261
1 INTRODUCTION
Numberofcyber‐attacksagainstmaritimeindustryis
growing each year. Such attacks were directed for
shipping companies and as well against individual
vessels. Within three years, from 2017 to 2020,
shipping industry had experienced tenfold rise in
cyberattacksasshownongraphicbelow:
Figure1.Cyber‐attacksriseonmaritimeindustry[32].
Targetedwereshippingcompaniesandindividual
vessels. Maritime security experts reported for the
same period number of cyber‐attacks againstvessels
arose for 900% [18]. Most significant attacks were
aimedagainstmajorshippinglinesandInternational
Maritime Organization. In June 2017 Danish Maersk
was hit with NotPetya wiper malware. Most of
Maersk data was lost with 49,000 laptops and 4,000
servers. Total losses exceeded $300 million [14]. A
year later, in July 2018, another shipping giant
COSCOfellpreyofSamSamransomware.Company
worldwide network collapsed and remained shut
downforseveraldays.COSCOS’sglobalfleetwasnot
affected by attack.
Financial losses remain unknown
as company never disclosed them [14]. Hackers did
notspareeveninternationalorganizationworkingon
cyber security regulations for maritime sector. Two
months later, on September 30, 2020, some
International Maritime Organization (IMO) website
services were taken down for few days by cyber‐
Cyber Threats for Present and Future Commercial
Shipping
J
.Pawelski
GdyniaMaritimeUniversity,Gdynia,Poland
ABSTRACT: Cyber‐attacks are extremely dangerous for all operations relaying upon it‐technologies. Today
shippingbusinessescannotoperatedwithoutprocessinglargeamountsofinformation.Fourbiggestshipping
companiessufferedbreak‐downintheiroperationsaftertheywerestruckbymalware.InternationalMaritime
Organizationalsowasstruck
bycyber‐attackwhichtookitswebsitedown.Maritimecommunitynoticedrisein
cyber‐attacksonvirtuallyallcomputer‐basedsystemsonboardofvessels.Formannedvesselsriskstosafetyof
navigation are mitigated by presence of crew on board but remain financial and reputational losses.
Introduction of remotely
controlled and fully autonomous unmanned vessels will increase seriousness of
threats. Cyber‐attack may severely hamper ship’s operability or even lead to complete loss of control.
Internationalcommunityisdevelopingseveralcountermeasurestoprotectcommercialshippingpresentlyand
infuture.
http://www.transnav.eu
the International Journal
on Marine Navigation
and Safety of Sea Transportation
Volume 17
Number 2
June 2023
DOI:10.12716/1001.17.02.01
262
attack,howevere‐mailandcommunicationcontinued
towork[24].
Figure2.IMOwebsitetakendownduetocyber‐attack[24].
Increasing dependency of vessels on computer
technologiesmakesthemmorevulnerabletoattackby
existingandfuturemalware.Problembecomesmore
acute with introduction of autonomous vessels.
Cyber‐attacksposerealbarriersforsafeoperationsof
such vessels until effective solution has been found
[11]. Baltic and International Maritime Council
(BIMCO)
issued in 2019 Cyber Security Clause 2019
obliging all parties involved in security incident
inform each other with 12 hours and poses security
plans and procedures [15]. Maritime insurance
companies concerned with growing number cyber‐
attackson shippingindustrypublishedwarnings for
theircustomers [1]. Insurers noware limiting claims
byapplicationtwoclausespublishedbyInternational
Underwriters Association (IUA). Clause IUA 09‐081
CYBERLOSSABSOLUTEEXCLUSIONCLAUSEand
clause IUA 09‐0812 CYBER LOSS LIMITED
EXCLUSION CLAUSE are excluding any cyber loss
from insurance cover [29]. Cyber‐attack targeting
vessel’snavigationalsystems,steeringandpropulsion
mayhaveveryserious
consequencesincludingevent
denial of port entry by authorities due to her
unseaworthiness.Withoutpossibilitytoreturnship’s
vitalequipmenttoitsworkingcondition,vesselcould
beleftadrift,remainingatanchoratroadsortowedto
portasahulk.Itisnotanimaginaryscenario.In2017
hackers
took control over container vessel in
MediterraneanSea.Theygainedfullcontroltoship’s
navigationalsystems with purpose tosteer vessel to
convenient place for boarding her. Crew regained
controlofvesselaftertenhoursandbringingITteam
on board [13]. Analysis of shipboard networks and
equipment shows their growing
vulnerability to
cyber‐attacksduetoimplementationofmorecomplex
systems for communication and vessel control.
