An equipment room containing PLCs and control gear for critical systems was located some distance from the main engine control room but required frequent adjustments via a local HMI.

To avoid leaving the control room, a PC was installed in the equipment room. Teamviewer was used to enable remote access from the control room.

The remote PC bridged between the corporate network and the OT network. The Teamviewer password was on a label above a monitor in the control room, allowing access to the remote PC from the wider Internet.

A vulnerability discovered in the network switches of the OT equipment allowed a shared password to be recovered. With this, it was possible to wipe the configuration of PLCs and switches, stopping all OT systems from functioning.

Scenario 2: Third-party mistakenly allows access to critical serial networks

The load computer was located on the bridge of the vessel. This required network connectivity between two PCs, and to several remote Serial->IP convertors used to read information from ballast tanks.

The third-party vendor used the available network sockets on the bridge to interface to these. The network design of the vessel meant that any unrecognised or unregistered devices were placed in an isolated VLAN.

This allowed the PCs to interact with the Serial->IP convertors. However, network sockets in the passenger space used the same mechanism.

A laptop connected to a network port in the passenger space could therefore inject traffic onto the serial network used for ballast tank readings. Random data injected here prevented the bridge systems reading ballast tank levels, causing multiple alarms and the requirement to take manual dippings until the problem was resolved.

Scenario 3: Remote firmware update causes operational issues

The NOx scrubber system was installed by a third party and contained significant control gear and remote monitoring.

The ship owner provided a dedicated VLAN for the system to communicate over VSAT. It was found that the HMI providing remote connectivity was also attempting to download a firmware and configuration from a remote server using unsecured HTTP.

It was possible to update the firmware of the HMI to a malicious one, and remotely interact with the control gear of the scrubber. The configuration of the PLCs in the scrubber was wiped, preventing control and monitoring of the scrubber. The engines needed to be operated at reduced power to avoid damage to the scrubber system.

Scenario 4: Accessible HMI leaks high-value passwords

An HMI in a HVAC room on the vessel had access to a limited number of screens, only concerning control of the HVAC equipment and monitoring of power systems on the vessel.

By using the “Print” menu, it was possible to break out of the HMI software and access the underlying operating system.

All HMIs used a shared Windows network, including SMB shares. One of the HMIs in the main control room had a file called “passwords.txt” left on this share.

This contained operator and administrator passwords for all the HMIs and PLCs, left from when the vessel was commissioned. These passwords were found to be common across all vessels using that ICMS (Integrated Control and Monitoring System) vendor.

Conclusion

SHIP IP LTD – Remote internal/external Vulnerability &

Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

Maritime Vulnerability and Penetration Testing

Source: pentestpartners

With the permission and under the supervision of system manufacturers and owners, Naval Dome’s cyber engineering team hacked into live, in-operation systems used to control a ships’ navigation, radar, engines, pumps and machinery.

While the test ships and their systems were not in any danger, Naval Dome was able to shift the vessel’s reported position and mislead the radar display. Another attack resulted in machinery being disabled, signals to fuel and ballast pumps being over-ridden and steering gear controls manipulated.

Commenting on the first wave of penetration tests, on the ship’s Electronic Chart Display and Information System (ECDIS), Asaf Shefi, Naval Dome’s CTO, the former Head of the Israeli Naval C4I and Cyber Defense Unit, said: “We succeed in penetrating the system simply by sending an email to the Captain’s computer.

“We designed the attack to alter the vessel’s position at a critical point during an intended voyage – during night-time passage through a narrow canal. During the attack, the system’s display looked normal, but it was deceiving the Officer of the Watch. The actual situation was completely different to the one on screen. If the vessel had been operational, it would have almost certainly run aground.”

According to Shefi, the Naval Dome hack was able to alter draught/water depth details in line with the spurious position data displayed on screen.

“The vessel’s crucial parameters – position, heading, depth and speed – were manipulated in a way that the navigation picture made sense and did not arouse suspicion,” he said. “This type of attack can easily penetrate the antivirus and firewalls typically used in the maritime sector.”

Commenting on the ease with which Naval Dome was able to by-pass existing cyber security measures, Shefi explained: “The Captain’s computer is regularly connected to the internet through a satellite link, which is used for chart updates and for general logistic updates. Our attacking file was transferred to the ECDIS in the first chart update. The penetration route was not too complicated: the attacking file identified the Disk-On-Key use for update and installed itself. So once the officer had updated the ECDIS, our attack file immediately installed itself on to the system.”

In a second attack, the test ship’s radar was hit. While the radar is widely considered an impregnable, standalone system, Naval Dome’s team used the local Ethernet Switch Interface – which connects the radar to the ECDIS, Bridge Alert System and Voyage Data Recorder – to hack the system.

