Monday, June 18, 2018

Hacking, tracking, stealing and sinking ships

Further illustrating the real-world implications, Pen Test Partners has managed to link version details for ships’ satcom terminals to live GPS position data, to establish a clickable map where vulnerable ships can be highlighted with their real-time position
(it’s not updated however, thus ensuring it remains out of date and useless to hackers).

From PenTestPartners by Ken Munro

Pen Tester find several ways to hijack, track, steal and even sink shipping vessels

At Infosecurity Europe this year, we demonstrated multiple methods to interrupt the shipping industry, several of which haven’t been demonstrated in public before, to our knowledge.

Some of these issues were simply through poor security hygiene on board, but others were linked to the protocols used and systems provided by maritime product vendors.

Tracking and hacking ships: satellite communications

Our earlier satcom work is here but we took this much further at the show:
Shodan already publishes a ship tracker.
We think this only uses AIS data, publicly available.
We’ve broken new ground by linking satcom terminal version details to live GPS position data.

This, we think, is the first ever VULNERABLE ship tracker.
Two public data sets have been linked, so we now have a clickable map where vulnerable ships are highlighted with their real time position


It’s here http://ptp-shiptracker.herokuapp.com/ – note that we deliberately haven’t refreshed the data in use, ensuring it is out of date so that it can’t be used by hackers.
We’ll refresh it in time.

Many satcom terminals on ships are available on the public internet.
Many have default credentials, admin/1234 being very common.
These passwords were found on a ship only two weeks ago:


So that’s an easy way to hijack the satellite communications and take admin rights on the terminal on board.

Hardware hacking the satellite terminal

We applied our expertise in IoT, automotive and SCADA hardware security to a Cobham (Thrane & Thrane) Fleet One satellite terminal.
We haven’t seen much evidence in public of anyone looking hard at maritime satcom terminal hardware security before.
They’re expensive, which may explain it!

Caveat: all of the vulnerabilities we cover here are resolved by setting a strong admin password, as per the manufacturers guidance.
Either that, or they aren’t particularly significant.
We found much more, but the more significant findings have to be disclosed privately to Cobham first!


First, we found that the admin interfaces were over telnet and HTTP.
Pulling the firmware, we found a lack of firmware signing – the validation check was simply a CRC

Then, we discovered that we could edit the entire web application running on the terminal.
That lends itself to attacks.

Further, there was no rollback protection for the firmware.
This means that a hacker with some access could elevate privilege by installing an older more vulnerable firmware version.
Finally, we found the admin interface passwords were embedded in the configs, hashed with unsalted MD5.

Hardly ‘defence in depth’!
Reminder: these are all fixed by setting a strong admin password.
We found lots more, but can’t disclose these yet.

Sending a ship the wrong way: hacking the ECDIS

We often find a lack of network segregation on the vessel.
Hack the satcom terminal and you’re on the vessel network.

ECDIS are the electronic chart systems that are needed to navigate.
They can slave directly to the autopilot – most modern vessels are in ‘track control’ mode most of the time, where they follow the ECDIS course.

Hack the ECDIS and you may be able to crash the ship, particularly in fog.
Younger crews get ‘screen fixated’ all too often, believing the electronic screens instead of looking out of the window.

We tested over 20 different ECDIS units and found all sorts of crazy security flaws.
Most ran old operating systems, including one popular in the military that still runs Windows NT!

One interesting example had a poorly protected configuration interface.
Using this, we could ‘jump’ the boat by spoofing the position of the GPS receiver on the ship.
This is not GPS spoofing, this is telling the ECDIS that the GPS receiver is in a different position on the ship.
It’s similar to introducing a GPS offset (which we can also do!)
Here’s it jumping from one side to the other of Dover Harbour:


Blocking the English Channel?

Worse, we could reconfigure the ECDIS to make the ship appear to be a kilometre square:


This doesn’t sound bad, until you appreciate that the ECDIS often feeds the AIS transceiver – that’s the system that ships use to avoid colliding with each other.

So, simply spoof the ECDIS using the vulnerable config interface, ‘grow’ the ship and ‘jump’ it in to the shipping lanes.

