Slashdot Mirror

← Back to Stories (view on slashdot.org)

Maritime Cybersecurity Firm: 37% of Microsoft Servers On Ships Are Vulnerable

Posted by samzenpus on from the protect-ya-neck dept.

colinneagle writes: A report from maritime cybersecurity firm CyberKeel claims that spot checks at 50 different maritime sites revealed that 37% of the servers running Microsoft were still vulnerable because they had not been patched. But what's most interesting is what happens when hackers can breach security in shipping environments, including one case in which "drug gangs were able to smuggle entire container loads of cocaine through Antwerp, one of Belgium's largest ports, after its hackers breached the port's IT network," said Rear Adm. Marshall Lytle, assistant commandant responsible for USCG Cyber Command.

51 comments

  1. Running "Microsoft" by ModernGeek · · Score: 1

    So this summary doesn't even go into which Microsoft product is vulnerable, and how these vulnerabilities could be potentially exploited. This level journalism is what causes people to say that Windows NT left a ship marooned.

    --
    Sig: I stole this sig.
    1. Re:Running "Microsoft" by rmdingler · · Score: 2

      Drug gangs...

      Two words put together by no one ever who sounded authentic.

      --
      Happiness in intelligent people is the rarest thing I know.

      Ernest Hemingway

    2. Re:Running "Microsoft" by rstanley · · Score: 5, Insightful

      "So this summary doesn't even go into which Microsoft product is vulnerable, ..."

      Are you kidding?

      They ALL are!!!

    3. Re:Running "Microsoft" by geekmux · · Score: 3, Funny

      So this summary doesn't even go into which Microsoft product is vulnerable...

      I'm sorry, but can you please identify your location? It seems the rest of us in the known universe are wondering what planet you are from where there is a Microsoft product that somehow isn't vulnerable.

      ..., and how these vulnerabilities could be potentially exploited.

      Given that the latest SMB rehashed vuln affects every version of Windows, I'd say the "exploit" is running Windows.

      This level journalism is what causes people to say that Windows NT left a ship marooned.

      Given my previous statement regarding vulnerabilities still being discovered, it really wouldn't fucking matter what version of Windows they assumed was hacked.

    4. Re:Running "Microsoft" by Bing+Tsher+E · · Score: 1

      This level journalism is what causes people to say that Windows NT left a ship marooned.

      Ah, you mean that old RexBallard-era chestnut on the 'Government Computer News' website? For some reason that's the only article I have EVER seen linked to from that particular website.

    5. Re:Running "Microsoft" by Anonymous Coward · · Score: 0

      Over a decade ago, I was talking to one of the top ranking members of a civilian/commercial ship's crew, and he was quite proud of their architecture, where even though the captain was the local domain admin, all the assets (files and such) were owned by another trusted domain in the forest. If someone local tried to take ownership or grab rights, the audit logs would show the breach in almost real time.

      These days, on a ship, I'd probably go with at least two RODC "appliances" (encrypted with BitLocker), for the forest/tree, then the DCs for the local ship's domain.

      As for what product is vulnerable, it could be that none of them are. It might be that someone brute-forced an account with domain admin or enterprise admin rights.

    6. Re:Running "Microsoft" by Anonymous Coward · · Score: 0

      > This level journalism is what causes people to say that Windows NT left a ship marooned.

      So, you are saying that "this level journalism" is 'Truth'.

    7. Re:Running "Microsoft" by Anonymous Coward · · Score: 1

      Notepad

  2. On the other hand by OzPeter · · Score: 2

    Drug smugglers in Europe managed to deliver 400kg of cocaine to the Aldi supermarket chain in Berlin. So apparently not all drug smugglers are good at moving their contraband.

    Aldi supermarket workers find record cocaine stash in banana boxes

    --
    I am Slashdot. Are you Slashdot as well?
    1. Re:On the other hand by grcumb · · Score: 3, Funny

      Drug smugglers in Europe managed to deliver 400kg of cocaine to the Aldi supermarket chain in Berlin. So apparently not all drug smugglers are good at moving their contraband.

