Monitoring Ships Data and activity – Attacking NMEA0183 1

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Attacking NMEA0183

If the hacker has established remote access to the vessel (perhaps through satcoms, creating a back door through a phishing attack or a physical network implant) the next step might be to tamper with the GPS data stream on the vessel network.

An ‘ARP poisoning’ attack involves the hacker instructing the various systems on the network to send their data to via them. The hacker effectively inserts themselves in to the data stream in what is known as a ‘man in the middle’ attack. By adjusting the GPS position reports from the GPS receiver in the NMEA 0183 data stream, the systems can be fooled.

Unlike GPS jamming or spoofing attacks, where no position data or gross position errors are received, this type of hack is much more insidious: the change in position is gradual and far harder to detect.

/by

Monitoring Ships Data and activity – OT on vessels

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – OT on vessels

Direct control from the bridge of, for example, the ships engine occurs by the engine levers sending network data over the OT network to the engine control systems in the engine control room.

There are numerous potential security flaws in the OT network that a hacker could exploit. First, we will look at the cabling.

Serial network cabling isn’t often the best way to send OT data around a vessel. An IP network will usually be in place throughout, so serial to IP convertors are used to ‘encapsulate’ the serial OT control data and transport it to the control systems over the IP network.

The convertor receives serial data at one side, then sends it out over an IP network from the other side. A second convertor at the outstation (e.g. the engine control room) converts the data back to serial again.

/by

Monitoring Ships Data and activity – Consider OT without ex IT 3

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Consider OT without external IT

There’s a reason that their security isn’t great – for many years OT networks were completely isolated from the internet and from corporate networks. The threat vector was primarily from physical attack, so they were kept behind lock and key in, for example, electricity substations and water pumping stations.

Utilities faced a barrage of OT hacking incidents as systems were accidentally (or thoughtlessly) connected to the internet in the 2000’s. This culminated in the Stuxnet incident in 2009 and 2010; an attack by nation states against the Iranian uranium enrichment programme that got out of hand. Lift systems in Germany were affected, production lines in the USA were compromised, all users of similar OT to the Iranians. Those familiar with the ‘notPetya’ incident at Maersk will note similarities here, though that was an IT attack, not OT.

/by

Monitoring Ships Data and activity – Consider OT without ex IT 2

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Consider OT without external IT

Examples of OT include propulsion control, steering, ballasting and many others. You are probably more familiar with an ethernet or IP network from your home or work computer; you’ll be familiar with the network cable that plugs in to your home router with a small clip. It’s called an RJ45 connector.

Serial networks operate differently; they are much more popular in industrial systems such as utilities and vessels where safety and reliability is paramount, however their cyber security is often non-existent or very weak. You may be familiar with 9 PIN serial cable connectors like this:

/by

Monitoring Ships Data and activity – Consider OT without ex IT 1

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Consider OT without external IT

You may also come across terms such as ICS (Industrial Control Systems) and SCADA (Supervisory Control and Data Acquisition) but generally we mean the serial data networks and devices that control machinery.

Chapter 1 of the Operators Course (Op) discussed how OT has become more IT and now there is a bridge between the two.  There were rumours that certain government organisations went `old school` to typewriters as it was the only way to guarantee security.

“The problem with a Typewriter, is that I can’t download the latest software patches to keep me safe from a Virus or Hacker…….”

/by

Monitoring Ships Data and activity – Network seg on board

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Network segregation on board vessels

There are multiple networks on board any large vessel:

Business network

Crew network and WiFi

Bridge systems

OT networks, including engine management and propulsion

Satellite communications and the internet

…among many

/by

Monitoring Ships Data and activity – Testing network seg 2

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Testing network segregation

Some questions may help provide a picture of vessel network segregation

“When was the last time a third party verified the segregation of the various networks on board”

“Which systems on the bridge have access to the OT network?”

“Does an OOW have access to bridge systems from anywhere other than the bridge?”

“Do any computers on the vessel business network have access to OT systems, e.g bay planning, ballast/trim, propulsion etc?”

“What steps have been put in place to ensure that the crew Wi-Fi network can only access the internet or other crew leisure systems?”

/by

Monitoring Ships Data and activity – Testing network seg 1

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Testing network segregation

Very often, the crew and operators perception of network segregation may not actually match the reality of the on board network. Through ongoing maintenance and upgrades to systems, changes by engineers and for many other reasons, carefully designed segregation may have been undermined.

For example, an ECDIS may have been isolated from the vessel IT network when first installed. In order to make the chart update process more efficient, automatic CMAP updates may have been implemented subsequently. In order to do this, it was connected to the business network so that it had access to the internet in order to access online chart update services. That well-intended change to the network has now accidentally created a link between the IT and OT networks, possibly exposing OT systems on the public internet.

Evaluating network segmentation requires certain network testing tools. Running these tools requires a degree of expertise; some tools can cause some systems to crash if run without care, particularly on the OT side of the network.

Tools such as NMAP are free, part of the Kali distribution. However, only experts in security assessment should use them on a live vessel network.

However, without testing the network, one is reduced to taking the word of the operator and crew.

/by

Monitoring Ships Data and activity – Restrictions and content

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Access restrictions and content filtering

In addition to network segregation, another useful layer of protection is to ensure that key systems can only access the resources they need to.

For example, an internet browser on a computer on the vessel business network should not be able to access pornographic web sites.

All operators should have content filters in place to help ensure that crews do not (intentionally or accidentally) access web sites from business computers that may contain malware.

If content filters have been implemented by the operator, then the web site should be banned to users.

/by

Monitoring Ships Data and activity – Basic steps to create

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Basic steps to create

First, one might build a series of Virtual LANS (‘VLANs’), often grouping devices by system function. For example, a VLAN of the workstations and laptops in the finance department, or the business computers on board a vessel.

Then one should consider what systems the computers on that VLAN need to access over the network.

For example, finance workstations would need network access to the servers that run the finance applications. On board a vessel, business computers may need access to an on board email server.

The second step is to work out which network services are needed to support the business function. For example, finance workstations might need to connect to a network port on a finance database server. The key is to use the VLAN to lock down the access between the two sets of devices (workstations and servers) to only allow access. In the case of a Microsoft SQL server database, that network port might be TCP port 1433.

By restricting access to only port 1433, it is much harder for malware and other attacks to spread around the network.

Of course, if the installer of the IT system forgot to change the default database password (as is surprisingly common!) the attacker would have little trouble hacking it.

/by