known that in the northwest region around Russia GPS satnav is unreliable,” comments Jones. “It’s unreliable because Russia has been broadcasting spoofed GPS signals. Ships’ captains have reportedly said, ‘I suddenly find myself in the middle of a playing field three miles inland, but when I look out the window, the ocean is still there.’”
In February 2022, the US Office of the Director of National Intelligence issued its annual threat assessment, saying, “Russia is investing in electronic warfare and directed energy weapons to counter western on-orbit assets. These systems work by disrupting or disabling adversary C4ISR [command, control, communications, computers, intelligence, surveillance, and reconnaissance] capabilities and by disrupting GPS, tactical and satellite communications, and radars.”
And on March 17, 2022, CISA issued an alert warning about “possible threats to US and international satellite communication (SATCOM) networks. Successful intrusions into SATCOM networks could create risk
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
in SATCOM network providers’ customer environments.”
“There is evidence that nation states, and Russia in particular, have been experimenting with things like compromising GPS,” continued Jones. “If you go back to previous generations of warfare where things like the Atlantic convoys were a vital lifeline to keep the country going, the attack method was submarines. Today it might well be misdirection to run aground on a sandbank and be delayed until the next spring tide can float you off, or crashing into breakwaters and losing cargo in that way. You can imagine it as a cyber/physical extension of the kind of cyber softening attacks that have been seen in several recent geopolitical campaigns.”
Casey Bisson, head of product and developer relations at BluBracket, comments, “The maritime industry, like all industries, is becoming increasingly dependent on industrial IoT and connected devices. Common IoT risks like weak default credentials, undocumented backdoors, and vulnerabilities that allow unauthorized remote access and control are especially concerning on vessels. Vessels at sea and in port
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
are both vulnerable to disruption and could potentially be used as weapons in larger state conflicts.”
IOActive’s Sheehy has similar concerns. “The War in Ukraine has caused part of the Black Sea and the Sea of Azov to become impassable, which necessarily limits exports and imports to both Russian and Ukrainian Black Sea ports. Of particular concern is Odessa, Ukraine, which is the largest commercial port on the Black Sea. The Russians could choose to use deniable cyber operations as a step up the escalation ladder to impose a cost on those countries who have imposed sanctions on them. Moreover, judicious operations could produce global effects as we saw with the blocking of the Suez Canal by the Ever Given, which was a result of pilot error.”
An extension to the spoofed GPS signals that might confuse a ship’s captain is interference to the ship’s Automatic Identification System (AIS). This could be an approach taken by cybercriminal gangs as part of a piracy scenario. These systems broadcast identification and location information so that both other ships and shore-based authorities know
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
exactly what ship is where. A compromised AIS could transmit either wrong information (making the ship appear to elsewhere) or no information (making it effectively an invisible ghost ship).
Jones described an example of a theoretical attack against a superyacht (although the basic principles could be harnessed against any vessel).
“Being able to get access to the systems on board the yacht,” he explained, “and to know what the plan is (that is, the charted route), and maybe even to monitor comms to know who’s on board; and then to use a hack on the charting system, you could misdirect the yacht so it thinks it is staying nicely clear in international waters, but you bring it within fast boat range of the Somali coast. At the same time, alter the AIS transponder system so that the vessel is reporting itself as being somewhere, let’s say north, of where it is supposed to be while it has gone way south. Fast gunboats can come out and take the crew hostage. The yacht may have broadcast an emergency alert, and an interdiction ship may have been dispatched – but it will go to where the AIS is
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
reporting the location. So, there’s a mismatch between actual and reported location, which reduces the risk for kidnappers.”
The maritime sector is already in the crosshairs of the ransomware gangs. “We have certainly seen ransomware affect maritime shipping,” John Bambenek, principal threat hunter at Netenrich, told SecurityWeek. “The entire ecosystem is supported by IT systems. When they are compromised, ships may have to wait in port for it to be sorted out, or goods cannot be shipped outbound to their customers. The net effects will look much like supply chain disruptions we have seen over the last year.”
Jasmine Henry, field security director at JupiterOne, agrees that the port itself is a vulnerable part of the maritime ecosphere. “The reason is simple,” she said. “The majority have limited visibility into ICS systems to even understand which devices exist, let alone apply proper updates or configurations. Merchant vessels and ports are extraordinarily vulnerable to increasingly sophisticated ransomware attacks against unmanaged OT systems, as well as DDoS attacks, command
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
injection, sideloaded malware, and exploited misconfigurations.”
So far, we have seen little evidence of criminal attacks against vessels. “We’ve seen examples of shipping companies being attacked by ransomware,” adds Jones. “They’re not yet the catastrophic attacks with cyber/physical threats that we’ll run your ship aground, play with the ballast and capsize it, or dump its cargo of oil…” But that is surely the logical extension of what is already happening, and what could be done in the future.
