{"id":6605,"date":"2016-01-12T04:01:54","date_gmt":"2016-01-12T09:01:54","guid":{"rendered":"https:\/\/kasperskydaily.com\/uk\/?p=6605"},"modified":"2019-11-22T10:11:48","modified_gmt":"2019-11-22T10:11:48","slug":"ship-black-boxes-vulnerability","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/ship-black-boxes-vulnerability\/6605\/","title":{"rendered":"Hey, captain, what&#8217;s wrong with your vessel? Ships black boxes are vulnerable to hackers"},"content":{"rendered":"<p>Usually we say \u201cblack box\u201d when we speak about flight data recorders, but these devices are actually implemented on ships as well. They are called Voyage Data Recorders, or VDRs. Maritime black boxes are required for all passenger and cargo vessels over 3,000 gross tons.<\/p>\n<p>Just like an airplane\u2019s black box, VDRs log everything what\u2019s going on with a vessel at sea: weather conditions, radar images, position, speed and all audio communications. In case of an accident this device, placed into protective capsule with an acoustic beacon, becomes an automated version of ship\u2019s logbook.<\/p>\n<p>VDR helps investigators clarify, what\u2019s happened with a vessel and why. For example, this device was used in the trial against the captain and crewmembers of infamous <a href=\"https:\/\/en.wikipedia.org\/wiki\/Costa_Concordia_disaster\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Costa Concordia cruise liner<\/a>. Their culpable negligence resulted in the death of more than 30 passengers and wreckage the ship.<\/p>\n<p>VDRs are used to investigate disasters of all kinds, including environmental incidents. In 2007 container vessel Cosco Busan <a href=\"https:\/\/en.wikipedia.org\/wiki\/Hanjin_Venezia\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">rammed into<\/a> the protective fender of the Delta Tower of the San Francisco \u2014 Oakland Bay Bridge in heavy fog. More than fifty thousand US gal of heavy fuel <a href=\"https:\/\/en.wikipedia.org\/wiki\/Cosco_Busan_oil_spill\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">oil spilled from its tanks<\/a> into San Francisco Bay. The crew refused to cooperate, but data extracted from ship\u2019s VDR helped the National Transportation Safety Board determine the causes of the incident.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">What is a plane's \"black box\" really?  <a href=\"https:\/\/t.co\/cXLa0FE3ba\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/cXLa0FE3ba<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/airplanes?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#airplanes<\/a> <a href=\"https:\/\/t.co\/3iCiJ9m6sm\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/3iCiJ9m6sm<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/664869307369787392?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">November 12, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Unfortunately, sometimes voyage data recorders work not as good as they are cracked up to be. As <a href=\"https:\/\/www.kaspersky.com\/blog\/maritime-cyber-security\/8796\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">the maritime industry in general<\/a>, VDR developers do not care much about Internet security and protection of their connected devices. Besides, many shipowners use old solutions, which run outdated Windows XP. As a result, vulnerable devices with poor software update mechanisms and bad encryption frequently <a href=\"http:\/\/blog.ioactive.com\/2015\/12\/maritime-security-hacking-into-voyage.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">appear on the market<\/a>. In this case all interested parties \u2014 from cybercriminals to seafarers and shipowners \u2014 can change or delete logged data, and that makes a VDR no good at all.<\/p>\n<p>15 February 2012 Italian seafarers mistook two Indian fishermen for pirates and shot them. After the incident all crucial data recorded on VDR, produced by Furuno company, was found to be mysteriously corrupted. This incident resulted in a <a href=\"https:\/\/en.wikipedia.org\/wiki\/enrica_lexie_case\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">diplomatic scandal<\/a>, and its investigation is still ongoing.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">More connected, less secure: how we probed <a href=\"https:\/\/twitter.com\/hashtag\/IoT?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#IoT<\/a> for vulnerabilities <a href=\"https:\/\/t.co\/f4Y6iXLG8U\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/f4Y6iXLG8U<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/internetofthings?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#internetofthings<\/a> <a href=\"https:\/\/t.co\/ZwFbvGGW6G\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/ZwFbvGGW6G<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/662276796310769664?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">November 5, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Later that year a cargo vessel Prabhu Daya flying the Singapore flag crash-dived a fishing boat off the Kerala Coast and tried to flee the scene. As a result, two fishermen died and the third disappeared. Later he was eventually rescued by another fishing vessel in the area. During the investigation <a href=\"http:\/\/www.thehindu.com\/news\/national\/tamil-nadu\/voyage-data-recorder-of-prabhu-daya-may-have-been-tampered-with\/article2982183.ece\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">authorities found out<\/a>, that one of the crewmembers deliberately damaged the data on VDR: he had inserted a pen drive into the device and infected it with a virus, which in turn corrupted all the logs. Moreover, the main computer system of Prabhu Daya was also infected, as it had no security solution at all.<\/p>\n<p>Recently security experts from IOActive <a href=\"http:\/\/blog.ioactive.com\/2015\/12\/maritime-security-hacking-into-voyage.