Naval Dome exposes vessel vulnerabilities to cyber attack

More onboard cyber vulnerability has been revealed, with maritime cyber defence firm Naval Dome demonstrating yet more ways hackers can compromise ship safety.

Earlier this week another shipping cybersecurity firm Pen Test Partners suggested hackers could potentially sink a bulk carrier by manipulating the loading data of its hull stress monitoring systems (HSMS) to deliberately cause an imbalance of cargo.

Naval Dome has now taken it up a notch by playing to some of  the maritime industry’s worst nightmare security scenarios with a series of cyber penetration tests on systems in common use aboard tankers, containerships, superyachts and cruiseships, revealing with startling simplicity the ease with which hackers can access and over-ride ship critical systems.

With the permission and under the supervision of system manufacturers and owners, Naval Dome’s cyber engineering team hacked into live, in-operation systems used to control a ships’ navigation, radar, engines, pumps and machinery.

While the test ships and their systems were not in any danger, Naval Dome was able to shift the vessel’s reported position and mislead the radar display. Another attack resulted in machinery being disabled, signals to fuel and ballast pumps being over-ridden and steering gear controls manipulated.

Commenting on the first wave of penetration tests on the ship’s ECDIS system, Naval Dome cto Asaf Shefi said: "We succeeded in penetrating the system simply by sending an email to the Captain's computer.

“We designed the attack to alter the vessel’s position at a critical point during an intended voyage - during night-time passage through a narrow canal. During the attack, the system's display looked normal, but it was deceiving the Officer of the Watch. The actual situation was completely different to the one on screen. If the vessel had been operational, it would have almost certainly run aground.”

According to the former Head of the Israeli Naval C4I and Cyber Defence Unit, the Naval Dome hack was able to alter draught/water depth details in line with the spurious position data displayed on screen.

“The vessel's crucial parameters - position, heading, depth and speed - were manipulated in a way that the navigation picture made sense and did not arouse suspicion,” he said. "This type of attack can easily penetrate the antivirus and firewalls typically used in the maritime sector.”

Commenting on the ease with which Naval Dome was able to bypass existing cyber security measures, Shefi explained: "The Captain's computer is regularly connected to the internet through a satellite link, which is used for chart updates and for general logistics updates. Our attacking file was transferred to the ECDIS in the first chart update. The penetration route was not too complicated: the attacking file identified the Disk-On-Key used for update and installed itself. So once the officer had updated the ECDIS, our attack file immediately installed itself on to the system.”

In a second attack, the test ship’s radar was hit. While the radar is widely considered an impregnable, standalone system, Naval Dome's team used the local Ethernet Switch Interface - which connects the radar to the ECDIS, Bridge Alert System and Voyage Data Recorder – to hack the system.

“The impact of this controlled attack was quite frightening,” said Shefi. "We succeeded in eliminating radar targets, simply deleting them from the screen. At the same time, the system display showed that the radar was working perfectly, including detection thresholds, which were presented on the radar as perfectly normal.”

A third controlled attack was performed on the Machinery Control System (MCS). In this case, Naval Dome's team chose to penetrate the system using an infected USB stick placed in an inlet/socket.

"Once we connected to the vessel's MCS, the virus file ran itself and started to change the functionality of auxiliary systems. The first target was the ballast system and the effects were startling. The display was presented as perfectly normal, while the valves and pumps were disrupted and stopped working. We could have misled all the auxiliary systems controlled by the MCS, including air-conditioning, generators, fuel systems and more.”

Itai Sela, ceo of the Israel-based company, further noted that the virus infecting ship systems can also be unwittingly transferred by the system manufacturer.

“As manufacturers themselves can be targeted, when they take control of onboard computers to carry out diagnostics or perform software upgrades, they can inadvertently open the gate to a cyber attack and infect other PC-based systems onboard the ship.”

“Our solution can prevent this from happening,” he concluded.

Posted 22 December 2017

© Copyright 2018 Seatrade (UBM (UK) Ltd). Replication or redistribution in whole or in part is expressly prohibited without the prior written consent of Seatrade.

Vincent Wee

Asia Editor, Seatrade Maritime News

STORYBOX Newsletter STMME Updates