Hacked – a real life story of exploiting vessel VSAT

We hacked a ship and the owner is liable, writes Ewan Robinson, Yangosat.

Well, we hacked the communications system of the ship. Technically we have been doing this for a few years. This time we did it like a ‘bad guy’ would.

We gained access to the vessel, belonging to a multinational company, and found out everything possible about the system, the setup, and the manufacturer’s information. This is a very specialised vessel that was alongside in the capital city of a major European country, carrying out cargo discharge.

We could have broken the system so badly that the vessel would have been back to Sat-C and flag signals. Any information going through that satcom could have been collected, checked and used for variety of nefarious activities.

We didn’t do that. As we are Ethical Hackers, we are obliged to act in certain ways. One of these obligations is to tell everyone involved if we did something during testing.

So we told them. Well, we tried to.

The owner’s operators, when we finally managed to get someone in the overworked operations department to listen, didn’t care and ignored us. The equipment manufacturers didn’t even bother to respond.

All of the testing was documented, peer reviewed and otherwise substantiated by trusted persons. I think the lawyers are going to have a field day and be very happy. The ship owners are not.

Owners and operators are too often being badly supported and advised by the ‘super providers’ that exist in the market, who use third party engineers (or poorly trained engineers) and leave systems in an exposed state. Equipment manufacturers and developers are so guilty of poor techniques and security that reference to ‘industry best practice’ is a total contradiction.

Lawyers, P&I and Class are going to be so busy refusing claims in the event of a cyber incident, that the poor owners are not going to know where to turn.

Owners are also being provided with sub-standard equipment, equipment that cannot realistically be made secure in its current format. Many manufacturers and developers also fail to update and secure the equipment provided.

Service providers supply this equipment, along with the bandwidth and the engineers who install it, but might incorrectly configure the hardware and allow public access to it. Nevertheless, it will still be the owner that is liable if there’s a cyber failure.

Hacking the VSAT

We have been presenting at various conferences over the last few years, highlighting how exposed we are as an industry to ‘hackers’ and bad actors.

These presentations normally consist of a prepared victim vessel, using a system that had been poorly configured by the provider, or the provider’s appointed engineer, allowing us to access the equipment onboard (in most cases the antenna or satcom system). It’s a quick way to demonstrate to an audience just how much information we are ‘displaying publicly’.

Recently, we were asked, if it was a real world situation away from a prepared demo, “what could someone actually do?”

A relevant question, we thought. So we went ahead to prove what ‘they’ could do.

As a basic attack, they could lock out all the users from accessing the equipment. They could turn off the satcom, or prevent applications and users on board gaining access to the internet or to systems on shore, while preventing shore offices from reaching the vessel.

This is annoying and disruptive, but also potentially quite expensive, costing from a few hundred to hundreds of thousands of dollars if the charterer deems ‘off hire’ status due to lack of communications.

Given the number of systems that are exposed to the internet with poor configuration, it is relatively easy to find a ‘victim’ and to maximise the information gained by using a variety of available tools, and exposing the most basic mistakes.

Mistakes like default admin passwords remaining in place. There may be a need for it, but there’s really no excuse for it. I know service providers who manage several thousands of vessels and still use engineers who fail to remove default admin usernames and passwords.

Our target vessel was located in just 7 minutes. As mentioned, it belonged to a very large multinational corporation, yet had the default username and password still in effect on the VSAT system.

This allowed us to gain access to the administration area, so all usernames and passwords could be changed. It also gave us access to the system by FTP, though even if this had not already been available we could have enabled it ourselves as we were in the Admin area.

This is where major security flaw #1 was found. The FTP access gave access to the entire operating system of the device, not just the FTP area.

Major security flaw #2 was the discovery of a text file in every folder with a map of the entire structure of the operating system.

This allowed us to find and copy the ‘hidden’ password file to our local machine. For security, it was actually encrypted – but two hours later it wasn’t. So now we had all the manufacturer’s usernames and passwords.

This meant we could access any publicly available machines, where they had changed the default admin username and password, by using the manufacturer’s own username and password. These log-in details are created so the engineers can always get in to the system to provide support. Great for business and maintenance – not so great for security.

The VSAT modem was accessed, again using default connections on SSH, with publicly available usernames and passwords. Command line access to the modem was achieved, allowing us to take control and alter the configuration of the system.

2021 and beyond

Such systemic failures, at the developmental and operational level, are going to cause huge issues when IMO’s Maritime Cyber Risk Management in Safety Management Systems resolution comes into force from the start of 2021.

Class and P&I groups will be left wondering which claims to refuse and who to sue for negligence when incidents happen. The operators are trusting their providers to correctly implement systems on board, but with some manufacturers and developers failing to ensure security at such basic levels they will likely be left with the legal responsibility in the first instance.

The lesson of life in today’s marine communications environment? Don’t trust what’s being given to you.

Unless you have had your own trusted IT security check performed, why would you blindly trust a stranger with your vessels’ security now? Remember – in the end, the owner is liable.