Slashdot Mirror

← Back to Stories (view on slashdot.org)

Critical Flaws In Maritime Communications System Could Endanger Entire Ships (helpnetsecurity.com)

Posted by BeauHD on from the critical-vulnerabilities dept.

Orome1 shares a report from Help Net Security: IOActive security consultant Mario Ballano has discovered two critical cybersecurity vulnerabilities affecting Stratos Global's AmosConnect communication shipboard platform. The platform works in conjunction with the ships' satellite equipment, and integrates vessel and shore-based office applications, as well as provides services like Internet access for the crew, email, IM, position reporting, etc. The first vulnerability is a blind SQL injection in a login form. Attackers that successfully exploit it can retrieve credentials to log into the service and access sensitive information stored in it. The second one is a built-in backdoor account with full system privileges. "Among other things, this vulnerability allows attackers to execute commands with SYSTEM privileges on the remote system by abusing AmosConnect Task Manager," Bellano shared. The found flaws can be exploited only by an attacker that has access to the ship's IT systems network, he noted, but on some ships the various networks might not be segmented, or AmosConnect might be exposed to one or more of them. The vulnerabilities were found in AmosConnect 8.4.0, and Stratos Global was notified a year ago. But Inmarsat won't fix them, and has discontinued the 8.0 version of the platform in June 2017.

5 of 41 comments (clear)

  1. Not To Worry by mentil · · Score: 2

    Don't worry, there's no way the designer of the system would give details of the backdoor to a sexy enemy spy posing as an industrial espionage spy. Noone could make strategic use of that vulnerability unless they did something audacious like nuke all the colonies at once. /s

    --
    Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
  2. "...could endanger entire ships..." by willoughby · · Score: 4, Funny

    As opposed to endangering only half a ship, I guess...

    1. Re: "...could endanger entire ships..." by Anonymous Coward · · Score: 3, Funny

      Technically the bottom half is already sunk. So there's only a 50% chance that an exploit will cause a problem.

    2. Re:"...could endanger entire ships..." by ClickOnThis · · Score: 3, Insightful

      As opposed to endangering only half a ship, I guess...

      Less than that, I would think. The vulnerabilities expose a ship's IT systems. Potentially the entire set of IT systems, I suppose, but just the IT systems.

      Now, there may be serious consequences from such a compromise that could endanger the "entire" ship, such as leaks of strategic information, combat readiness, or defense vulnerabilities. But the headline still reads like breathless clickbait.

      --
      If it weren't for deadlines, nothing would be late.
  3. Stop the sensational headlines by Goetterdaemmerung · · Score: 2

    Article says "Could endanger *entire* ships" If this flaw can't sink or disable the engines it isn't endangering them, much less the *entire* ship.