Other ships AIS will alert the ships captain to a collision scenario.
It would be a brave captain indeed to continue down a busy, narrow shipping lane whilst the collision alarms are sounding.
Block the English Channel and you may start to affect our supply chain.

Going the wrong way: hacking NMEA 0183 messages

A completely different technique is to exploit the serial networks on board that control the Operation Technology (OT).
The ethernet and serial networks are often ‘bridged’ at several points, including the GPS, the satcom terminal, the ECDIS and many other points

OT systems are used to control the steering gear, engines, ballast pumps and lots more.
They communicate using NMEA 0183 messages.
Here are several such messages including steering heading, GPS, AIS and Bridge alarm data.


There is no message authentication, encryption or validation of these messages.
They’re plain text.
All we need to do is man in the middle and modify the data.
This isn’t GPS spoofing, which is well known and easy to detect, this is injecting small errors to slowly and insidiously force a ship off course.

If the autopilot is engaged, one could change the rudder command by modifying a GPS autopilot command like this:
Change R to L (Right to Left rudder command!) and then change the 2 byte XOR checksum at the end.

Conclusion

Ship security is in its infancy – most of these types of issues were fixed years ago in mainstream IT systems.

The advent of always-on satellite connections has exposed shipping to hacking attacks.
Vessel owners and operators need to address these issues quickly, or more shipping security incidents will occur.
What we’ve only seen in the movies will quickly become reality.

Links :
Posted by at 1 comment:
Labels:

Sunday, June 17, 2018

Pilot chart of the North of Atlantic : June 1923 vs June 2018

June 1923, founded upon the researches made and the data collected by Lieut. M.F. Maury, US Navy

Posted by at No comments:
Labels:

Saturday, June 16, 2018

Eric Tabarly (1931-1998)

Posted by at No comments:
Labels:

Friday, June 15, 2018

Seafloor cables that carry the world’s internet traffic can also detect earthquakes

Seafloor cables, such as this link between the United States and Spain, can serve as seismic sensors. Run Studios
From ScienceMag by Eric Hand

Some 70% of Earth's surface is covered by water, and yet nearly all earthquake detectors are on land.
Aside from some expensive battery-powered sensors dropped to the sea floor and later retrieved, and a few arrays of near-shore detectors connected to land, seismologists have no way of monitoring the quakes that ripple through the sea floor and sometimes create tsunamis.

Now, a technique described online in Science this week promises to take advantage of more than 1 million kilometers of fiber optic cables that criss-cross the ocean floors and carry the world's internet and telecom traffic.
By looking for tiny changes in an optical signal running along the cable, scientists can detect and potentially locate earthquakes.

The technique requires little more than lasers at each end of the cable and access to a small portion of the cable's bandwidth.
Crucially, it requires no modification to the cable itself and does not interfere with its everyday use.
The method "could be a game-changer," says Anne Sheehan, a seismologist at the University of Colorado in Boulder who wasn't involved in the work.
"More observations from oceanic regions could fill in some pretty big gaps."

MOMotion of the Ocean floor : The network of submarine fiber-optic cables that deliver work emails and cat videos to computers around the world could double as undersea earthquake detectors.
Existing cables are shown in purple; planned cables are in blue.
G. Marra et Al/Science 2018
It began with an accidental discovery, says Giuseppe Marra, a metrologist at the National Physical Laboratory in Teddington, U.K., who works on the fiber optic links that connect atomic clocks in labs across Europe.
He was testing a connection on a 79-kilometer buried cable that runs from Teddington to Reading, U.K., and relies on a stable, resonating loop of laser light.
Vibrations near the cable—even the noise of traffic above—can bend it imperceptibly.
That can shorten or lengthen the light's travel distance by less than the width of a human hair, shifting the resonating light beams slightly out of phase.

Marra was accustomed to background noise on his fiber optics.
But when he reviewed data from October 2016, he saw more than the average amount of noise.
It turned out to be the local effects of 5.9- and 6.5-magnitude quakes that struck central Italy late that month.
"It was quite a revealing moment," Marra says.
That noise, he realized, pointed to a new way to detect earthquakes.