      Aldi supermarket workers find record cocaine stash in banana boxes

      'Allo? Polizei? Ve bin finden der... four... five... six... er, FOUR hundred kilos von der cocaine!'

      --
      Crumb's Corollary: Never bring a knife to a bun fight.
    2. Re:On the other hand by someone1234 · · Score: 1

      Europe's supermarkets are literally flooded by cocaine. Earlier Prague got 100kg shipped. Now Berlin got 400kg.
      There was another 140kg shipment somewhere. And these are just the cases picked up by the media.

      --
      Patents Drive Free Software as Hurricanes Drive Construction Industry
  3. That's Because they're all running by Anonymous Coward · · Score: 4, Funny

    Pirated versions.

    yarrr

    1. Re:That's Because they're all running by electrosoccertux · · Score: 1

      Pirated versions.

      yarrr

      when it's maritime you use the merigoround

      these are seaservers btw, not webservers

  4. Underestimate. by Anonymous Coward · · Score: 0

    37% of Micro$oft servers have known vulnerabilities. 100% have vulnerabilities - it M$.

    1. Re:Underestimate. by Anonymous Coward · · Score: 0, Troll

      37% of wives and girlfriends are likely to cheat on you too. But what you gonna do about it? Dump your cheating girlfriend and just end up with another cheating girlfriend? What's the point of that? So most people just stay with their lousy operating system or girlfriend. Really it is all pointless anyway.

    2. Re:Underestimate. by hey! · · Score: 2

      37% of wives and girlfriends are likely to cheat on you too. But what you gonna do about it? Dump your cheating girlfriend and just end up with another cheating girlfriend? What's the point of that? So most people just stay with their lousy operating system or girlfriend. Really it is all pointless anyway.

      Er... presuming that the cheating is important to you, you have a 100% chance of having a cheating girlfriend if you stay with the current one but only a 37% chance if you switch to a new, randomly chosen girlfriend.

      But... if you don't instinctively see that, then I have to conclude that on some level you want abuse from your girlfriend/software vendor. In fact given your track record of past choices it seems likely that your choice will perform worse than chance, although a probably bad new choice remains a better strategy than staying with the devil you know.

      If you don't have the confidence in your discretion to improve upon chance, a randomly chosen girlfriend/OS is a reasonable next step. You should try *anything* that meets the obvious superficial criteria (e.g., is biologically female, has companies providing professional support services). In fact studies suggest that while attractiveness makes a huge difference in who people ask out on a date, it has no effect on their satisfaction with that date once it takes place. What we think we want and what will make us happy are often two different things.

      --
      Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
  5. 37% of webservers, not servers on ships by Dutch+Gun · · Score: 4, Informative

    Hopefully that includes timely patch management, since CyberKeel claims 37% of maritime webservers running Microsoft were not patched and thereby "open to remote control risk." Granted, that risk is about hackers taking over websites, but it could certainly turn into a misinformation mess.

    Also, I love the picture used for that article - a coast guard cutter in front of a ship burning on the water in the background - as though it's vulnerable Microsoft-based computer suddenly burst into flames and took the ship with it. Danger! Patch your OS or this could happen to you!

    --
    Irony: Agile development has too much intertia to be abandoned now.
    1. Re:37% of webservers, not servers on ships by __aabppq7737 · · Score: 1

      I saw one Azure ad where a helicopter was lifting a boat out of the water "The cloud saves more than time. This is the M$ Cloud."

    2. Re:37% of webservers, not servers on ships by plopez · · Score: 1

      And then there was the famous Intel TV ad showing how the Intel chip could make the internet run faster.

