Internal Case study drills and procedures – Case Study 5

Cyber Management Course (Ma) – Module 10

Internal Case study drills and procedures – Case Study 5 – Ship agent and shipowner ransomware incident

A shipowner reported that the company’s business networks were infected with ransomware, apparently from an email attachment. The source of the ransomware was from two unwitting ship agents, in separate ports, and on separate occasions. Ships were also affected but the damage was limited to the business networks, while navigation and ship operations were unaffected. In one case, the owner paid the ransom5.

The importance of this incident is that harmonized cyber security across relationships with trusted business partners and producers is critical to all in the supply chain. Individual efforts to fortify one’s own business can be valiant and well-intended but could also be insufficient. Principals in the supply chain should work together to mitigate cyber risk.

/by

Internal Case study drills and procedures – Case Study 6

Cyber Management Course (Ma) – Module 10

Internal Case study drills and procedures – Case Study 6 – Crash of integrated navigation bridge at sea

A ship with an integrated navigation bridge suffered a failure of nearly all navigation systems at sea, in a high traffic area and reduced visibility. The ship had to navigate by one radar and backup paper charts for two days before arriving in port for repairs. The cause of the failure of all ECDIS computers was determined to be attributed to the outdated operating systems. During the previous port call, a producer technical representative performed a navigation software update on the ship’s navigation computers. However, the outdated operating systems were incapable of running the software and crashed. The ship was required to remain in port until new ECDIS computers could be installed, classification surveyors could attend, and a near-miss notification had been issued as required by the company. The costs of the delays were extensive and incurred by the shipowner.  This incident emphasizes that not all computer failures are a result of a deliberate attack and that outdated software is prone to failure. More proactive software maintenance to the ship may have prevented this incident from occurring.

/by

Internal Case study drills and procedures – Case Study 7

Cyber Management Course (Ma) – Module 10

Internal Case study drills and procedures – Case Study 7 – Navigation computer crash during pilotage

A ship was under the conduct of a pilot when the ECDIS and voyage performance computers crashed. A pilot was on the bridge. The computer failures briefly created a distraction to the watch officers; however, the pilot and the master worked together to focus the bridge team on safe navigation by visual means and radar. When the computers were rebooted, it was apparent that the operating systems were outdated and unsupported. The master reported that these computer problems were frequent (referred to the issues as “gremlins”) and that repeated requests for servicing from the shipowner had been ignored.

It is a clear case of how simple servicing and attention to the ship by management can prevent mishaps.

/by

Internal Case study drills and procedures – Case Study 8

Cyber Management Course (Ma) – Module 10

Internal Case study drills and procedures – Case Study 8 – Worm attack on maritime IT and OT

A ship was equipped with a power management system that could be connected to the internet for software updates and patching, remote diagnostics, data collection, and remote operation. The ship was built recently, but this system was not connected to the internet by design. The company’s IT department made the decision to visit the ship and performed vulnerability scans to determine if the system had evidence of infection and to determine if it was safe to connect. The team discovered a dormant worm that could have activated itself once the system was connected to the internet and this would have had severe consequences. The incident emphasizes that even air gapped systems can be compromised and underlines the value of proactive cyber risk management.

The shipowner advised the producer about the discovery and requested procedures on how to erase the worm.

The shipowner stated that before the discovery, a service technician had been aboard the ship. It was believed that the infection could potentially have been caused by the technician.

The worm spread via USB devices into a running process, which executes a program into the memory. This program was designed to communicate with its command and control server to receive its next set of instructions. It could even create files and folders.

The company asked cyber security professionals to conduct forensic analysis and remediation. It was determined that all servers associated with the equipment were infected and that the virus had been in the system undiscovered for 875 days. Scanning tools removed the virus. An analysis proved that the service provider was indeed the source and that the worm had introduced the malware into the ship’s system via a USB flash drive

during a software installation. Analysis also proved that this worm operated in the system memory and actively called out to the internet from the server. Since the worm was loaded into memory, it could affect the performance of the server and systems connected to the internet.

/by

Internal Case study drills and procedures – Case Study 9

Cyber Management Course (Ma) – Module 10

Internal Case study drills and procedures – Case Study 9 – Bunker surveyor’s access to a ship’s administrative network

A dry bulk ship in port had just completed bunkering operations. The bunker surveyor boarded the ship and requested permission to access a computer in the engine control room to print documents for signature. The surveyor inserted a USB drive into the computer and unwittingly introduced malware onto the ship’s administrative network. The malware went undetected until a cyber assessment was conducted on the ship later, and after the crew had reported a “computer issue” affecting the business networks.

This emphasises the need for procedures to prevent or restrict the use of USB devices onboard, including those belonging to visitors.

/by

Internal Case study drills and procedures – Case Study 3 1

Cyber Management Course (Ma) – Module 10

Internal Case study drills and procedures – Case Study 3 – 10 August 2017 Ships fooled in GPS spoofing attack suggest Russian cyberweapon

By David Hambling

Reports of satellite navigation problems in the Black Sea suggest that Russia may be testing a new system for spoofing GPS, New Scientist has learned. This could be the first hint of a new form of electronic warfare available to everyone from rogue nation states to petty criminals.

On 22 June, the US Maritime Administration filed a seemingly bland incident report. The master of a ship off the Russian port of Novorossiysk had discovered his GPS put him in the wrong spot – more than 32 kilometres inland, at Gelendzhik Airport.

After checking the navigation equipment was working properly, the captain contacted other nearby ships. Their AIS traces – signals from the automatic identification system used to track vessels – placed them all at the same airport. At least 20 ships were affected.

While the incident is not yet confirmed, experts think this is the first documented use of GPS misdirection – a spoofing attack that has long been warned of but never been seen in the wild.

