Slashdot Mirror
Ships Infected With Ransomware, USB Malware, Worms (zdnet.com)
An anonymous reader writes: IT systems on boats aren't as air-gapped as people think and are falling victims to all sorts of cyber-security incidents, such as ransomware, worms, viruses, and other malware -- usually carried on board via USB sticks. These cyber-security incidents have been kept secret until now, and have only been recently revealed as past examples of what could go wrong, in a new "cyber-security guideline" released by 21 international shipping associations and industry groups. One of the many incidents: "A new-build dry bulk ship was delayed from sailing for several days because its ECDIS was infected by a virus. The ship was designed for paperless navigation and was not carrying paper charts. The failure of the ECDIS appeared to be a technical disruption and was not recognized as a cyber issue by the ship's master and officers. A producer technician was required to visit the ship and, after spending a significant time in troubleshooting, discovered that both ECDIS networks were infected with a virus. The virus was quarantined and the ECDIS computers were restored. The source and means of infection in this case are unknown. The delay in sailing and costs in repairs totaled in the hundreds of thousands of dollars (U.S.)." The document also highlights an incident involving ransomware. "For example, a shipowner reported not one, but two ransomware infections, both occurring due to partners, and not necessarily because of the ship's crew," reports ZDNet. Another ransomware incident occurred because the ship failed to set up proper (RDP) passwords: A ransomware infection on the main application server of the ship caused complete disruption of the IT infrastructure. The ransomware encrypted every critical file on the server and as a result, sensitive data were lost, and applications needed for ship's administrative operations were unusable. The incident was reoccurring even after complete restoration of the application server. The root cause of the infection was poor password policy that allowed attackers to brute force remote management services successfully. The company's IT department deactivated the undocumented user and enforced a strong password policy on the ship's systems to remediate the incident.
Don't run ships on Windows, for obvious reasons.
Also, not carrying ANY paper charts as a backup? Dumb, dumb, DUMB.
Just cruising through this digital world at 33 1/3 rpm...
If you are allowing people to plug USB sticks into your computer you aren't as "air gapped" as you think you are. Sneaker-net is still a net. Air-gapped means no connection to the outside AT ALL.
Seven puppies were harmed during the making of this post.
Air gaping in network terms means no connection possible. More in fluid flow terms, a semi abuse of language from a time of solely wired connections. Air gapped really means no connections allowed, wired or unwired. Ships by their very nature can not be air gapped, communications need to be maintained.
The ships system should be locked down though only capable of taking input from wired connections, never ever wireless and that USB port should be locked behind a safe in the Captains cabin. Flexible == to insecure in the digital world, only capable of doing what it was specifically designed to do should be the rule of law for digital security.
Chaos - everything, everywhere, everywhen
Once it was the wood-eating teredo worm that sank ships, now it's data-eating worms!
Not foreseeing malware problems can be kinda forgiven if you're ignorant of IT. But not having paper charts on board? That's utter stupidity. You're going to risk the ship and the life of everyone on board because you don't want to pay about $100 for a set of waterproof charts? Never mind malware. What happens if a generator glitch sends a power surge through the onboard power system? Or a rogue wave smashes in a bridge window dumping salt water on all the electronics?
Ships are not air-gapped, they are water-gapped!
And everyone knows that salt water conducts.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I was in the Navy back in the early '70s, when LORAN was still king. Our ship not only had paper charts for the Quartermaster's Mates to track our position by dead reckoning, we took regular star sightings with a sextant for Celestial Navigation. And, we still had two mechanical chronometers that were kept wound, even though the ship's navigator had an Omega watch that was more accurate. The USN doesn't take chances with things like this and I'd bet that today's ships still use dead reckoning, hand-wound chronometers and sextants even with today's highly accurate GPS, just to keep in practice in case of an emergency.
Good, inexpensive web hosting
"I'm the Nigerian Prince of the world!"
Table-ized A.I.
In critical applications you should be using embedded hardware that doesn't have usb unless absolutely required...
And even if you do have usb ports, you should be using an embedded os that only contains drivers for the specific usb devices its required to interface with.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
usually carried on board via USB sticks.
Well the USB and other similar external connectors should always be hard-disabled in mission critical applications.
Firstly, that's not going to help when your "mission critical" system is running Windows. Sooner or later the outside world is going to be reachable and if you're stupid enough to be running Windows then your system is going to be hosed.
