A voyage data recorder recovery capsule aboard a container ship.
Some VDRs may be an easy target for hackers--or crew members who don't want what they've done to be recorded.
photo : Hervé Cozanet
photo : Hervé Cozanet
When the freighter El Faro was lost in a hurricane on October 1, one of the goals of the salvage operation was to recover its voyage data recorder (VDR)—the maritime equivalent of the "black box" carried aboard airliners.
The VDR, required aboard all large commercial ships (and any passenger ships over 150 gross tons), collects a wealth of data about the ship's systems as well as audio from the bridge of the ship, radio communications, radar, and navigation data.
Writing its data to storage within a protective capsule with an acoustic beacon, the VDR is an essential part of investigating any incident at sea, acting as an automated version of a ship's logbook.
Sometimes, that data can be awfully inconvenient.
While the data in the VDR is the property of the ship owner, it can be taken by an investigator in the event of an accident or other incident—and that may not always be in the ship owner's (or crew's) interest.
The VDRs aboard the cruise ship Costa Concordia were used as evidence in the manslaughter trial of the ship's captain and other crewmembers.
Likewise, that data could be valuable to others—especially if it can be tapped into live.
It turns out that some VDRs may not be very good witnesses.
As a report recently published by the security firm IOActive points out, VDRs can be hacked, and their data can be stolen or destroyed.
The US Coast Guard is developing policies to help defend against "transportation security incidents" caused by cyber-attacks against shipping, including issuing guidance to vessel operators on how to secure their systems and reviewing the design of required marine systems—including VDRs.
That's promising to be a tall order, especially taking the breadth of systems installed on the over 80,000 cargo and passenger vessels in the world.
And given the types of criminal activity recently highlighted by the New York Times' "Outlaw Ocean" reports, there's plenty of reason for some ship operators to not want VDRs to be secure—including covering up environmental issues, incidents at sea with other vessels, and sometimes even murder.
IOActive researchers looked specifically at the Furuno VR-3000, a VDR that was involved in a case in 2012 where data for a period during which Italian marines aboard a freighter fired upon an Indian fishing vessel "mysteriously" corrupted before investigators could access it.
The marines, who were embarked aboard the freighter Enrica Lexie, claimed that they were in international waters and believed the fishermen to be pirates.
The data that could have proven their location, along with communications data, was lost.
The VR-3000's Data Recording Unit is essentially a Linux-based personal computer with little in the way of security hardening.
Other manufacturers use various industrial, real-time operating systems.
But at least it's more secure than some of the other VDRs sold by Furuno.
In another incident with a different, Windows XP-based VDR in 2012, data was corrupted when a crewmember on a Singapore-flagged ship inserted a USB drive into a port on the VDR—causing it to be infected with malware and for voice and navigation data to be overwritten.
(No, that wasn't a typo: it was a Windows XP-based black box.)
Windows XP is embedded in a variety of hardware at sea.
Furuno's XP-based VX2 system is used in GPS systems, auto-pilots, satellite weather terminals, and Automatic Identification System (AIS) transponders used to provide vessel tracking data.
And many of these systems use standard Ethernet local area networks to connect to navigational systems—as well as to PCs that provide access to the stored data.
The network of devices connected to a voyage data recorder system.
IOActive did a deep analysis on the VR-3000 and found a number of vulnerabilities, including:
Weak encryption of voice data files using an embedded, shared password.
Vulnerabilities in software services that allowed remote attackers to execute code on the data recording unit with root privileges, including the ability to "delete certain conversations from the bridge, delete radar images, or alter speed or position readings."
The VDR could also be turned into a remote bug to spy on the crew of a ship through its attached microphones.
To execute remote attacks on the VDR, the attacker only needed access to the network.
Since many VDR systems use Ethernet and sit on the same network as satellite communications systems (some of which are known to be vulnerable to attacks), there are a number of potential ways attackers could breach the security of the VDR while not being aboard.
Terrorists, pirates, hostile state actors and others could pinpoint the location of ships of interest and then listen to the conversations of crewmembers as well as their radio calls.
IOActive revealed these vulnerabilities to the Department of Homeland Security's Industrial Control Systems Computer Emergency Response Team (ICS-CERT) and Japan's CERT Coordination Center (JPCERT/CC) over a year ago.
Furuno was notified as well, but it promised only to patch the problem "sometime in 2015," according to the IOActive report.
There's no word on whether the patches have been distributed to ship operators.