Introduction of remotely controlled and fully
autonomous vessels may have negative impact on
overallsafetyofnavigation.
2 VESSEL’SSHIPBOARDNETWORK
Until middle of last century ship’s communication
and control of equipment were domain
of analogue
technology. Digital revolution first revolutionized
land‐based information transmission methods and
waysofindustrialprocessescontrolwithintroduction
of network. Implementation of Global Maritime
Distress Safety System (GMDSS) began era of
maritime communication networks for digital
informationtransfer.Digitalizationalsofounditsway
into systems controlling vessel’s equipment.
Analogue
mechanicalandelectroniccontrollerswere
replacedwithfullydigitalizedinterconnectedsystems
forming shipboard network. Digitalized systems
onboard vessels are divided into two distinctive
kinds: Information Technology (IT) and Operational
Technology (OT). IT systems are designed for data
management and typically they handle GMDSS,
Automatic Ship Identification (AIS), Long Range
Identification
and Tracking (LRIT), corporate
communication (owners, management, charterers,
suppliers,localauthorities).SystemstermedasOTare
industrial control systems. They consist of
Programmable Logic Controllers (PLC), Distributed
ControlSystems(DCS)andSupervisoryControland
Data Acquisitionsystems (SCADA).Most significant
differences among IT and OT systems are given in
table1.
Table1.MaindifferencesbetweenITandOTsystems.
Modifiedfrom[10]
________________________________________________
Category InformationOperational
TechnologyTechnology
________________________________________________
Performance Non‐realtime. Realtime.Realtime
Responsemustbe responsecritical.
consistent.ResponseResponseto
toemergencyless emergencycritical.
critical.Accesscanbe Accessstrictly
restrictedtothe restricted.
requireddegree.
Availability Rebootingacceptable. Rebootingnot
Temporarylackof acceptable.
availabilityUninterrupted
acceptable.availabilitymay
requireredundant
system
Risk Managedata.Data Controlphysical
Management confidentialityand world.Humansafety
integrityisparamountisparamount,followed
Faulttoleranceislessbyprotectionofthe
important.Majorrisk process.Majorrisk
impactisdelayof impactsareregulatory
businessoperation non‐compliance,
environmental
impacts,lossof
life,
equipment,or
production
System Systemsaredesigned Proprietarysystemfor
Operations forusewithtypical industrialprocess.
operatingsystems. Mostlywithoutsafety
Upgradesare capabilitiesbuiltin.
straightforwardwithUpgradedby
theavailabilityof authorizedservice.
automated
deploymenttools.
Resource Systemswithenough Systemwithlimited
Constrains resourcestosupportcomputingand
theadditionofthird‐ memoryresourcesto
partyapplications supportonlyparticular
suchassecurity process.
solutions.
Communi‐ StandardManyproprietaryand
cations communications standard
protocolsPrimarily communication
wirednetworkswith protocolsSeveraltypes
somelocalized ofcommunications
wirelesscapabilities.mediausedincluding
TypicalITnetworkingdedicatedwireand
Practices.wireless(radioand
satellite).Networksare
complexand
263
sometimesrequirethe
expertiseofcontrol
engineers.
Component 3to5years10to15years
Lifetime
Components Componentslocally Componentscanbe
Locations andeasilyaccessible. isolated,remote,and
requireextensive
physicalefforttogain
accesstothem.
________________________________________________
Another major difference between IT ant OT is
CIATriad.ItismodelofsecuritypolicyofITsystems
in organization. CIA stand for Confidentiality,
Integrity, and Availability of information in
hierarchical order. OT systems represent different
model security policy. It is CAIC which means
Control, Availability, Integrity, and Confidentiality
[31].