“The impact of this controlled attack was quite frightening,” said Shefi. “We succeeded in eliminating radar targets, simply deleting them from the screen. At the same time, the system display showed that the radar was working perfectly, including detection thresholds, which were presented on the radar as perfectly normal.”

A third controlled attack was performed on the Machinery Control System (MCS). In this case, Naval Dome’s team chose to penetrate the system using an infected USB stick placed in an inlet/socket.

“Once we connected to the vessel’s MCS, the virus file ran itself and started to change the functionality of auxiliary systems. The first target was the ballast system and the effects were startling. The display was presented as perfectly normal, while the valves and pumps were disrupted and stopped working. We could have misled all the auxiliary systems controlled by the MCS, including air-conditioning, generators, fuel systems and more.”

Itai Sela, CEO of Israel-headquartered Naval Dome, furthered that the virus infecting ship systems can also be unwittingly transferred by the system manufacturer.

“As manufacturers themselves can be targeted, when they take control of onboard computers to carry out diagnostics or perform software upgrades, they can inadvertently open the gate to a cyber attack and infect other PC-based systems onboard the ship. Our solution can prevent this from happening.”

SHIP IP LTD – Remote internal/external Vulnerability & Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

https://shipip.com/maritime-vulnerability-and-penetration-testing/

The Maritime business is facing huge challenges with managing Cyber Security in their environments. The maritime regulator, International Maritime Organization IMO, has identified these challenges in their efforts to regulate the maritime environment and has updated their regulations and guidelines to include cyber risk management onboard ships mandatory as of 1 January 2021.

Maritime organisations need to assess risks in both traditional information technology(IT) and Operational Technology(OT) environments in order to establish appropriate controls against cyber security incidents. In many cases, IT and OT is managed by different teams without established standards, shared knowledge and minimal collaboration, leaving IT uninformed about the OT technologies on ships and OT uninformed about the cyber threats and risks in traditional IT environments. Deductive Labs has the knowledge and experience that can help bridge the gap between IT and OT, aligning the areas with business goals, operational processes and security requirements.

Deductive Labs provide our customers with professional security services in order to improve their cyber security posture and fulfil current and upcoming requirements and regulations.

We combine our security- and penetration testing methodologies with our 15+ years of security knowledge and experience. Penetration testing methodology based on industry best practices from PTES standard, OWASP Testing Guide. ISO27001, IEC 62443, NIST Cyber Security Framework as information Security frameworks.

SHIP IP LTD – Remote internal/external Vulnerability & Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

https://shipip.com/maritime-vulnerability-and-penetration-testing/

GTMaritime is now offering a penetration testing service free of charge which allows customers to evaluate the ability of their personnel to identify phishing attacks

Hackers are constantly trying to come up with new ruses to outwit software-based protections. For this reason, crew cannot afford to become complacent in the belief that, with a technological safety net in place, everything reaching their inbox is trustworthy and can be taken at face value.

On the contrary, they must remain vigilant: the few malicious messages that do arrive will more likely resemble an authentic request or employ advanced social-engineering techniques, which make them harder to recognise.

Quality ship operators understand this and take a holistic approach to cyber defence. To supplement the work done by technological tools such as GTMailPlus by GTMaritime, they routinely remind staff to stay alert and offer training on what to look out for.

However, it can be difficult to gauge exactly how well these measures are working or to identify areas that would benefit from improvement. In the same way that cyber criminals are constantly refining their techniques, ship operators too must continually adapt.

Last autumn GTMaritime started offering a penetration testing service free of charge to its shipping company customers. The service involves sending a selection of crafted spoof phishing messages to crew to test for alertness and for response. These realistic but ultimately harmless simulated attacks offer an effective way of gathering quantitative evidence on the alertness of the frontline staff most exposed to hoax emails.

By revealing weaknesses in training provision, the free service allows customers to pinpoint where educational resources can be enhanced or redirected, knowledge gaps plugged and awareness raised.

Test results revealed weaknesses

We recently completed a two-round penetration test for an established shipping company. For the initial test the vessel operator sent to sixteen of its captains a spoof message appearing to come from a Port Authority requesting basic identifying information about the vessel and its owner.

Half correctly identified the message as a phishing attempt and ignored it, but half supplied the information asked for. Of the latter group, in no case was the message escalated to management for advice on how to proceed.

The 50-50 split certainly raised pulses at company headquarters, as the spoof email was written in poor English and emanated from a mysteriously unnamed port authority – both common traits that should ring alarm bells. To determine if the same result would be found if more detailed information was requested a second test was employed.