What sort of drooling imbecile walks a USB device into the facility and plugs it into a system like that? Have we learnt nothing whatsoever from all the other cases since years where that was the attack vector for an airgapped system?
Yeah, unlike a facility on land, on a ship the crew might be away for weeks and might just want to bring things with them on a USB stick. Having security that relies on the user not being human is stupid. If you're going to shut away humans for weeks at a time you must be really dumb to be surprised that they want to bring entertainment for that period.
Instead of castigating the users for being human, you should have been castigating the techies for choosing Windows in the first place.
I'm a minority race. Save your vitriol for white people.
Since they usually propogate via USB *drives* (not "sticks") then I'm going to go ahead and say they are exactly as air gapped as one might think.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
HACK TEH PLANET!
Don't fight for your country, if your country does not fight for you.
That means spending money. How dare you suggest that?!?
often COTS run windows, the navigation/sensors tends to be seperate network. Like all systems you need management and maintenance of those systems just like the engine etc
The problem comes when no one takes responsibility
If a 30y lifespan is necessary on both hardware and software, why would you go with Windows at all? How easy is it to run Windows 2.x and MsDOS 3 on modern hardware?
Now how easy is it to run and compile simple software under any version of Linux, even if it came from something arcane like SunOS or SCO Unix.
Custom electronics and digital signage for your business: www.evcircuits.com
So in your mind the USB drive driver wouldn't be present. I suppose if the only thing it was used for was 2 Factor Auth, but I think in the cast majority of cases the USB drive would be used for sneaker-netting if the system is air gapped.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
They have satellite internet.
Some even fast enough connection to watch movies.
Air gap means NO outside connection.
Ships are NOT air gapped.
Windows is fine for some things, but the networks need to be segregated and external comms to critical systems should be proxied for status only and not control.
It sounds like the networks are even less robust than an automotive network, and they need to be more like an airplane.
Given the recent collisions my guess is that seamanship isn't the US Navy's strong suit at the moment.
There is absolutely no good reason to keep Autorun on USB devices as a thing. People just need to learn to open Windows Explorer, and browse to an .exe to run if they need to install something. If it is drivers they are worried about, then provide simple steps on the device in print for where to download drivers. That is it, end-stop-goodbye.
... shadowing the goddam ship's starboard aft and hopping a WiFi that was just a LAN?
The root cause of the infection was poor password policy that allowed attackers ...
Or did they land an Internet-connected drone on the deck and snake an Ethernet cable down to the server to "attack," it? What is "air gap" again?
It little behooves the best of us to comment on the rest of us.
iamthecaptainnow.exe
When I was in the Navy, I was assigned to After Steering, just above the rudder. If the connections from the bridge to the rudder failed, we could steer from there, and often did for practice. If the motors moving the rudder died, we could even turn it manually, although very slowly, and the ship would be brought down to a safe speed. (No, I never had to do it, but I know it was done during a combat drill once.) Of course, we only had one rudder and I hate to think of how many men it would take to turn an aircraft carrier that way.
Good, inexpensive web hosting
This is a problem because management will not force control systems to be air gapped. And I don't mean from the Internet I mean from other computers at the same location.
The way such a system should be designed is that any system having to to do with ship control should be on it's own network. This network should only be accessible for update/file download from a secure station onboard the ship and only accessible to a technician while in port.
All personal/administrative computer should be a a different network. If your administrative stuff is important enough it too should be on a separate network.
As soon as you let people start using your network for personal letters, email and entertainment you are screwed.
Why aren't things done this way? Because companies are cheap. They don't want to maintain separate hard networks. They don't want to have to pay technicians to actually visit the ships to update software, and they don't want to pay what they would have to pay to get competent computer technicians to actually travel with the ship. Figure what a top IT person gets and then add the premium they would want for spending 24/7 at sea for a good portion of the year.
One of my friends back then was a Quartermaster's Mate, which is how I know this stuff. When we went from Pearl to Subic Bay, our last leg was from Guam, after refueling. For dead reckoning, they used 2000 yards per nautical mile (rounded down) and all turns were treated as point turns, ignoring the distance traveled in the turn itself. When we made landfall, our calculated position was off by less than 2 nmi. I wonder how many of today's navigators could do so well.
Good, inexpensive web hosting
When they remotely infected that ship,
was the wek password 16309, or 123456?