For long time both systems were separated on
boardofvesselsandso‐called‘airgap’wasactingas
very efficient barrier protecting OT systems from
malicious attacks. Situation has changed when
development of internet‐based technologies evolved
intoInternetofThings(IoT)linkingconsumerdevices
withInternetandother
devices[27].Digitalizationof
industrial systems eventually led to the creation of
IndustrialInternetofThings(IIoT)formanagingand
controllingprocesses and data acquisition via global
network[34]. Newindustrial technologyopened the
wayforInternetbasedmaritimeservicesandcreated
Internet of Ships (IoS) for management and
monitoring of
smart vessels [20]. Figure 3 shows
shipboardnetworksforexistingandfuturevessels[9].
IoS technology is necessary for introduction of
remotely controlled and fully autonomous vessels.
FuturedevelopmentofIoSneedstoaddresssecurity
issues and uninterrupted availability of transferred
information,alternative systemsof data transferand
widening bandwidth
to accommodate much larger
volume of information being transferred at high
speed. Connecting OT systems to networks outside
ship makes them vulnerable to cyber‐attacks which
mayleadtoinjury,lossoflife,largescaledamageto
assetsandhaveseriousenvironmentalimpact.
Figure3.Presentandfutureshipboardnetworks[9]
More advanced autonomy of vessels will require
all shipboard equipment conjoined into the single
local network connected to shore‐based services by
satellite or radio link. Merging ship’s environment
with global network opens the gateway for cyber‐
attack unless effective preventive measures are
introduced.
3 VESSEL’SINFRASTRUCTURETARGETEDBY
CYBERATTACKS
Dependency of shipping industry on digital
technologies and networks is growing each year.
ShippinglinesareextensivelyusingITformanaging
their businesses and for communication with their
businesspartners.Someofthemsufferedheavylosses
whentheirITsystemswereattacked[14].Ithappened
despite of having their systems
protected and
supervised by IT specialists. Digitalization of ship’s
communication and control systems made them
prone to malicious cyber‐attacks. Due to increased
dependencyofship’sITandOTsystemsonnetworks
and Internet theoretically all shipboard systems are
vulnerable. Internal protocols used by internal
networksarenotencryptedareofficially
knownand
published industry standards. Attacker can easily
inject false information in data exchange stream to
fool equipment. Equipment requiring more
computing power often uses commercial operating
systems including these which are no longer
supported.Obsoleteandunpatchedsystemsareeasy
preyforhackers.
Figure4.Potentialtargetsofcyber‐attackagainstvessel[4].
It is difficult to analyse all hypothetical cyber‐
attacks against vessel’s systems but security and
resilienceagainstcyber‐attackisparamountforsafety
of navigation. With more developed ship’s network
more equipment is exposed to attacks. Shipboard
networkconsistsofseveralcomponentslike:
communication network including satellite and
radiolinks.
ComposedofGMDSSequipmentwith
mandatory emergency satellite and radio
communication means, Very Small Aperture
Terminals (VSAT) for official and crew
communication including Internet other
communication systems provided for
communicationandglobalnetworkaccess.
integrated navigation system as network of
navigational equipment linked together.
Introduction of e‐Navigation concept
resulted
necessity of data interchange between Global
NavigationalSatelliteSystem(GNSS)receiversand
Electronic Chart Display and Information Centre
(ECDIS), radars with Automatic Radar Plotting
Aid(ARPA),AutomaticShipsIdentification(AIS)
transponders, Voyage Data Recorders (VDR) and
adaptiveautopilots.
industrialcontrolsystems(ICS)asnetworksmade
upofOTequipment
managingship’spropulsion,
power generation and steering, such as SCADA,
DCS,PLCandHMI(Human‐MachineInterface).
loading and stability network including cargo
management and cargo handling, ballast
managementsystems.
264
shipboard safety systems for fire and smoke
detection,wateringressalarm,fire,andwatertight
doorsmanagement.
shipboard security system, as such internal
communication, Closed Circuit TV (CCTV) with
video recording, firewalls, network segmentation
devices, Ship Security Alert System (SSAS), Ship
SecurityReportingSystem(SSRT)
First generations of malware
targeting OT were
aimed at Windows‐based SCADA systems. Prime
example of it is Stuxnet worm created for attacking
IranianuraniumcentrifugesPLCcontrollersthrough
Windows applications controlling PLC’s and
controllersembeddedsoftware.TodayStuxnetisthe
history,andzero‐dayvulnerabilitiesarepatchedlong
ago but after attack on
Iranian Natanz facility it
quicklyspreadintonumerouslocationsintheworld
[17].LowlevelsystemslikePLCsforlongtimewere
consideredassafefromcyber‐attackswhenprotected
by “air gap” and lack of PLC specific malware.