This time the message that supposedly came from a port authority had a personalised subject line that mentioned the target vessel’s name and IMO number. There is mounting evidence of cyber criminals including references to familiar people or organisations, adding a veneer of authenticity that encourages the targeted recipient to lower their guard. The rogue message then asked for a host of sensitive particulars and security details, which if passed on to pirates could jeopardise the safety of vessel and crew.

The response showed a marked improvement over the first test. Eight recipients immediately detected something was amiss and ignored the request. Encouragingly, three were suspicious enough to seek guidance from head office. Although head office personnel were kept in the dark about the test, they reacted correctly, advising vessels not to send any data and also alerted the IT department.

Even so, five vessels still obligingly followed the instructions in the message without properly considering either the safety or commercial ramifications of sensitive information falling into the wrong hands.

Path to enhanced education and procedures

Following the penetration tests GTMaritime supplied the vessel operator with educational materials for both staff and IT personnel. The operator took an enlightened view to the results, seeing them as an opportunity to learn rather than apportion blame. It later shared the full findings in a company-wide security bulletin in the hope that using real data rather than hypothetical scenarios to present the dangers would drive home the need for vigilance.

SHIP IP LTD – Remote internal/external Vulnerability & Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

https://shipip.com/maritime-vulnerability-and-penetration-testing/

As ships get bigger, with more automation, fewer crew members, and more connectivity, the attack surface of a modern commercial vessel is becoming as complex and diverse as that of a connected car or commercial aeroplane.

We have ex-ships officers and engineering staff on the team here, so we have first-hand experience of the unusual networks and communications found on board.

Don’t risk your ships security to a penetration tester that doesn’t understand shipping; we’ve come across other consultancies that have broken critical systems on board whilst trying to test their security, as they simply didn’t understand what they were testing.

What does a ship look like to an attacker?

The complex systems involved in shipping offer rich pickings to the hacker, pirate and thief. Load theft, smuggling stowaways, narcotics, arms, even crippling or sinking a vessel are very real threats.

Maritime insurance often specifically excludes losses as a result of ‘cyber’ incidents, so it’s very important to check your cover.

From satcoms, mobile data and Wi-Fi through to propulsion and loading systems, this is what a hacker sees when they look at a ship. Many of these systems can be comprised, causing financial loss and safety issues.

Tactical Advice
Tens of vendors are involved in connected systems on ships, from Dell providing desktop PCs, to satcoms gear for Internet, chart systems, MMI, control systems, radar systems etc. This is a recipe for security disasters.

Here are a few basic issues you could check for yourself:

Check your satcom terminals for default, weak or blank admin passwords. Make sure the latest software is running on ALL of your terminals.

Check the network isolation and segregation between bridge, engine room, crew, Wi-Fi and business networks.

Check Wi-Fi networks for strong encryption and strong passwords. Make sure that business systems are particularly well protected.

Demand evidence from your technology suppliers that the systems they provide to you are secure. Remember, if you don’t ask for security, you probably won’t get it!

Sit down and think about how you might attack your ships network, given your knowledge of your systems. That’s what the hacker does, so pre-empt them and defend better.

Don’t forget your people. Officers can become fixated on digital navigation systems on the bridge. These can be hacked and manipulated, so don’t forget to look outside.

SHIP IP LTD – Remote internal/external Vulnerability & Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

https://shipip.com/maritime-vulnerability-and-penetration-testing/

Source: thedigitalship

Penetration testing services

Our ICS penetration testing services enable you to find weaknesses in your network perimeter. The penetration testing commences by scanning the network to determine what types of hardware are connected and the operating systems being used. Then we search for unpatched vulnerabilities in those devices and attempt to exploit those vulnerabilities to gain access to the network. The penetration testing services are supported by our ethical hackers group, who have a background in IT and engineering, and certification according Certified Ethical Hacker (CEH), GXPN, GPEN, Global Industrial Cyber Security Professional (GICSP).

Securing control systems, preventing cyber security breaches

A common design principle is to ensure that programmable logic controllers (PLCs) and the network infrastructure that is used to connect them, operate in a secure environment (i.e. sealed from malicious attackers). In practice, ICS are often inadvertently connected to other networks, which can allow remote access through open networks or the Internet. Our ICS penetration testing services will identify such weaknesses, consider the possible impacts and then suggest corrective actions.

