Slashdot Mirror
How Hackers Are Targeting the Shipping Industry (bbc.com)
An anonymous reader shares a report: When staff at CyberKeel investigated email activity at a medium-sized shipping firm, they made a shocking discovery. "Someone had hacked into the systems of the company and planted a small virus," explains co-founder Lars Jensen. "They would then monitor all emails to and from people in the finance department." Whenever one of the firm's fuel suppliers would send an email asking for payment, the virus simply changed the text of the message before it was read, adding a different bank account number. "Several million dollars," says Mr Jensen, were transferred to the hackers before the company cottoned on. After the NotPetya cyber-attack in June, major firms including shipping giant Maersk were badly affected. In fact, Maersk revealed this week that the incident could cost it as much as $300 million in profits. But Mr Jensen has long believed that that the shipping industry needs to protect itself better against hackers -- the fraud case dealt with by CyberKeel was just another example. The firm was launched more than three years ago after Mr Jensen teamed up with business partner Morten Schenk, a former lieutenant in the Danish military who Jensen describes as "one of those guys who could hack almost anything." They wanted to offer penetration testing -- investigative tests of security -- to shipping companies. The initial response they got, however, was far from rosy.
I doesn't sound like a virus to me -- a virus has to be self-replicating. This sounds more like an implant.
Could this be the kind of response someone would give when misappropriation of money is found out.
When government outlaws regexes, only outlaws will have regexes.
I'm a good cook. I'm a fantastic eater. - Steven Brust
There's a book on my reading list that I haven't read yet (pay attention, trolls), about the history of shipping containers: "Ninety Percent of Everything: Inside Shipping, the Invisible Industry That Puts Clothes on Your Back, Gas in Your Car, and Food on Your Plate" by Rose George. The New York Times gave it a good review when it first came out, mentioning that the author traveled on a Maersk ship to research the book.
In related news, autonomous ships will soon become a reality. More targets for hackers.
http://spectrum.ieee.org/transportation/marine/forget-autonomous-cars-autonomous-ships-are-almost-here
"before the company cottoned on"
What do the editors even do here?
Any actionable financial emails should be encrypted and signed. Why would they do business this way? Even a signed pdf invoice would have been better...
love is just extroverted narcissism
Transferring millions to an account number found in an email ? That sounds dumb to me.... But at the end there is always a human that makes mistakes. I guess every industries should learn from this 'incident'... Never trust emails for conducting business. Pick up the phone!
Creimer posting as APK. Another APK Creimer post. Welcome to slashdot boys.
Looks to me like someone's list of favorite movies growing up included Hackers and Office Space
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
APK Creimer is a dreamboat. So thick so sweet.
Large companies often have this problem. At the end of all the financial safeguards, double and triple checks, and hidebound processes for moving money around, the actual way it's done is very dependent on a human recognizing a message is from a trusted source. Billion-dollar companies have a bunch of payroll people literally emailing or EDI-ing unencrypted Excel files to their payroll processor showing who to pay what amount, and the only security on that process is that "I'm the payroll clerk, so I know what's going on." Same goes for invoices -- if something looks legit, and it looks like it came from a vendor, it gets paid.
If a company wants to keep these manual processes in place, they need to ensure the channels these messages run over are totally secure. At least train people to pick up a phone and call if they see something out of the ordinary.
Just another company that doesn't think IT is important until something bad happens. No big surprise.
Well then, put the ships' ballasts under manual control.
There's no such thing anymore, Duke.
These ships are totally computerized. They rely on satellite navigation, which links them to our network, and the virus, wherever they are in the world.
I thought they were all pretty small. It sounds like a joke, don't worry it's only a small virus.
I saw this documentary in the mid-90s about hackers putting viruses on supertankers to capsize them. But it really wasn't the hacker. The hackers were the good guys trying to stop the executives who were the real villains. I think it was called 'Computer Hackers' or something.
They used email as their source of banking account information?! Whoever wrote a policy that said that was okay needs to never work around money ever again. That is too stupid for words.