Manufacturers did not bother to provide them even
with rudimentary security features.
Within last few
yearsresearchersworkedoutPLChackwhichgathers
sensitive data andsends it out by radio linkcreated
by PLC itself generating frequency modulated
transmission. Data is decoded by Software Defined
Radio (SDR) and personal computer (PC) with
antenna.Rangeoftransmissionislimitedduetolow
signallevelbutlowflyingdroneorplacednearbyPC
withSDRarecapabletopickupsignal[20].Another
unpleasant information for OT engineers is
development of undetectable PLC rootkits for
research purposes. Rootkits residing in dynamic
memory can manipulate PLC input‐output devices
(I/O)anddirectlyaffectcontrolof
industrialprocesses
[19]. Researchers also proved feasibility of cyber‐
attack on PLC networks due to meagre security
features provided by makers [21]. All shipboard
systems are important for universally understood
safetyofnavigation,butoverallcommandofvesselis
exercisedbynavigationsystems.
4 NAVIGATIONSYSTEMS
DevelopmentofGlobalNavigational
SatelliteSystems
(GNSS) paved way to rise of Integrated Navigation
Systems (INS) requiring continuous updating of
ship’s position. IMO determined equipment and its
functionsINS[7].
Table2.IntegratedNavigationSystem.Modifiedfrom[7].
________________________________________________
INSsubsystem Tasksandfunctions
________________________________________________
RadarCollisionavoidance
ECDISRouteplanning
Routemonitoring
HeadingcontrolNavigationcontroldata
Navigationstatusanddatadisplay
Trackcontrol Navigationcontroldataandtrackcontrol
AISCollisionavoidance
Navigationcontroldata
Echosounder Routemonitoring
GNSSNavigationcontroldata
Navigationstatusanddatadisplay
Log(speedandNavigationcontrol
data
distance)
Navigationstatusanddatadisplay
________________________________________________
Today GNSS is the backbone of all integrated
navigational systems providing continuous position
of vessel necessary for appropriate work of ECDIS,
radar,ARPA,AIS,andtrackcontrol.Mostofvessels
are using Global Positioning System (GPS) as main
source of position however alternative system
Globalnaya Sputnikovaya Systema (GLONASS) is
oftenused
in highlatitudesdueto its higher orbital
inclination. Differential version of GPS allows to
navigateconfinedwaterswithmuchhigheraccuracy
thantraditionalmethodsofnavigation.Cyber‐attack
on GPS disruptswork ofmost INS components and
seriouslyjeopardizesafetyofnavigation.Asasource
ofpositionGPSis
themostimportantpartofanyINS.
ECDISplaysnolesssignificantroleinsafenavigation
asmeansofplanningandmonitoringofvessel’ssafe
route. Loss of GPS position limits ECDIS route
monitoring abilities to terrestrial navigation with
position obtained from radar or terrestrial bearings.
Digital radars in use today
are based on data
processing software which can be targeted by
malicious attack leaving ECDIS without position
input from radar and denying vessel protection
againstcollision. AIS is design to supplement ship’s
navigationandcollisionavoidance,butitsunsecured
communication protocols made it vulnerable to
spoofing attacks with purpose to
provide false
information. All these technologies are playing
especially vital role in development of autonomous
vesselsofthefuture.
4.1 GPS
Satellitenavigationsystemisthemostcrucialpartof
today’sINS,anditsrolewillrisewithdevelopmentof
remotely controlled and fully autonomous vessels.
Manned vessels even with reduced
crew can still
navigateinconfinedwaterswhenGPSpositionisnot
available using more traditional ways of navigation.