SHIP IP LTD – Remote internal/external Vulnerability & Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

https://shipip.com/maritime-vulnerability-and-penetration-testing/

The rising trend of piracy over the past several years has constituted a grave threat to the lives of the crews and the safe operation of ships. Areas of particular concern have been off the coast of Somalia, the Gulf of Guinea and the Malacca Straits. INTERTANKO has been actively involved to addressing piracy wherever it occurs through a number of actions, including the development of industry Best Management Practices to combat piracy, engaging with United Nations Contact Group on Piracy, working with IMO on the development of guidelines to Administration and seafarers and engaging with the Regional Cooperation Agreement on combating piracy in Asia. INTERTANKO will continue to ensure that its members have the most up-to-date information so they can decide on the best measures they feel are appropriate to protect their tankers against acts of piracy anywhere in the world.

Sanctions
The United Nations and individual countries have imposed sanctions against certain countries around the world for a variety of reasons, ranging from economic and trade to more targeted measures such as arms embargoes, travel bans, and financial or commodity restrictions. The purpose of these sanctions is to peacefully bring about some sort of change within the country affected. INTERTANKO assists Members in dealing with sanctions in two major ways. First, ensuring that any sanctions imposed that may affect members’ tanker operations are fair, reasonable and practical to implement. And second, to ensure that all members are fully aware of any sanctions that could affect their tanker operations, thereby minimizing the possibility of violating the sanction and avoiding potential penalties or trade restrictions.

Refugees
The recent upheaval of certain governments in the Middle East and Africa, combined with unprecedented terrorist activities in these areas has resulted in the largest migration of refugees since World War II. The majority of these migrants are seeking refuge in Europe through sea routes in the Aegean and Mediterranean Seas. In many cases, the refugees are turning to smugglers who provide sea craft that are not suitable for crossing these seas, resulting in very unsafe conditions and the need for the refugees to be rescued at sea.  When called on to assist in rescuing these refugees at sea, INTERTANKO Members’ tankers respond. However, there is a need for a coordinated governments’ approach to addressing the problem ashore. INTERTANKO has been, and will continue to, encourage governments to take the appropriate action to mitigate the need for rescuing refugees at sea and assist members in having those rescued, disembarked safety ashore as soon as possible to minimise delays.

Cyber Risk Management
Cyber-technologies have become essential to the operation and management of numerous systems critical to the safety and security of shipping and protection of the marine environment. In some cases, these systems are to comply with international standards and/or national requirements. However, the vulnerabilities created by accessing, interconnecting or networking these systems can lead to cyber risks in many of ships systems, including bridge navigation equipment, cargo handling and main propulsion and machinery. IMO has developed guidelines on cyber risk management which provide high level recommendations to be used in development and implementation of detailed specific risk management processes that are ship specific. In addition, the shipping industry has prepared Industry Guidelines on Cyber Security which complement the IMO guidelines. INTERTANKO has been actively involved in the development of both and will continue to play an active role in updating these guidelines to ensure that Members have the most up-to-date information to protect their tankers.

Ssource: intertanko

Please adhere to on line etiquette during our presentations.  We kindly ask you to mute your microphone and video upon commencing the link and to use the Chat application for any  questions, which will be addressed by the speaker at the end of the presentation. We suggest dialling in at least 5 mins before the start of the webinar.

Please note that any recording of this event will be available post-event in DropBox format, subject to speaker authorisation.

Protecting Maritime Assets in a Cyber World delves into the biosphere of cyber-security in the maritime industry. Due to the challenges posed to the maritime industry including ports, terminals, ships, refineries, and support systems which are vital components all nations’ critical infrastructure, national security, and economies, these parties look to insurance as a way to “fill the gap”. This is because cyberattacks on industrial control systems could kill or injure workers, damage equipment, expose the public and the environment to harmful pollutants, and lead to extensive economic damage. The loss of ship and cargo scheduling systems could substantially slow cargo operations in ports, leading to backups across the transportation system. A less overt cyberattack could facilitate the smuggling of people, weapons of mass destruction, or other contraband into a country.

Many cyber security experts believe attacks on maritime related infrastructure has increased by over 900%. Because there are as many potential avenues for cyber damage in the maritime sector as there are cyber systems, all stakeholders must identify and prioritize risks, take this threat seriously, and work together to improve our collective defenses. Fortunately, the process for doing so is parallel in structure to that of other security and safety efforts: assess risk, adopt measures to reduce that risk, assess progress, revise, and continue. These processes, taken together, can significantly improve an organization’s risk reduction efforts and increase resilience through continuity of business planning. This includes implementing IMO 2021 (along with specific flag state guidance), where on the first annual verification of a shipping company’s Document of Compliance (DOC), cybersecurity will be part of the safety management audit, where a shipping company must demonstrate that appropriate measures for handling cyber risk are an integral part of its safety management system.

At this market briefing, our speakers will explore cyber security issues within the maritime industry, case examples for study and discuss the keys to cyber security planning and cyberattack “avoidance”.

Source: iua.co.uk