A.P.T. Cyberattacks on a marine context

Transcripción

1 A.P.T. Cyberattacks on a marine context Gutiérrez A. Corredera L.E.

2 Goal of the talk Identification of potential security flaws on a marine context using the most recent assetoriented hacking techniques. Potential scenarios pirates could pursue targeting a vessel: 1- Compromised communications. 2- Malfunctioning/Sabotage of PLC systems 3- GPS precise fleet position discovering

3 Key concept A.P.T. (Advanced Persistant Threat): Refers to a group with both the capability and the intent to persistently and effectively target a specific entity. Advanced: Intelligence-gathering techniques Persistent: Not opportunistic Threat: Capability and Intent

4 Are sea pirates an A.P.T.? Persistent: Hijacking from early 90s. Threat: 53 ships on 2010 But...could they become Advanced?

5 Are sea pirates an A.P.T.? Persistent: Hijacking from early 90s. Threat: 53 ships on 2010 But...could they become Advanced?

6 Are sea pirates an A.P.T.? Persistent: Hijacking from early 90s. Threat: 53 ships on 2010 But...could they become Advanced?

7 Cyberattacks makes them Advanced Intelligence-gathering: Information Systems Intrusion Communications interception: Fake base station techniques Satellite Imaging: Google Maps, Bing...

8 Classic Cyberattacks: IP oriented Every device connected to the Internet has an IP address Basic steps of a classical Hacker (Not Persistent) IP ranges scan for listening services Target Characterization Investigate vulnerabilities and exploits

9 New Cyberattacks: Asset oriented Asset oriented search engine. Basic steps of a Persistent Hacker (Addressed to a certain target) Search for a concrete target in Shodan: e.g. Router Model Find exploit in Shodan So much faster and straightforward technique!

10 DEMO: Quick hacking session Search for USAL assets: hostname:usal.es Find vulnerable ones. (But be nice to them :)

11 How all this apply to a marine context?

12 How all this apply to a marine context?

13 How all this apply to a marine context?

14 How all this apply to a marine context?

15 How all this apply to a marine context?

16 How all this apply to a marine context?

17 Potential security flaws

18 Potential security flaws Communications Interception Sabotage Intelligence gathering

19 Communications interception

20 Communications interception

21 Communications interception

22 Communications interception A5/x Cryptoanalysis Fake base station Cellphone baseband modification No real time. Needs saved transmission. Close to the target Close to the target No GPRS by now Experimental Look up tables CUDA/GPUs Micro BTS Freq.inhibitor for 3G openbsc, openbts Very costly Less than 10k Motorola C123,155 OsMoComBB Less than 13$!!!

23 Potential security flaws

24 Potential security flaws Communications Interception Sabotage Intelligence gathering

25 Sabotage

26 Sabotage

27 Sabotage SCADA

28 Sabotage PLCs SCADA

29 Sabotage PLCs SCADA Water Treatment

30 Sabotage Stuxnet (Infects PLCs from FieldPGs) Very sophisticated. Deeply targeted at PLCs. Spionage 4 Zero-days vulnerabilities. 2 stolen digital certificates. Extremely expensive ScadaTrojans (Infects PLCs from SCADAs) Inspired by Stuxnet but Low cost Needs a infection pathway to install a client side modified file. 3 Zero-days. Cheaper

31 Potential security flaws

32 Potential security flaws Communications Interception Sabotage Intelligence gathering

33 Intelligence gathering

34 Intelligence gathering Electronic Chart Display and Information System

35 Intelligence gathering

36 Intelligence gathering A Vessel is usually part of the Internet..

37 Intelligence gathering A Vessel is usually part of the Internet.. And can be hacked as regular servers!

38 Intelligence gathering A Vessel is usually part of the Internet.. And can be hacked as regular servers!

39 Intelligence gathering A Vessel is usually part of the Internet.. And can be hacked as regular servers!

40 Intelligence gathering Asset oriented hacking Depends on manufacturer s security Internet connection. Computer. Classic hacking tools. Extremely cheap

41 DEMO: Quick assets oriented search session Membrane Biological Reactor, Merchant Vessels, Worldwide Control system solution comprises: Siemens S7-300 PLC with MP HMI and S7-200 PLC based control systems and networking for the water treatment systems. Search for Maritime related assets: Zynetix MaritimeGSM, S7-300, advantech

42 Conclusions Pirates should be considered an APT. They could virtually use Cyberattacks to hijack vessels more easily. Complex Cyberattacks are more and more affordable. A ship may become practically speaking an Internet node with all its risks (should be managed). Let s be in the look out!

43 THANK

44 THANK