      --
      putting the 'B' in LGBTQ+
  6. Starlight Glimmer 2016 by Anonymous Coward · · Score: 0

    Vote Starlight Glimmer for President in 2016. As the equalist candidate, Starlight invites all of America to experience true friendship for the first time. Starlight believes in an America where people don't flaunt their special talents because they have no special talents to flaunt.

    1. Re:Starlight Glimmer 2016 by plopez · · Score: 0

      Bah! Vote for the greater evil; https://www.facebook.com/cthul...

      --
      putting the 'B' in LGBTQ+
    2. Re:Starlight Glimmer 2016 by plopez · · Score: 0

      Bah! Vote darkness and despair; https://www.facebook.com/cthul...

      --
      putting the 'B' in LGBTQ+
  7. Thank Greeks and Microsoft for your iWatches! by antiperimetaparalogo · · Score: 1

    As i Greek, which his compatriots control (including those actually Greek but under a flag of convenience) about 1/3 of the world's fleet (by any important metric), and since 9/10 of global/international trade is done by sea, i ensure you that Microsoft servers on the ships are safe enough (and -usually- out of a hacker's reach anyway), so you Apple iWatches will be delivered in time... thank Greeks and Microsoft!

    --
    Antisthenes: "Wisdom begins by examining the words/names." - excuse my English, i am (slightly...) better with my Greek!
    1. Re:Thank Greeks and Microsoft for your iWatches! by ColdWetDog · · Score: 1

      You do realize that these systems are connected to the Internet? The same Internet that everyone else is connected to. The fact that the server is in the middle of the ocean is irrelevant. As is the fact (true enough) that a significant fraction of commercial shipping is run by Greek firms.

      I suppose it being in Greek might be an example of security by obscurity, but it's just TCP/IP and the same Microsoft code that everyone else uses.

      --
      Faster! Faster! Faster would be better!
    2. Re:Thank Greeks and Microsoft for your iWatches! by antiperimetaparalogo · · Score: 2

      You do realize that these systems are connected to the Internet? The same Internet that everyone else is connected to. The fact that the server is in the middle of the ocean is irrelevant. As is the fact (true enough) that a significant fraction of commercial shipping is run by Greek firms.

      I suppose it being in Greek might be an example of security by obscurity, but it's just TCP/IP and the same Microsoft code that everyone else uses.

      No, -most- of these systems are not connected to the Internet, not even between them and/or a central ship's system - usually they are just monitor and control systems with very little integration. I don't blame you because the article (and /. summary) was not good to begin with, so relax, everything is under control in sea by us Greeks (hey dude, some fucking Greek pride, don't hate me!)

      --
      Antisthenes: "Wisdom begins by examining the words/names." - excuse my English, i am (slightly...) better with my Greek!
    3. Re:Thank Greeks and Microsoft for your iWatches! by Anonymous Coward · · Score: 0

      Just don't give him a credit card. We all know what happens when you extend a line of credit to Greece ;)

    4. Re:Thank Greeks and Microsoft for your iWatches! by Anonymous Coward · · Score: 0

      And why do you Greeks fail to pay taxes and are more corrupt than Bulgaria? Yeah, fucking Greek pride. By the way, fucking Greek is quite cheap nowadays :-D

  8. servers on ship != port systems by BK425 · · Score: 1

    The headline is 37% of MS servers on ships, the lead is about Port IT systems. These are of course very different things.

  9. Windows for warships still in use? by Joe_Dragon · · Score: 1

    Well if they F* realty bad just send the seals into the MS HQ.

  10. Ship Hacking? by xrayspx · · Score: 1

    Never fear, *I* is here.

    Uuh, Mister The Plague, something really weird's going in the system, we've got a user logged on, with the load of about four users. I think we've got a hacker.

    --
    I like music
  11. Obviously by ArcadeMan · · Score: 4, Funny

    Those servers are particularly vulnerable to flooding.

