Specific Compartment equipment – segregation and bridging

Cyber Operators Course (Op) – Module 7

Specific Compartment equipment – Network segregation and bridging

The ECDIS is an ideal candidate for the hacker to ‘bridge’ between the IT and OT networks on the vessel. An ECDIS consumes multiple data feeds, for example:

  • GPS
  • ARPA
  • Log
  • AIS
  • Gyro
  • Chart updates

This image shows the inside of an ECDIS computer case. The smaller wires are serial data feeds from several OT sources. The whole computer is also connected to the vessel IP network, meaning a skilled hacker could use an ECDIS as the route between the IT and OT networks.

OT and IT networks are often joined on board, often for reasons of convenience such as being able to review engine parameters and efficiency from a computer on the vessel business network.

Discuss the following with the operator and on board engineering team:

Where on board are the OT and IT networks joined?

The VDR is another common source of network convergence: the data recorder needs to monitor both sets of networks in order to gather useful telemetry for accident analysis

/by

Specific Compartment equipment – System updates and hardening

Cyber Operators Course (Op) – Module 7

Specific Compartment equipment – System updates and hardening

It is imperative that the ECDIS computer is subject to regular updates to its operating system. During vessel security audits, we have discovered ECDIS still running Windows NT, an operating system so old that Microsoft stopped supporting it in 2004! That means that any new security flaws in the software will NEVER be fixed.

Windows XP and Windows 7 are also commonly found on bridge systems. Even as recently as April 2018, Microsoft released 22 vulnerabilities rated ‘critical’. These updates must be applied, as hackers will quickly ‘reverse engineer’ the updates and work out how to exploit the security flaw.

Not all ECDIS are based on Microsoft operating systems. A smaller subset of vendors use Linux based operating systems, which require updating in just the same way.

Whilst downloading updates at sea over satellite can be expensive, the operator should determine how critical a new patch is to their systems. Truly urgent patches, such as the ‘Heartbleed’ flaw from 2014 would merit the expense of patching whilst at sea, though most could likely wait until the next port of call and updating over shore Wi-Fi.

All computers should be subject to ‘hardening’ during installation. This describes the process whereby it is configured to be as secure as possible; it should deliver minimum functionality in order to deliver its role as an ECDIS. For example, one would not expect Microsoft games to be present on an ECDIS, nor would one expect administrator passwords to be blank or simple

The Center for Internet Security publishes free CIS Benchmarks which offer good practice guides and checklists for hardening systems. Their web site is at www.cisecurity.org

/by

Specific Compartment equipment – ECDIS USB security

Cyber Operators Course (Op) – Module 7

Specific Compartment equipment – ECDIS USB security

The ECDIS system case must be kept in a robust locked cabinet to which only senior personnel have access. It should not be possible for other personnel to access the system case or any of the USB and network ports on it.

A source of several ECDIS security incidents has been from crew charging smartphones from the USB ports. Phones that have not been kept up to date may already be infected with malware.

Many ECDIS have USB ports present on their keyboards, as shown in the example below. Operators frequently report that, despite multiple ‘safe’ USB charging points being made available on the bridge, crew still charge phones from the ECDIS.

With this in mind, seriously consider installing USB port blockers such as the below. Whilst they are not difficult to remove, they do provide a visual deterrent to casual charging.

/by

Specific Compartment equipment – ECDIS security

Cyber Operators Course (Op) – Module 7

Specific Compartment equipment – ECDIS security

An ECDIS is usually just a desktop computer. It may have a rugged case, screen and keyboard, but it is fundamentally just a PC.

Just like any computer, it requires updates to be applied, both to the underlying operating system, to its ECDIS software and to the digital charts. If any of those are omitted for any period of time, cyber security vulnerabilities creep in.

ECDIS are increasingly being connected to vessel networks to facilitate online chart updates, integration with other bridge systems and remote maintenance. Security flaws that did not matter so much in the past through a lack of connectivity are now becoming very important.

Even having dual redundant ECDIS on the bridge is no guarantee of availability: during research we discovered similar security flaws on multiple ECDIS brands. A hacker would have little difficulty in compromising both.

/by

Specific Compartment equipment – Bridge O/S 3

Cyber Operators Course (Op) – Module 7

Specific Compartment equipment – Bridge Operating Systems

From Engine Room Management to RADAR, all your systems will also have an Operating system on it. Without it, the system wouldn’t work correctly and even not be able to be installed. The issue is that there are multiple different operating systems, all able to do different thing and have different features and also cost different amounts to buy. This means some have different requirements in terms of hardware and what software they need on them and what security features they hold. Also some software onboard may only support certain Operating systems.

Do you now have a list of all your equipment, and their update status onboard?