Submarine seismology
An underwater fiber-optic cable stretching from Malta to Sicily sensed a magnitude 3.4 quake in the Mediterranean Sea on September 2, 2017.
Researchers confirmed this detection with two nearby seismometers.
One seismometer near the Malta end of the cable, closer to the earthquake’s epicenter, detected the quake shortly before the cable, and a seismometer near the Sicily end identified it shortly after.
Marra wondered whether the technique could be extended to the ocean, where the environment might be quieter.
Using a 96-kilometer submarine cable connecting Malta and Sicily in Italy, he and his colleagues detected a magnitude-3.4 earthquake in the Mediterranean Sea.
They couldn't pinpoint it.
But by shooting lasers down a cable from both ends, he says, scientists could detect differences in the travel times of the out-of-phase signals, which would reveal just where the earthquake first caused a disruption along the cable.
With three or more cables outfitted this way, he says, the earthquake's exact location in the crust could be triangulated.

By filling in the "seismic desert" in the ocean crust and showing where seafloor earthquakes occur and how often, the method could illuminate new fault structures and regions where tectonic plates are colliding or rifting apart, says Charlotte Rowe, a seismologist at Los Alamos National Laboratory in New Mexico.
It could also help with tsunami warning systems, she says, provided the strength of the optical signal reveals an earthquake's size.

Besides mapping earthquakes, Rowe thinks the cable networks could sharpen pictures of Earth's interior.
Like x-rays in a computerized tomography (CT) scan, seismic waves from big earthquakes carry clues to the density of rock they pass through.
From crisscrossing waves received by multiple sensors, seismologists can construct 3D pictures of mantle convection, in which hot plumes well up and cold tectonic plates plunge toward Earth's core.
Data from seafloor cables could fill in blind spots in these seismic CT scans.
But Rowe says investigators will have to get better at interpreting the cable signals before using them to peer into deep Earth.

Marra says the new technique is sensitive enough to work across ocean basins thousands of kilometers wide.
It requires adding a small cabinet of lasers and optical equipment that costs about $50,000 at each end of the cable, and access to just one of the hundreds of channels in a typical cable.
Renting a dedicated channel might cost about $100,000 a year on a transpacific cable, and much less on one between North America and Europe, says Stephen Lentz, who works with the cable industry as director of network development for Ocean Specialists, Inc., based in Stuart, Florida.
"Frankly, this is the kind of thing where the cable owner could donate the service and take the tax write-off.
It costs them little or nothing to share unused wavelengths."

That's significant, says Bruce Howe, a physical oceanographer at the University of Hawaii in Honolulu, who leads a task force exploring how to stud new ocean cables with seismic, pressure, and temperature sensors, every 50 to 100 kilometers.
Although the add-on sensors, at roughly $200,000 apiece, are cheaper than operating stand-alone ocean bottom detectors, cable owners have been wary of affecting cable performance.
The new technique offers a cheaper and less disruptive way to listen to the ocean floor.
Howe calls the results "intriguing" and says his task force will advocate for a longer test.
"It should absolutely be pursued."

 Links :

Posted by at No comments:
Labels:

Thursday, June 14, 2018

Ramp-up in Antarctic ice loss speeds sea level rise

Changes in the Antarctic ice sheet’s contribution to global sea level, 1992 to 2017.
According to research from the Ice Sheet Mass Balance Inter-comparison Exercise (IMBIE), published today in Nature, the Antarctic ice sheet’s contribution to global sea level was 7.6 mm since 1992, with two fifths of this rise (3.0 mm) coming in the last five years alone. 

Credits: IMBIE/Planetary Visions

From NASA by Steve Cole and Alan Buis

Ice losses from Antarctica have tripled since 2012, increasing global sea levels by 0.12 inch (3 millimeters) in that timeframe alone, according to a major new international climate assessment funded by NASA and ESA (European Space Agency).

According to the study, ice losses from Antarctica are causing sea levels to rise faster today than at any time in the past 25 years.
Results of the Ice Sheet Mass Balance Inter-comparison Exercise (IMBIE) were published Wednesday in the journal Nature.

