Slashdot Mirror
Ships Infected With Ransomware, USB Malware, Worms (zdnet.com)
An anonymous reader writes: IT systems on boats aren't as air-gapped as people think and are falling victims to all sorts of cyber-security incidents, such as ransomware, worms, viruses, and other malware -- usually carried on board via USB sticks. These cyber-security incidents have been kept secret until now, and have only been recently revealed as past examples of what could go wrong, in a new "cyber-security guideline" released by 21 international shipping associations and industry groups. One of the many incidents: "A new-build dry bulk ship was delayed from sailing for several days because its ECDIS was infected by a virus. The ship was designed for paperless navigation and was not carrying paper charts. The failure of the ECDIS appeared to be a technical disruption and was not recognized as a cyber issue by the ship's master and officers. A producer technician was required to visit the ship and, after spending a significant time in troubleshooting, discovered that both ECDIS networks were infected with a virus. The virus was quarantined and the ECDIS computers were restored. The source and means of infection in this case are unknown. The delay in sailing and costs in repairs totaled in the hundreds of thousands of dollars (U.S.)." The document also highlights an incident involving ransomware. "For example, a shipowner reported not one, but two ransomware infections, both occurring due to partners, and not necessarily because of the ship's crew," reports ZDNet. Another ransomware incident occurred because the ship failed to set up proper (RDP) passwords: A ransomware infection on the main application server of the ship caused complete disruption of the IT infrastructure. The ransomware encrypted every critical file on the server and as a result, sensitive data were lost, and applications needed for ship's administrative operations were unusable. The incident was reoccurring even after complete restoration of the application server. The root cause of the infection was poor password policy that allowed attackers to brute force remote management services successfully. The company's IT department deactivated the undocumented user and enforced a strong password policy on the ship's systems to remediate the incident.
Don't run ships on Windows, for obvious reasons.
Also, not carrying ANY paper charts as a backup? Dumb, dumb, DUMB.
Just cruising through this digital world at 33 1/3 rpm...
If you are allowing people to plug USB sticks into your computer you aren't as "air gapped" as you think you are. Sneaker-net is still a net. Air-gapped means no connection to the outside AT ALL.
Seven puppies were harmed during the making of this post.
Once it was the wood-eating teredo worm that sank ships, now it's data-eating worms!
I was in the Navy back in the early '70s, when LORAN was still king. Our ship not only had paper charts for the Quartermaster's Mates to track our position by dead reckoning, we took regular star sightings with a sextant for Celestial Navigation. And, we still had two mechanical chronometers that were kept wound, even though the ship's navigator had an Omega watch that was more accurate. The USN doesn't take chances with things like this and I'd bet that today's ships still use dead reckoning, hand-wound chronometers and sextants even with today's highly accurate GPS, just to keep in practice in case of an emergency.
Good, inexpensive web hosting
That means spending money. How dare you suggest that?!?