The cyber reality
“One of the weird things about my job,” said Professor Jones, “is that I get to look at all the truly horrible things you can do by taking control of a ship. But I try not to be too melodramatic, because there are too many over-hyped horror stories in cybersecurity. While I don’t want small freight companies to go out of business because they cannot afford hundreds of thousands of pounds to update their ships, there is certainly the possibility of both criminal extortion and nation state geopolitical activity using vessels. With some vessels, it would be very hard to mitigate against an attack –
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
sometimes, the crew will have less than a minute to respond – so an attacker with sufficient skill and determination has a high probability of success.”
What is missing from the maritime sector is the ability to do genuine and regular risk assessments. The risk is different for each vessel, and varies depending on the route, cargo, and external threat conditions. To try and solve this problem, Jones and Plymouth university developed the MaCRA maritime cyber risk assessment software. It can provide a continuous risk assessment for individual vessels depending on the state of their onboard technology, their location and the route they are taking, and the cargo they are carrying.
The bottom line today, however, is that the global economy’s single biggest supply chain is vulnerable to cyberattack.
Learn More About Maritime Cybersecurity at
SecurityWeek’s ICS Cyber Security Conference
Related: U.S. Releases Cybersecurity Plan for Maritime Sector
Related: U.S. Coast Guard Issues Cybersecurity Warnings for
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
Commercial Vessels
Related: DEF CON Wrap-Up: Hacking Phones, Cars and Satellites
Related: Maritime Cybersecurity: Securing Assets at Sea
WRITTEN BY
Kevin Townsend
Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long- gone computer magazines.
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
CISO Conversations: Three Leading CISOs in the Modern Healthcare Sector
Meta Takes Action Against Multiple Foreign In�uence Campaigns
Hacktivism: What’s in a Name… It May be More Than You Expect
Bad Bots Account for 73% of Internet Tra�c: Analysis
Zip Raises $7.7 Million to Expand SMB Cybersecurity Business
Hacker Conversations: Chris Wysopal, AKA Weld Pond
Top 10 API Security Threats for Q3 2023
New MacOS Malware Linked to North Korean Hackers
In Other News: Crypto Exchange Hack Guilty Plea, Rating AI Vulnerabilities, Intellexa Spyware
Iranian Hackers Targeting US Defense Industrial Base Entities With New Backdoor
Inmate, Sta� Information Stolen in Rhode Island Prison Data Breach
CISA Warns of FXC Router, QNAP NVR Vulnerabilities Exploited in the Wild
Malicious GPT Can Phish Credentials, Ex�ltrate Them to External Server: Researcher
Cisco to Acquire Isovalent, Add eBPF Tech to Cloud Portfolio
Celebrities Found in Unprotected Real Estate Database Exposing 1.5 Billion Records
ESET Patches High-Severity Vulnerability in Secure Tra�c Scanning Feature
More from Kevin Townsend
Latest News
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
Comments for this thread are now closed
Share
Best Newest Oldest
×
0 Comments 1 Login
This discussion has been closed.
ALSO ON SECURITYWEEK | CYBERSECURITY SECURITY NEWS AND ANALYSIS
DataData … … 2 days ago
BeyoBeyo 2 month
Related Content
Cyber Insights 2023 | Ransomware
Kevin Townsend
Cyber Insights 2023 | The Coming of Web3
Kevin Townsend
Cyber Insights 2023 | Supply Chain Security
Kevin Townsend
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
Cyber Insights 2023 | Quantum Computing and the Coming Cryptopocalyps e
Kevin Townsend
The Five Stories That Shaped Cybersecurity in 2022
Ryan Naraine
Cyber Insights 2023 | Artificial Intelligence
Kevin Townsend
Cyber Insights 2023 | ICS and Operational Technology
Kevin Townsend
Why CISOs Make Great Board Members
Galina Antova
Cybersecurity News
Industrial Cybersecurity
Virtual Cybersecurity Events
Webcast Library
CISO Forum
ICS Cybersecurity Conference
Cybersecurity Newsletters
Cyber Weapon Discussion Group
RSS Feed
Security Intelligence Group
Follow SecurityWeek on LinkedIn
Advertising
Event Sponsorships
Writing Opportunities
Feedback/Contact Us
Popular Topics Security Community Stay Intouch
About SecurityWeek
News Tips Advertising
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
Got a con�dential news tip? We want
to hear from you.
Submit Tip
Reach a large audience of enterprise
cybersecurity professionals
Contact Us
Subscribe to the SecurityWeek Daily
Brie�ng and get the latest content
delivered to your inbox.
Business Email Address...
Subscribe
Privacy Policy
Copyright © 2023 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.
Daily Brie�ng Newsletter
Malware & Threats Security Operations Security Architecture Risk Management
CISO Strategy ICS/OT Funding/M&A