“This is the most robust study of the ice mass balance of Antarctica to date,” said assessment team co-lead Erik Ivins at NASA’s Jet Propulsion Laboratory (JPL).
“It covers a longer period than our 2012 IMBIE study, has a larger pool of participants, and incorporates refinements in our observing capability and an improved ability to assess uncertainties.”

The Antarctic Peninsula from the air: although the mountains are plastered in snow and ice, measurements tell us that this region is losing ice at an increasing rate.
Credits: University of Durham/Pippa Whitehouse

This latest IMBIE is the most complete assessment of Antarctic ice mass changes to date, combining 24 satellite surveys of Antarctica and involving 80 scientists from 42 international organizations.

The team looked at the mass balance of the Antarctic ice sheet from 1992 to 2017 and found ice losses from Antarctica raised global sea levels by 0.3 inches (7.6 millimeters), with a sharp uptick in ice loss in recent years.
They attribute the threefold increase in ice loss from the continent since 2012 to a combination of increased rates of ice melt in West Antarctica and the Antarctic Peninsula, and reduced growth of the East Antarctic ice sheet.

Prior to 2012, ice was lost at a steady rate of about 83.8 billion tons (76 billion metric tons) per year, contributing about 0.008 inches (0.2 millimeters) a year to sea level rise.
Since 2012, the amount of ice loss per year has tripled to 241.4 billion tons (219 billion metric tonnes) – equivalent to about 0.02 inches per year (0.6 millimeters) of sea level rise.

Crevasses near the grounding line of Pine Island Glacier, Antarctica.
Credits: University of Washington/I. Joughin

West Antarctica experienced the greatest recent change, with ice loss rising from 58.4 billion tons (53 billion metric tons) per year in the 1990s, to 175.3 billion tons (159 billion metric tons) a year since 2012.
Most of this loss came from the huge Pine Island and Thwaites Glaciers, which are retreating rapidly due to ocean-induced melting.

 Pine Island Glacier calving front with the GeoGarage platform (NGA chart)

At the northern tip of the continent, ice-shelf collapse at the Antarctic Peninsula has driven an increase of 27.6 billion tons (25 billion metric tons) in ice loss per year since the early 2000s. Meanwhile, the team found the East Antarctic ice sheet has remained relatively balanced during the past 25 years, gaining an average of 5.5 billion tons (5 billion metric tons) of ice per year.

Rapid collapse of Antarctic glaciers could flood coastal cities by the end of this century.
Based on an article written by Eric Holthaus

Antarctica’s potential contribution to global sea level rise from its land-held ice is almost 7.5 times greater than all other sources of land-held ice in the world combined.
The continent stores enough frozen water to raise global sea levels by 190 feet (58 meters), if it were to melt entirely.
Knowing how much ice it’s losing is key to understanding the impacts of climate change now and its pace in the future.

“The datasets from IMBIE are extremely valuable for the ice sheet modeling community,” said study co-author Sophie Nowicki of NASA’s Goddard Space Flight Center.
“They allow us to test whether our models can reproduce present-day change and give us more confidence in our projections of future ice loss.”

The satellite missions providing data for this study are NASA’s Ice, Cloud and land Elevation Satellite (ICESat); the joint NASA/German Aerospace Center Gravity Recovery and Climate Experiment (GRACE); ESA’s first and second European Remote Sensing satellites, Envisat and CryoSat-2; the European Union’s Sentinel-1 and Sentinel-2 missions; the Japan Aerospace Exploration Agency’s Advanced Land Observatory System; the Canadian Space Agency’s RADARSAT-1 and RADARSAT-2 satellites; the Italian Space Agency’s COSMO-SkyMed satellites; and the German Aerospace Center’s TerraSAR-X satellite.

Tom Wagner, cryosphere program manager at NASA Headquarters, hopes to welcome a new era of Antarctic science with the May 2018 launch of the Gravity Recovery and Climate Experiment Follow-on (GRACE-FO) mission and the upcoming launch of NASA’s Ice, Cloud and land Elevation Satellite-2 (ICESat-2).

“Data from these missions will help scientists connect the environmental drivers of change with the mechanisms of ice loss to improve our projections of sea level rise in the coming decades," Wagner said.

Links :
Posted by at 1 comment:
Labels:
Subscribe to: Posts (Atom)