It is very common for Bridge equipment to use OS considered `dated` by the home user, such as Windows NT, 2000 or XP (which runs a large proportion of Navigation Software as an example)

Check the terminal vendors software update pages regularly – security fixes are often hidden in the changelog and not easy to find.

Check that the bridge, engine room, crew, Wi-Fi and business networks on board are logically separated

If a device on your vessel is compromised, segregated networks will ensure critical systems are kept safe from the hacker. Do crew members personal laptops on the ship network have access to the navigation systems? Have you actually checked to make explicitly sure?

/by

Specific Compartment equipment – Bridge O/S 2

Cyber Operators Course (Op) – Module 7

Specific Compartment equipment – Bridge Operating Systems

An operating system is the most important software that runs on a computer. It manages the computer’s memory and processes, as well as all of its software and hardware. It also allows you to communicate with the computer without knowing how to speak the computer’s language. Without an operating system, a computer is useless. A main task for the OS is that several different computer programs running at the same time all need to access the computer’s central processing unit (CPU), memory, and storage. The operating system coordinates all of this to make sure each program gets what it needs.

Operating systems usually come pre-loaded on any computer you buy. This is the same for a ships computer.

Most people use the operating system that comes with their computer, but it’s possible to upgrade or even change operating systems. The three most popular and used operating systems for personal computers are Microsoft Windows, Mac OS X, and Linux. Modern operating systems use a graphical user interface or GUI). A GUI lets you use your mouse to click icons, buttons, and menus, and everything is clearly displayed on the screen using a combination of graphics and text. Remember your phone will also use an Operating System but mobile devices generally aren’t as fully featured as those made for desktop and laptop computers, and they aren’t able to run all of the same software. However, you can still do a lot of things with them, like watch movies, browse the Web, manage your calendar, and play games.

/by

Specific Compartment equipment – Bridge O/S 1

Cyber Operators Course (Op) – Module 7

Specific Compartment equipment – Bridge Operating Systems

First of all, know your OS.

The ‘OS’ or also known as an Operating System is the software that supports a computer’s basic functions. Without it there would be no User Interface.

Maritime Type Approved Hardware, undoubtedly still uses `standard` OS.

Image above: One is Linux, on Windows.  Many ECDIS systems use XP or VISTA.

Before moving on, you will need to list all the bridge equipment and what OS it uses.  Which OS it uses will affect your cyber solution.  One solution does not fix all.

/by

Specific Compartment equipment – Introduction

Cyber Operators Course (Op) – Module 7

Specific Compartment equipment – Introduction, replicate this Module outside of just the Bridge

It is important to note that for explanation purposes this module is focused on the Bridge.  This is purely as an example of an `isolated` area.  However, as we saw at the begging on this course there are many departments on board from Passenger management to Cargo depending on the type of vessel you are on.  The concept remains the same though, each department must be assessed and procedures documented for Cyber.  This module concentrates on the bridge but it is strongly advised that the module is repeated when considering each other department.

/by

Communication equipment and security – Vulnerability, Sat Ter

Cyber Operators Course (Op) – Module 6

Communication equipment and security – Vulnerability of Ship Satellite Terminals

What could go wrong?

There are already numerous anecdotal incidents relating to ship hacking through satellite terminals. A number of ‘white hat’ or ethical hackers and security researchers have shown that compromise of these terminals is relatively easy. Their findings were first published in 2017, shortly followed by a real-time map of ships, located by their satellite terminal.

It is a natural progression that less ethical hackers will already know about these issues in terminal equipment and be exploiting them for gain.

It is very difficult to gather statistics about hacking incidents as operators are understandably reluctant to publish data.

/by

Communication equipment and security – Wi-Fi, satcom terminal

Cyber Operators Course (Op) – Module 6

Communication equipment and security – Wi-Fi, in the context of a satcom terminal

As with cellular communications, the vessel internet access can be connected to shore via Wi-Fi to reduce satellite airtime and mobile data costs.

This switch is often seamless with modern equipment, so the crew may not even realise that the crew Wi-Fi network has moved from satellite to cellular to shore Wi-Fi, though the bandwidth and response times may improve dramatically!

As the switch from satellite to Wi-Fi occurs, the crew and vessel are exposed to different security threats. If the basic security advice around satellite terminals is followed, data is likely to be relatively safe. As we move to Wi-Fi communications, any unencrypted data from the crew laptops, phones and any business systems aboard the vessel could be exposed to rogue Wi-Fi hotspots or hackers that have compromise the shore Wi-Fi network in port.

Operators would be well advised to ensure that a VPN is used for ALL communications on the business network. Crews would also be well advised to use a personal VPN.

/by