Vessels relying solely upon remote control or
autonomous navigation must always have access to
reliablesatellitederivedpositionsafelynavigate.Most
of word’s fleet use GPS as Positioning, Navigation
and Timing
system (PNT). Despite of well‐known
virtues, GPS has two significant vulnerabilities: low
levelofreceivedsignalandunprotectedtransmission
protocol for civilian users. Very weak PGS signal
makes it prone to interferences with system proper
functioning. Problems with GPS may lead to
improper work shipboard systems and Aids to
Navigation
(AtoN). Loss of GPS signal or its
distortionaffectssuchsystemsonboardas:
GPSandDGPSpositioning
ECDIS
Radar/ARPA
AIS
Digitalgyrocompass
Trackcontrol
DigitalSelectiveCall(DSC)
LRIT
SSASandSSRT
DynamicPositioning(DP)
ProblemswithGPSsignal
havealsoanimpacton
AtoN:
AtoNpositioningmonitoring
DGPScorrections
AtoNcorrectdeployment
265
AIS
Lightssynchronization
AtoNisvitalforsafenavigationinconfinedwaters
when navigator needs to verify GPS position with
navigational aids to confirm correctness ship’s
position. Weaknessof GPS signal makes this system
easy target for several methods of maliciousattacks.
SimplestwaytoattackGPSis
jammingofsignal.Itis
sufficienttobroadcaststrongsignalonGPSfrequency
tooverpowerweaksignalandreceiverloseslock on
signal from satellite. Equipment for jamming, so
called jammer, is widely used for personal and
militarysecurity. Insomecountriesit canbe bought
legally.Figure5 shows
resultoftestjammingexercise
where small power transmitter could interfere with
GPSsignalatdistance30km[3].
Figure5. Experiment with 1.58 W jammer at 25 m height.
Distancesinkm[3].
Intentional jamming can be carried out non‐state
actors, individuals, or small groups with portable
jammers or state‐sponsored i.e., North Korea [v]. In
some situations, GPS signal can be jammed
unintentionallybyaircraftsaltimeters,TVharmonics,
certain radars, satellite communication equipment
and malfunctioning electronic devices [8]. Providing
receivers with smart
array antennae with nulling
properties makes equipment more resilient to
jamming by surface‐based transmitters. It also
possible to counter jamming by powerful terrestrial
PNTsystemslikeLoran‐e.
Another way of attacking is spoofing by
broadcasting false GPS signals. Attack begins with
transmission of signals with slightly higher power
and synchronised with GPS signal. When receivers
lock onto bogus signal it gradually phases out
genuine GPS signal and gives false position [3].
Simple spoofing equipment can generate only static
position, but more complex systems are capable of
dynamicone.Thiskindof attackismore difficultto
detect unless navigator
can obtain position by
independent way and analyses reason of positions
discrepancy. Most prominent spoofing attack
happened between 22 and 24 of June 2017 at Black
Sea. 20 vessels reported their positions on land in
GelendzhikAirport[25].NullingarrayGPSantennae
and powerful land based PNT system may protect
user to certain degree by suppressing unwanted
signalandusingalternativenavigationsystem.More
radical solution foresees implementation of
Navigation Message Authentication (NMA) in GPS
signal. This method will require replacement of
existing GPS receivers with new generation of
equipment [8]. This solution may not work for
meaconingattackagainstGPS.
Itisatypeofspoofing
whenGPSsignalsarere‐transmittedaftersometime.
Intentional delay in satellite signal leads to position
error.Re‐transmissiondoesnotrequiremimickingof
genuine GPSD signal including NMA and signal
encryption does not work. Mitigation methods like
nulling antennaeand land based
PNT may alleviate
consequenceofsuchattack.
4.2 ECDIS
Paperchartsonlargeocean‐goingvesselshavegiven
way to ECDIS which became nexus of electronic
navigation. Such system makes marine navigation
safer and more efficient but is very vulnerable to
cyber‐attacks like any personal computer. ECDIS
worksoncommercially
availablecomputeroperating
systems prone to attacks even when regularly
updated and protected by anti‐malware software.
Securityconsultants Pen Test Partners during cyber‐
security inspections found most of ECDIS using old
outdated operating systems with one of them even
workingonWindows NT[33].Operatingsystemcan
be attacked
through network used for updating
electronic chartsor USB memory sticks used forthe
same purpose. Results of such attack a same as on
personal computer i.e., operating system crash, data
encryption and deletion, planting malicious scripts,
spreadingmalwarethroughconnectednetwork.Asa
result,ECDISbecomesunusableandotherequipment
gets infected. For such scenario vessel must be
provided with another ECDIS as a backup or set of
paper charts for intended voyage. Different form of
attackisjammingofspoofingGPSprovidingposition
forECDIS.Jammingiseasilydetectablewhensystem
loses position input and goes into dead reckoning.