    --
    Get free satoshi (Bitcoin) and Dogecoins
    1. Re:Obviously by TeknoHog · · Score: 1

      As a bonus, you can experience the Blue screen of death in immersive 3D.

      --
      Escher was the first MC and Giger invented the HR department.
  12. Apps are responsible by Anonymous Coward · · Score: 0

    App appers installed Windows for Apps, causing app appers to get apped!

    Apps!

  13. What about Linux? by Anonymous Coward · · Score: 0

    So what percentage of Linux servers on ships are vulnerable? Not a troll, I just the article itself is.

  14. Microsoft is garbage by Anonymous Coward · · Score: 0

    Anyone using Microsoft software for anything other than personal use should be fired and thrown in prison for criminal incompetence.

  15. Cocaine through Antwerp by Anonymous Coward · · Score: 0

    container loads of cocaine through Antwerp

    So, an everyday load for a port of that size. Let me guess, the final destination was Milano and London? As God and Queen knows, the economy needs a boost while keeping lean and skinny.

  16. Too many links by tquasar · · Score: 1

    Do you need a link in every sentence?

  17. They shipped buggy code by penguinoid · · Score: 1

    Come on, someone had to say it.

    --
    Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
  18. Servers on Ships? by styrotech · · Score: 2

    Is that like Ruby on Rails?

  19. Pffft by Tablizer · · Score: 1

    That study is full of ships!

    --
    Table-ized A.I.
  20. doit by Anonymous Coward · · Score: 0

    more patching less lashing!

  21. You say bugs by rakslice · · Score: 1

    We say "Ship It!"

  22. Heh by Vlijmen+Fileer · · Score: 1

    I thought I read "Microsoft Servers on Ships"
    Can not be true, right :)

  23. Computers on ships? by houghi · · Score: 1

    We are talking about hackable computers on ships and still no reference to Hackers? You people disapoint me.

    --
    Don't fight for your country, if your country does not fight for you.
  24. Not new at all, and hackers not involved by Trax3001BBS · · Score: 1

    Long time ago Risk Digest had an article where the latest and greatest air craft carrier failed left drifting in the water when the operating system (NT) had a divide by zero error.

    Doing a global search the best I could come across was this one article.

    (http://www.theregister.co.uk/2010/05/12/emals_backfire/)

    The article describes an incident where, apparently, a test of the US Navy's
    new Electro-Magnetic Aircraft Launch System (EMALS) failed because it
    unexpectedly went in reverse, destroying 'important equipment' and delaying
    the program by several months. The failure has been blamed on a software
    problem.

    Given that such a device only has two possible ways to move - forwards or
    backwards - one wonders just how it happened. However, I'm sure that it is
    far more complicated than I realise.

    What is most risky is the attitude of EMALS programme chief Captain Randy
    Mahr who says, "The things that are delaying me right now are software
    integration issues, which can be fine-tuned after the equipment is installed
    in the ship."

    I think most RISKS readers will agree that on-board ship will be the worst
    place to finish the software. (However it will be the best place in order to
    claim to your paymasters that the project is complete and operational - bar
    a minor software glitch that may not happen again. And even if it does, it
    may not kill or injure anyone as long as we remember to tell everyone to
    stand well away from the back of the machine as well as the front.)"

    a lot had to be removed due to "junk charters"
    ------

  25. Gibson? by Bruha · · Score: 1

    I figured they would of fixed this problem after the Gibson was hacked?

    DiVinci returns.

  26. Only 37%? by jbmartin6 · · Score: 1

    If it is only 37%, they are well ahead of the rest of the world!

    --
    This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
  27. 37% of Microsoft servers on ships are vulnerable.. by Anonymous Coward · · Score: 0

    Couldn't they just have left out the "on ships" part and said the same thing?

  28. Re:37% of Microsoft servers on ships are vulnerabl by rstanley · · Score: 1

    No, because if you consider ALL Mickey$oft Servers, then the percentage would be even higher, IMHO!!!