Cyber Security of ships

Could someone remotely put the rudder hard over on a ship while transiting the Suez Canal?
Never thought of the possibility? Someone apparently have:

So far the very good hackable items are the brains of various scribblers( Splash247 Guru Sam C. ) and other scaremongers ,who pump the hype with blind copies and dissemination of such stories on the web in order to scare managers/owners/operators stiff as they successfully did in y2k scam.

All to the great enjoyment of cyber security lobbyist drooling at the piece of pie ,waiting for them out there at sea.

I may be wrong of course but do strongly suggest an in depth study of SOLAS and in depth familiarization of vsl operations . Surely it may help .
Meantime pls find below DEBUNKING OF ARMAGGEDON THEORIES PROMULGATED BY CYBER -SCARE ENTHUSIASTS done by Capt. Gunter Schutze dd. July 4th, 2018 .

I have not obtained His permission to blind copy his text but it can be found in Linkedin , Safety4sea and some other sites. Needless to say in my subjective opinion He is damn right.

Meantime I would be worried looking at the picture in the source article, if hackers have already not attacked the loadicator of this ship in order to fool the master and chief mate, that their calculated bending moments are less then 100%, while in reality the deck line or coaming line may indicate great desire to become an inverted happy banana.

Dp vessels with more computers and likely to have a system to connect for remote access are at risk when the crew leave it wired to the satcom.
Golden rule is that connect in a locked box and left disconnected.
Satcom systems were never built to deal with hacking, hopefuly lots now got firewalls installed on vessels.

CyberOwl-HFW-Thetius-Cyber-Security-Report-The-Great-Disconnect-.pdf

Lets for a brief moment put aside sophisticated , highly skilled professionals called HACKERS, sinking, breaking in half ships, jamming rudders ,stopping ship’s engines and causing havoc in busy , congested traffic lanes and waters . What i am missing in this catastrophic scenarios is an attack on a reefer container full of chilled tenderloins and converting it into microwave oven with a "delicious " result .

Have found an interesting point of view written by my FB friend Mikhail in this link :

How to disable global shipping in just one stroke? Russia knows, how. – Maritime Bulletin

Looks like Ruskie’s solutions lacking western sophistication are quite simple but may be quite effective . Just like their missile targeting - what they lack in precision, they compensate in yield.

How to fix a problem the Russian way can be admired in this famous extract from Armageddon movie :stuck_out_tongue_winking_eye:

(225) Armageddon - Russian Cosmonaut - YouTube

Returning to our muttons ,namely Splash247 revelations , have found the original LLoyds List article referred to by the author Sam C.
Seized UK tanker likely ‘spoofed’ by Iran :: Lloyd’s List (informa.com)
" ships’ receivers being tricked with counterfeit satellite automatic identification signals " and " *Stena Impero received “spoofed” Automatic Identification System signals, sending it off course into Iranian waters as it transited the Strait of Hormuz.- loved that sentences.

and also

59-2(h)+El-Fakir+Note.pdf (squarespace.com)

Interesting.

Yes and no. Any robust vessel satcom these days is like any shore based network switch. The Sat feed is the same as the fiber feed to the core switch. What happens down the line is dependent on the quality of your firewalls.

Some vendors like Kongsberg like to have remote access to be able to troubleshoot issues. Security minded shipping companies will deny that access. The best firewall is a hard wall. If you want access you need to be onboard.

Otherwise this story is as old as Hackers , a movie from 1995 that suggested remotely capsizing tankers by hacking their ballast system. It’s not far fetched, and with a co-conspirator would be easily done today.

2 Likes

Even DNV isn’t able to avoid cyber attack. Affects 6000+ ships:

1 Like

Norwegian Shipowner’s Association has their own Cyber Security Service:
https://www.normacyber.no/en/home

Fundamental concept in IT, if you put your crown jewels on the internet the thieves will come looking.

Actually, it is worse than that. Up until the advent of cyber currency it was possible to do threat assessment based on the nature of the asset under threat. That is, you could make more or less educated guesses about whether anybody with an interest in your stuff would have the capability to go after it.

Now the criminals don’t bother to select or even identify their targets. They just scoop up what’s accessible and put it up on the dark web for sale to any third party who has bitcoin to spend.

So all data on the net is effectively under maximum threat.

Earl

2 Likes

Agreed
but now the art is trying to work out if someone has hacked in and are just looking around or…

Together, DNV and Nixu will safeguard demanding IT and industrial control system environments and build business resilience across multiple industries – from energy and maritime to telecommunications and financial services:
https://www.dnv.com/news/dnv-acquires-nixu-to-safeguard-society-from-rising-cyber-security-risks-244722

What do You think ?? Any comments remarks re below material will be most welcome.

https://imcso.org/

1 Like