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">examined a VR-3000 voyage data recorder<\/a> produced by the aforementioned Furuno company. They have found out that the device is rather vulnerable to hacker attacks:<\/p>\n<p>\u201cMultiple services are prone to buffer overflows and command injection vulnerabilities. The mechanism to update firmware is flawed. Encryption is weak. Basically, almost the entire design should be considered insecure.\u201d<\/p>\n<p>As a result, terrorists, pirates and other malefactors can remotely spy on the conversations of crewmembers and their radio calls, as well as access, modify or erase data stored on the VDR.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Hacked at sea: Researchers find ships\u2019 data recorders vulnerable to attack <a href=\"https:\/\/t.co\/VLaGtfgV4k\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/VLaGtfgV4k<\/a> by <a href=\"https:\/\/twitter.com\/thepacketrat?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@thepacketrat<\/a><\/p>\n<p>\u2014 Ars Technica (@arstechnica) <a href=\"https:\/\/twitter.com\/arstechnica\/status\/675009341603389447?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">December 10, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Many VDR systems, though not connected to the Internet directly, use Ethernet and access the same network as satellite communications systems, which are already known to be vulnerable. That\u2019s why criminals don\u2019t need to be onboard to get access to VDR data \u2014 all they need is to break into the main computer system of a vessel.<\/p>\n<p>And it\u2019s quite possible. For example, in 2013 security researchers <a href=\"http:\/\/www.technologyreview.com\/news\/520421\/ship-tracking-hack-makes-tankers-vanish-from-view\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">found out<\/a> how to hijack <a href=\"http:\/\/www.imo.org\/OurWork\/Safety\/Navigation\/Pages\/AIS.aspx\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Automatic Identification System<\/a>, or AIS, used by an estimated 400,000 ships worldwide.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Maritime industry is easy meat for cyber criminals \u2013 <a href=\"http:\/\/t.co\/arylkFBOTc\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/arylkFBOTc<\/a> <a href=\"http:\/\/t.co\/v6QKzcjJXM\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/v6QKzcjJXM<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/601876502058262528?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">May 22, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>IOActive notified Furuno about these vulnerabilities in October 2014. The developer promised to provide a patch \u201csometime in the year of 2015.\u201d It\u2019s still unknown whether the patches have been distributed to ship operators, as nothing has been heard from Furuno since that time.<\/p>\n<p>Until recently maritime industry did not care a lot about cyber security. And it was a mistake: as 90% of goods all over the world are transported by sea, <a href=\"https:\/\/www.kaspersky.com\/blog\/maritime-cyber-security\/8796\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">shipping will always attract hackers<\/a>. Nowadays attention is being increasingly focused on the cybersecurity questions. But unfortunately, it\u2019s almost impossible to quickly change or update equipment for the whole world merchant fleet, which <a href=\"http:\/\/www.emsa.europa.eu\/damage-stability-study\/77\/472.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">only in 2014 consisted of<\/a> more than 85,000 of vessels and is known to increase from year to year. But changes are underway, and that\u2019s good.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ships have their own black boxes but their security leaves much to be desired<\/p>\n","protected":false},"author":522,"featured_media":6607,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2026],"tags":[1255,1258,1259,1254,97,1257,1256,268],"class_list":{"0":"post-6605","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-black-boxes","9":"tag-cargo","10":"tag-maritime","11":"tag-seafarers","12":"tag-security-2","13":"tag-ships","14":"tag-vessels","15":"tag-vulnerabilities"},"hreflang":[{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/ship-black-boxes-vulnerability\/6605\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/ship-black-boxes-vulnerability\/6526\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/ship-black-boxes-vulnerability\/6521\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/ship-black-boxes-vulnerability\/7481\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/ship-black-boxes-vulnerability\/7247\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/ship-black-boxes-vulnerability\/10957\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/ship-black-boxes-vulnerability\/6738\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/ship-black-boxes-vulnerability\/10057\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/ship-black-boxes-vulnerability\/10957\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/ship-black-boxes-vulnerability\/10957\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.co.uk\/blog\/tag\/black-boxes\/","name":"black boxes"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/6605","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/users\/522"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=6605"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/6605\/revisions"}],"predecessor-version":[{"id":17815,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/6605\/revisions\/17815"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media\/6607"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=6605"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=6605"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=6605"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}