Cybercrime on the high seas: the new threat facing billionaire superyacht owners

Yachts moored in Monaco harbour.

The superyacht industry is enjoying its best sales figures since the 2008 financial crash.

Photograph: David Levene for the Guardian
 

From The Guardian by Rupert Neate

Buyers at London superyacht conference shown the ease with which hackers can take control of vessels – and even procure private photos

Within a few hours of mooring up and opening his laptop, Campbell Murray had taken complete control of a nearby multimillion-dollar superyacht.
He could easily have sailed it – and its super rich owner – off into the sunset.
“We had control of the satellite communications,” said Murray, an IT specialist.
“We had control of the telephone system, the Wi-Fi, the navigation … And we could wipe the data to erase any evidence of what we had done.”

The ease with which ocean-going oligarchs or other billionaires can be hijacked on the high seas was revealed at a superyacht conference held in a private members club in central London this week.
Murray, a cybercrime expert at BlackBerry, was demonstrating how criminal gangs could exploit lax data security on superyachts to steal their owners’ financial information, private photos – and even force the yacht off course.

The seaborne cybercrime threat is real: one billionaire had more than £100,000 stolen when criminals hacked his bank account.
Others have been blackmailed with compromising photos, and some have already been forced to pay a ransom to unlock their vessel’s navigation systems.

The cybercrime session was one of the most popular at the Superyacht Investor London conference, where the industry was celebrating the best annual sales since the 2008 financial crisis.

Over lunch of smoked salmon and roast chicken, superyacht builders and financiers discussed the best ways to win over new customers in growing but underexploited markets such as China and the Middle East.
The key to both of these markets was said to be two galleys, so that one could be dedicated to their home cuisine and the other for preparing western meals.

The superyacht A, owned by the Russian tycoon Andrey Melnichenko,

moored beside HMS Belfast in London

 Photograph: Toby Melville/Reuters

Other James Bond-style accessories were showcased, such as exploration submarines and snow rooms designed to mimic winter conditions in case it gets too hot up on deck.
Some clients have also demanded dealing rooms with Bloomberg terminals, or operating theatres, so that ultra-rich owners could receive immediate treatment in case of injury or illness onboard.
Oliver Blanchet, head of yacht financing for the French bank BNP Paribas, said his bank had calculated that there were more than 100,000 people in the world who could afford a superyacht, but only 5-7% of them had bought one – so there was plenty to play for.

By comparison, the private jet industry, he said, has had much more success selling jets as a business tool: at least 20% of people who had the money had purchased one.
He told his colleagues that the industry needed to do more to promote yachts as a way for the rich to save time.
“Time is a new currency,” he said.
“A yacht is an amazing tool for saving time and a platform for new experiences.”

In a live demo, a detector deploys direction-of-arrival sensing to alert users on board a superyacht to GPS spoofing

Robb Maass, a US lawyer who arranges superyacht sales and dubbed “the godfather of yachting law”, said US sales were booming after the election of Donald Trump boosted the confidence of billionaires.
“Superyachts are all about confidence, not about money,” he said.
“The money has always been there, but following the election there has been a significant impact in people feeling more confident to be boastful and brash.”
Maass said Trump’s planned tax reforms would likely give the rich an income boost and had encouraged them to spend, particularly as Trump is expected to introduce a tax holiday to encourage multinationals to repatriate some of the billions held offshore.
“We have seen more and more young buyers coming from the tech sector and buying a very large yacht,” he said.

To see for himself just how vulnerable superyachts are to attack, Campbell and a colleague hacked one themselves.
He said that within 30 minutes they had taken control of the ship’s Wi-Fi and could read, delete and even edit emails.
“Imagine you’ve got a high-value guest on one of your ships and they want to send a press release, if I can capture it and change it I can cause a lot of reputational damage,” he said.

Yachts are vulnerable due to less-secured Wi-Fi networks, which Murray said could be hacked into from some distance.
“Owners like to have strong Wi-Fi so they can operate their businesses from the vessel,” said Murray.
“But this means that the network extends quite far from the actual ship to other vessels and the shore. If you moor up in Monaco, who are you moored up next to?”

As well as stealing financial data and potentially compromising photos, Murray said he also had control of the ship’s CCTV so he could have helped assist a physical attack or kidnap.
“We could let people onto the boat, and then wipe [the CCTV] so no one would know.”

Security experts said physical attacks on superyachts were very rare but data hacks leading to blackmail and ransom demands had become more common in the past 18 months.
“People on yachts are what cybercriminals call high-value targets,” said Malcolm Taylor, a former GCHQ officer who now heads up cybersecurity for the private security firm G3.
“They are wealthy, and money is what people want to steal or extort.”

Taylor said superyachts used to be seen as floating luxury hotels, “now they are more often used as floating offices and require a lot of technology. But the security has not kept up and is vulnerable to attack”.
“The biggest problems are extortion,” said Ben Lind, a superyacht insurance underwriter at AIG. “People will hold photos of owners and guest to ransom. Our client base is wealthy and high-profile: they are targets.”

Hacking might not even be necessary, Lind said, if the yacht crew post photos on social media. “Anyone on the internet can find the address of anyone streaming on Facebook Live, so if you do have crew members onboard who are streaming live on the ship’s Wi-Fi, that ship’s internet presence is immediately available to anyone watching that video if they know where to look.”

Once the location of the ship is known, long-lens photographers can be dispatched to try and take compromising photos of the rich and their often well-known guests.
To combat the threat, many superyacht owners have banned their crew from using Facebook or Instagram.

“Confidentiality clauses have been in crew contracts for a long time; [they have] got to remember who they are looking after,” William MacLachlan, a senior associate at law firm Holman Fenwick Willan, said.
“[The owners] will be high net worth individuals and they could be very much in the public domain and very sensitive, they don’t need the crew facilitating the release of photos whether accidentally or otherwise.
“We recognise that 99% of the time it’s not deliberate it’s not malicious – use of social media without thinking is just part of youth.”

Links:

• The Times : Hackers of the high seas hold superyacht owners to ransom
• Int Business Times : Are hackers the new pirates on high seas? Billionaire superyacht owners can be held to ransom
• GeoGarage blog : Opinion: Were US sailors 'spoofed' into Iranian waters? / Combatting maritime cyber security threats / Rising fraud in the high seas / Superyacht GPS spoofing experiment on the high seas