Until now, the biggest worry for GPS has been it can be jammed by masking the GPS satellite signal with noise. While this can cause chaos, it is also easy to detect. GPS receivers sound an alarm when they lose the signal due to jamming. Spoofing is more insidious: a false signal from a ground station simply confuses a satellite receiver. “Jamming just causes the receiver to die, spoofing causes the receiver to lie,” says consultant David Last, former president of the UK’s Royal Institute of Navigation.

Todd Humphreys, of the University of Texas at Austin, has been warning of the coming danger of GPS spoofing for many years. In 2013, he showed how a superyacht with state-of-the-art navigation could be lured off-course by GPS spoofing. “The receiver’s behaviour in the Black Sea incident was much like during the controlled attacks my team conducted,” says Humphreys.

/by

Internal Case study drills and procedures – Case Study 3 2

Cyber Management Course (Ma) – Module 10

Internal Case study drills and procedures – Case Study 3 – 10 August 2017 Ships fooled in GPS spoofing attack suggest Russian cyberweapon

Humphreys thinks this is Russia experimenting with a new form of electronic warfare. Over the past year, GPS spoofing has been causing chaos for the receivers on phone apps in central Moscow to misbehave. The scale of the problem did not become apparent until people began trying to play Pokemon Go. The fake signal, which seems to centre on the Kremlin, relocates anyone nearby to Vnukovo Airport, 32 km away. This is probably for defensive reasons; many NATO guided bombs, missiles and drones rely on GPS navigation, and successful spoofing would make it impossible for them to hit their targets.

But now the geolocation interference is being used far away from the Kremlin. Some worry that this means that spoofing is getting easier. GPS spoofing previously required considerable technical expertise. Humphreys had to build his first spoofer from scratch in 2008, but notes that it can now be done with commercial hardware and software downloaded from the Internet.

Nor does it require much power. Satellite signals are very weak – about 20 watts from 20,000 miles away – so a one-watt transmitter on a hilltop, plane or drone is enough to spoof everything out to the horizon.

If the hardware and software are becoming more accessible, nation states soon won’t be the only ones using the technology. This is within the scope of any competent hacker. There have not yet been any authenticated reports of criminal spoofing, but it should not be difficult for criminals to use it to divert a driverless vehicle or drone delivery, or to hijack an autonomous ship. Spoofing will give everyone affected the same location, so a hijacker would just need a short-ranged system to affect one vehicle.

But Humphreys believes that spoofing by a state operator is the more serious threat. “It affects safety-of-life operations over a large area,” he says. “In congested waters with poor weather, such as the English Channel, it would likely cause great confusion, and probably collisions.”

Last says that the Black Sea incident suggests a new device capable of causing widespread disruption, for example, if used in the ongoing dispute with Ukraine. “My gut feeling is that this is a test of a system which will be used in anger at some other time.”

/by

Internal Case study drills and procedures – Case Study 4

Cyber Management Course (Ma) – Module 10

Internal Case study drills and procedures – Case Study 4 – Unrecognised virus in an ECDIS delays sailing

A new-build dry bulk ship was delayed from sailing for several days because its ECDIS was infected by a virus. The ship was designed for paperless navigation and was not carrying paper charts. The failure of the ECDIS appeared to be a technical disruption and was not recognized as a cyber issue by the ship’s master and officers. A producer technician was required to visit the ship and, after spending a significant time in troubleshooting, discovered that both ECDIS networks were infected with a virus. The virus was quarantined and the ECDIS computers were restored. The source and means of infection in this case are unknown. The delay in sailing and costs in repairs totalled in the hundreds of thousands of dollars (US).

/by

Internal Case study drills and procedures – Case study 2

Cyber Management Course (Ma) – Module 10

Internal Case study drills and procedures – Case study 2 – Hackers took ‘full control’ of container ship’s navigation systems for 10 hours

In February 2017 hackers reportedly took control of the navigation systems of a German-owned 8,250 teu container vessel en route from Cyprus to Djibouti for 10 hours. “Suddenly the captain could not manoeuvre,” an industry source who did not wish to be identified told Fairplay sister title Safety At Sea (SAS). “The IT system of the vessel was completely hacked.”

There are three German shipowners that operate eight vessels between 8,200 and 8,300 teu, according to IHS Markit data, one of which confirmed knowledge of the attack to SAS but denied it was a vessel from their own company. However, both IHS Markit data and George Pouros, chief operating officer at Eurogate Container Terminal Limassol, Cyprus, confirmed that no vessels of this size called at the port. Pouros told SAS that the maximum capacity of vessels entering the port/Eurogate container terminal is 7000 teu, with a frequency of one per week*.

While details are limited, according to the source, the 10-hour attack was carried out by “pirates” who gained full control of the vessel’s navigation system intending to steer it to an area where they could board and take over. The crew attempted to regain control of the navigation system but had to bring IT experts on board, who eventually managed to get them running again after hours of work.

/by

Internal Case study drills and procedures – Case Study 1

Cyber Management Course (Ma) – Module 10

Internal Case study drills and procedures – Case Study 1 – Ship Engines explode from Hack (Aurora Attack)

In 2007, the Idaho National Lab staged a cyberattack against a power generator to demonstrate how cyberattacks could have serious physical consequences on the components of the electric grid. In the experiment, a computer program was used to rapidly open and close the circuit breakers of a diesel generator out of phase from the rest of the grid, eventually causing the diesel generator to explode.

This intrinsic vulnerability, which does not exploit any software-related flaw, has been since then called the Aurora vulnerability. The Aurora vulnerability is of serious concern because most of the key components of electric grid, like power generators and transformers are venerable to this kind of attack.

/by