SpoofingofGPSismuchworsescenario.ECDISplots
on electronic chart false position from GPS receiver
whichismoredifficultforoperatortospotandreact.
In both situation navigator may continue navigation
on ECDIS with help of radar overlay and terrestrial
bearing. Unmanned vessels are in much worse
situation
as they rely solely on GNSS. International
Organization of Lighthouse Authorities (IALA)
proposed land based resilient PNT system named
Enhanced Radar Positioning System (ERPS). It
consists of modified racons (eRacons) and modified
radars(eRadars)andisindependentofGPS.eRacons
providetheirabsolutepositionsinencodedresponse
signals. eRadars use
these positions for calculation
own vessel’s position [26]. Proposed system may
provide backup navigation for unmanned vessels in
confined waters but is not yet operational. ECDIS
specific cyber‐attack was reported by employees of
security firm Naval Dome. During penetration test
they acquired access to ship’s navigation, radar,
engines,pumps,and
machineryby sendingemail to
the captain. [12]. Position of vessel was shifted on
ECDIS screen and remaining parameters were
modifiedinwaythattheylookednormallyforofficer
onbridge.
266
4.3 AIS
International Convention for Safety of Life at Sea
(SOLAS) introduced requirement for vessels to be
fittedwithAIStransponders[6].AISonboarddevice
provides shore stations, nearby vessels and aircrafts
with vessel and safety related information, receives
suchinformationfromothertransponders,tracksand
monitors movement of vessels
and displays
transmitted AtoN information. System uses for
communication two narrow radio frequency (RF)
channelswithinmarineVHFband.Receivedonboard
information is processed by software (SW) and
displayed in graphic and text form on ECDIS, radar
and ARPA for navigation, collision avoidance and
rescuepurposes.OnshoreAISinformation
isusedfor
vessel traffic monitoring and management by Vessel
Traffic Management System (VTMS) and online AIS
providers. In present state AIS has numerous
vulnerabilities which should be addressed before
introduction of autonomous vessels. Table 3
summarizesidentifiedthreatstoAIS.
Table3.AISidentifiedthreats.Modifiedfrom[30].
________________________________________________
Category ThreatSW RF
________________________________________________
Spoofing ShipsYes Yes
AtoNYes Yes
SARYes Yes
CollisionYes
AISSARTYes
WeatherForecastYes
Hijacking HijackingYes Yes
AvailabilityCommunicationslotstarvationYes
Disruption FrequencyhopingYes
TimingattackYes
________________________________________________
Lack of encryption in AIS transmission allows
hackers to interfere with all its functions including
programming fake movement of non‐existent vessel
withsimpleequipment.[16].
Figure5.Trajectoryofnon‐existentvesselshowing‘pwned’
[16].
Word‘pwned’usedinAISpenetrationteststands
for‘Youhavebeenhacked.’AIStodayisessentialfor
INS providing information related to collision
avoidance and situational awareness. Improper
operation or false information can be disastrous for
presentandfutureshipping.
Integrationofnavigationalequipmentsignificantly
changed design of marine radars.
Analogue signal
from transceiver is converted into digital form for
processing by purpose made software. Capability of
moderndigitalradarsarefargreateroftheiranalogue
predecessors, but digital processing makes them
vulnerable to attack. During penetration test
conducted by Naval Dom engineering team hacked
into marine radar and was
able to manipulate
equipment’ssoftwaretodeletetargetsfromthescreen
[12].Figure6showsattackedradarwithmostofthe
echoes deleted from the screen. Remaining targets
werelefttoconvinceoperatorincorrectoperationof
the radar. During the night or poor visibility such
situation may become extremely dangerous.
Vessel
wasleftwithoutmostimportantcollisionprevention
aid.
Figure6.Attackeddigitalradarwithmostoftargetsdeleted
[12].
5 COMMUNICATION
Satellite communication is a dominant type of
maritime mobilecommunicationbothfor emergency
and business use. Vessels operating under GMDSS
rules in area A3 are fitted with Inmarsat
communication equipment [6] using geostationary
satellites.Primarypurpose of itiscommunicationin
emergency, which is charge free. Inmarsat provides
also
payable business communication.
