Communication equipment and security – Hacking Cellular Data 2

Cyber Operators Course (Op) – Module 6

Communication equipment and security – Hacking Cellular Data

Crews should therefore be very aware of the potential for their network traffic to be intercepted whilst on shore or close to shore. Operators should also be alert to the potential for their crews data and communications to HQ by mobile phone and via the vessel when close to shore being intercepted.

A good defence against cellular (or any data) interception is to run a personal VPN from ones phone and laptop. Whilst free VPN software is available, there is some variability in the quality. Advertising is often used to compensate the VPN vendor. Instead, you may consider paying for a VPN service, given its importance to your privacy and resistance to data interception.

Business mobile devices should have a VPN or mobile device management (‘MDM’) platform installed. This provides an additional layer of defence against hacking. An MDM creates a secure environment within the smart phone or tablet that protects sensitive corporate data.

If no MDM or VPN is present, it is relatively straightforward for a hacker to fool the user in to allowing them to intercept sensitive data.

/by

Communication equipment and security – Hacking Cellular Data 1

Cyber Operators Course (Op) – Module 6

Communication equipment and security – Hacking Cellular Data

OpenBTS.org is an open source software project dedicated to making telco protocols and traditionally complex, proprietary hardware systems with Internet Protocol and a flexible software architecture. The OpenBTS software is a Linux application that uses a software-defined radio to present a standard 3GPP air interface to user devices, while simultaneously presenting those devices as SIP endpoints to the Internet.

/by

Communication equipment and security – Cell data connections 2

Cyber Operators Course (Op) – Module 6

Communication equipment and security – Cellular data connections

Whilst the detail of cellular network security is beyond the scope of this, there are some basic principles that will be of use to the seafarer and vessel operator:

2G networks are easily spoofed – a hacker can trivially set up a fake cellular base station with <$100 of equipment.

3G networks require ~$5,000 of equipment to successfully spoof.

4G networks can be spoofed, but expensive equipment is currently required

/by

Communication equipment and security – Cell data connections 1

Cyber Operators Course (Op) – Module 6

Communication equipment and security – Cellular data connections

When closer to shore, mobile data connectivity is often much cheaper and faster than satellite connections. Many vessels have facilities that will automatically switch to the cheapest form of data connection. Mobile data connections on crew mobile phones will also spring in to life as they approach shore.

/by

Communication equipment and security – knowledge of Passwords

Cyber Operators Course (Op) – Module 6

Communication equipment and security – Crew knowledge of Admin Passwords

Ask if anyone on the crew knows the admin password. If not, who does know it?

Is it written down anywhere? It is often written on a note physically stuck to the terminal! Here are some examples of passwords stuck to computer systems found on vessels:

Review the password if it is supplied to you. Is it at least 10 characters long, does it have uppercase, lowercase, numbers and non-alphanumeric (e.g. !”£$%^ etc) content. However, “Password1!” would not be acceptable.

Is the password ever changed? If so, how often? Once per year would be reasonable, or when key personnel leave.

How is the terminal administrated? Does anyone on the crew know how to fix bugs with it, if it failed at sea?

/by

Communication equipment and security – Technology suppliers

Cyber Operators Course (Op) – Module 6

Communication equipment and security – Make technology suppliers prove that they are secure

If you don’t ask for security, you don’t get it! Your technology and services suppliers won’t spend any time on security if they don’t think the market wants it.

A 3rd party audit of your supplier would be a good start, though in the short term you should ask them for evidence of security accreditations such as ISO27001 or compliance with the NIST cyber security frameworks.

/by

Communication equipment and security – Cloud Computing 2

Cyber Operators Course (Op) – Module 6

Communication equipment and security – Cloud Computing

One issue that many people have found around the work with cloud storage is that the security of it is very much compromised. Thousands of everyday people and celebrities have had much of their personal details, photos and video stolen by hackers and leaked them to the web.

/by

Communication equipment and security – Cloud Computing 1

Cyber Operators Course (Op) – Module 6

Communication equipment and security – Cloud Computing

The cloud is basically just Online Storage where you can upload all your files to without having to keep it on your hard drive. Cloud computing lets you keep information on a remote server (the cloud), instead of trapped in a computer. You can access your data from a Smartphone, a tablet, a laptop, or a desktop, wherever you have an Internet connection. Some cloud services let you share files. They are also always backing them up so there is less of a chance of your data being lost compared to if you keep it on your hard drive. Often cloud hosting companies either charge you for the amount of storage you’re using monthly. But some companies also allow you to pay annually. Some also let you have some storage for free. Some examples are Apple iCloud & Dropbox.

/by

Communication equipment and security – SSL Certificate 2

Cyber Operators Course (Op) – Module 6

Communication equipment and security – SSL Certificate

Image of an SSL cert error on iOS and Android

Whilst these are sometimes legitimately seen when connecting to a public Wi-Fi hotspot, they are also a common route for hackers to intercept email. Do not accept the certificate!

/by

Communication equipment and security – SSL Certificate 1

Cyber Operators Course (Op) – Module 6

Communication equipment and security – SSL Certificate

An SSL certificate, or secure certificate, is a file installed on a secure Web server that identifies a website. This digital certificate establishes the identity and authenticity of the company or merchant so that online shoppers can trust that the website is secure and reliable. In order to verify that these sites are legitimate (they are who they say they are), the companies and their websites are verified by a third party. When going to these webpages, you will notice that they are slightly more different! How? By looking at the Hypertext Transfer Protocol type in the address bar. It will say HTTPS Instead of HTTP These Can then be viewed by a person if they want to know more details about the company who is selling.

/by