Nightmare Scenario: Ship Critical Systems Easy Target for Hackers

Hackers can easily access and over-ride ship critical systems, results of a series of cyber penetration tests conducted by Naval Dome, an Israel-based cyber security specialist, show.

The tests were carried out on systems in common use aboard tankers, containerships, superyachts and cruiseships, under the supervision of system manufacturers and owners,

Naval Dome’s cyber engineering team hacked into live, in-operation systems used to control a ships’ navigation, radar, engines, pumps and machinery, and was able to shift the vessel’s reported position and mislead the radar display.

Another attack resulted in machinery being disabled, signals to fuel and ballast pumps being over-ridden and steering gear controls manipulated.

“We succeed in penetrating the system simply by sending an email to the captain’s computer,” Asaf Shefi, Naval Dome’s CTO, the former Head of the Israeli Naval C4I and Cyber Defense Unit, said commenting on the penetration into the ship’s Electronic Chart Display and Information System (ECDIS).

“We designed the attack to alter the vessel’s position at a critical point during an intended voyage – during night-time passage through a narrow canal. During the attack, the system’s display looked normal, but it was deceiving the Officer of the Watch. The actual situation was completely different to the one on screen. If the vessel had been operational, it would have almost certainly run aground.”

According to Shefi, the Naval Dome hack was able to alter draught/water depth details in line with the spurious position data displayed on the screen.

“The vessel’s crucial parameters – position, heading, depth and speed – were manipulated in a way that the navigation picture made sense and did not arouse suspicion,” he said. “This type of attack can easily penetrate the antivirus and firewalls typically used in the maritime sector.”

Commenting on the ease with which Naval Dome was able to by-pass existing cyber security measures, Shefi explained: “The Captain’s computer is regularly connected to the internet through a satellite link, which is used for chart updates and for general logistic updates. Our attacking file was transferred to the ECDIS in the first chart update. The penetration route was not too complicated: the attacking file identified the Disk-On-Key use for update and installed itself. So once the officer had updated the ECDIS, our attack file immediately installed itself on to the system.”

In a second attack, the test ship’s radar was hit. While the radar is widely considered an impregnable, standalone system, Naval Dome’s team used the local Ethernet Switch Interface – which connects the radar to the ECDIS, Bridge Alert System and Voyage Data Recorder – to hack the system.

“The impact of this controlled attack was quite frightening,” said Shefi. “We succeeded in eliminating radar targets, simply deleting them from the screen. At the same time, the system display showed that the radar was working perfectly, including detection thresholds, which were presented on the radar as perfectly normal.”

A third controlled attack was performed on the Machinery Control System (MCS). In this case, Naval Dome’s team chose to penetrate the system using an infected USB stick placed in an inlet/socket.

“Once we connected to the vessel’s MCS, the virus file ran itself and started to change the functionality of auxiliary systems. The first target was the ballast system and the effects were startling. The display was presented as perfectly normal, while the valves and pumps were disrupted and stopped working. We could have misled all the auxiliary systems controlled by the MCS, including air-conditioning, generators, fuel systems and more.”

Itai Sela, CEO of Naval Dome, added that the virus infecting ship systems can also be unwittingly transferred by the system manufacturer.

“As manufacturers themselves can be targeted, when they take control of onboard computers to carry out diagnostics or perform software upgrades, they can inadvertently open the gate to a cyber attack and infect other PC-based systems onboard the ship. Our solution can prevent this from happening.”