Communicationbasedongeostationarysatelliteshas
limitedrangeinpolarwatersduetolowelevationof
satellites above horizon. Many shipping companies
additionally are using satellite communication
providerswiththeirmediumandloworbitssatellite
networks allowing forvoice data transferallaround
theworld.Dependingon
serviceproviderdiffertypes
ofequipmentandcommunicationplatformareused.
In 2015 researcher reported that with inexpensive
equipmentwas ableto gain access toinformationin
Globalstaruplinkandcouldinjecthisowndata.Lack
ofdataencryptioninmodemtransmitterchipwasthe
vulnerability exploited in this experiment. [22].
Besides of hardware weak or missing protection
against malicious attack software used as
communication platforms is vulnerable and can be
used as gateway to ship’s networks. In 2016
cybersecurity firm IOActive found two serious
vulnerabilities in communication platform
AmosConnect 8.0 provided by Stratos company,
subsidiaryofInmarsat,forintegrationof
largegroup
of messaging tools for narrow band satellite
communication [23]. Inmarsat first responded with
revertingtoolderversionofAmosConnectandfinally
withdrew software from use. and launched Fleet
Secure Unified Threat Management (UTM) in 2022
[28].Compromisedcommunicationcandenyvessel’s
staff access to information needed for efficient and
savevoyagebutalsocanleavecrewwithoutabilityto
control own ship when navigation, steering and
propulsion systems are penetrated by attackers. To
267
alleviate problems with communication on short
distances,when is themost needed, IALA proposed
introduction of VHF Data Exchange System (VDES)
[5]. Using radio frequency channels within maritime
VHFbandvesselislinkedwithterrestrialorsatellite
communication network providing alternative to
maritime satellite communication. System is not
intended to
work on high seas but within range of
VHF transmission it can be invaluable providing
resilientmeansofcommunication.
6 CONCLUSIONS
Number cyber‐attacks against shipping industry is
risingrapidly withinlastfew yearsthreateningboth
shipping lines and individual vessels. Attacks
directed against biggest shipping companies
succeeded and incurred
large financial loses. It
happened despite professionally managed IT
networks in large companies. Attacks aimed against
ships targeted both IT and OT technologies.
Compromisedcommunicationmayseriouslyhamper
ship’s operations and provides gateway to OT
equipment.Ongoingconvergencevessel’sITandOT
technologies makes maritime transport more
vulnerable. Some research penet ration
test exposed
susceptibility of technologies currently in use to
simple methods of attack. Numerous vulnerabilities
were found in both in software managing ship’s
systems and in unprotected hardware. Technologies
used today onboard are not sufficiently resilient
against cyber‐attacks. It may lead to delay of
introduction of autonomous vessels until
revealed
vulnerabilitiesareproperlyaddressed.
REFERENCES:
[1]AGCS. Safety and Shipping Review 2022.p.9. Munich
2022
[2]BalduzziM.,PastaA.,WilhoitK.,ASecurityEvaluation
of AIS Automated Identification System,
https://www.madlab.it/papers/ais_acsac14.pdf
[3]]DirenzoIIIJ.,DrumhillerN.K.,RobertsF.S.,Issuesin
Maritime Cyber Security, p.20,23. Westphalia Press,
WashingtonD.C.2017
[4]Finnish National Emergency Supply
Organization, The
Maritime Transport Pool, Maritime Cybersecurity‐Best
PracticesforVessels,p.5,Helsinki2021
[5]IALA Guideline G1117 VHF Data Exchange System
(VDES) Overview Edition 3.0, electronic edition, Saint
GermainenLaye,2022.
[6]IMO, International Convention of Safety of Life at Sea
(1974),ElectronicEdition2020,London
[7]IMO,
Resolution MSC.252(83) Adoption of the Revised
Performance Standards for Integrated Navigation
Systems(INS),London,2007
[8]INTERTANKO, Jamming and spoofing of Global
NavigationalSatelliteSystem(GPS),p.5,14,London2019
[9]Lind M., Michaelides M., Ward R., Watson R. T.,
MaritimeInformatics,p.43,Springer,Cham2021
[10 National Institute of Standards and
Technology, US
Department of Commerce, Guide to Industrial Control
Systems(ICS)Security,p.2‐16,2‐17,Gaithersburg,2015
[11]Pawelski J., (2022) Barriers impending introduction of
autonomousvessels.ScientificJournalsoftheMaritime
University of Szczecin, Zeszyty Naukowe Akademii
MorskiejwSzczecinie72(144),p.39,Szczecin2022
[12]https://blog.geogarage.com/2017/12/nightmare‐
scenario‐
ship‐critical.html,accessed10.02.2023
[13]https://rntfnd.org/2017/11/25/hackers‐took‐full‐control‐
of‐container‐ships‐navigation‐systems‐for‐10‐hours‐ihs‐
fairplay/,accessed02.02.2023
[14]https://vesselautomation.com/maritime‐cyber‐
attacks/,accessed10.02.2023
[15]https://www.bimco.org/contracts‐and‐clauses/bimco‐
clauses/current/cyber‐security‐clause‐2019,accessed
20.01.2023
[16]https://www.blackhat.com/docs/asia‐
14/materials/Balduzzi/Asia‐14‐Balduzzi‐AIS‐Exposed‐
Understanding‐Vulnerabilities‐And‐
Attacks.pdf,accessed21.01.2023
[17]https://www.csoonline.com/article/3218104/stuxnet‐
explained‐the‐first‐known
‐cyberweapon.html,accessed
02.02.2023
[18]https://www.cybersecurity‐review.com/news‐july‐
2020/maritime‐cyber‐attacks‐increase‐by‐900‐in‐three‐
years/,accessed04.02.2023
[19]https://www.darkreading.com/attacks‐breaches/plcs‐
possessed‐researchers‐create‐undetectable‐
rootkit,accessed17.02.2023
[20]https://www.darkreading.com/threat‐
intelligence/stealthy‐new‐plc‐hack‐jumps‐the‐air‐
gap,accessed11.02.2023
[21]https://www.darkreading.com/vulnerabilities‐
threats/hijacking‐a‐plc‐using‐its‐own‐network‐
features,accessed09.02.2023
[22]https://www.defenseone.com/technology/2015/08/hacke
r‐
cracks‐satellite‐communications‐
network/118915/,accessed17.02.2023
[23]https://gcaptain.com/inmarsat‐shipboard‐
communication‐platform‐found‐vulnerable‐to‐
hacking/,accessed08.02.2023
[24]https://gcaptain.com/international‐maritime‐
organization‐hit‐by‐cyber‐attack/,accessed17.02.2023
[25]https://www.gpsworld.com/spoofing‐in‐the‐black‐sea‐
what‐really‐happened/,accessed12.02.2023
[26]https://www.iala‐aism.org/e‐bulletin/enhanced‐radar‐
positioning‐system/,accessed15.02.2023
[27]https://www.ibm.com/blogs/internet‐of‐things/what‐is‐
the‐iot/,accessed15.02.2023
[28]
https://www.inmarsat.com/en/news/latest‐
news/maritime/2022/fleet‐secure‐cybercrime‐unified‐
threat‐management.html,accessed14.02.2023
[29]https://www.iua.co.uk/IUA_Member/Clauses/eLibrary/
Clauses_Search.aspx?CAT=PAC,accessed08.02.2023
[30]https://www.madlab.it/papers/ais_acsac14.pdf,accessed
10.02.2023
[31]https://www.missionsecure.com/resources/comprehensi
ve‐guide‐to‐maritime‐security‐ebook,accessed15.022023
[32]https://www.otorio.com/blog/maritime‐port‐cyber‐
security‐the‐achilles‐heel‐of‐the‐global‐
economy/,accessed17.02.2023
[33]https://www.pentestpartners.com/security‐
blog/hacking‐tracking‐stealing‐and‐sinking‐
ships/,accessed14.02.2023
[34]https://www.techopedia.com/iiot‐vs‐iot
‐the‐bigger‐
risks‐of‐the‐industrial‐internet‐of‐
things/2/34394#:~:text=The%20defining%20difference%2
0between%20Internet%20of%20Things%20%28IoT%29,a
s%20manufacturing%2C%20supply%20chain%20monito
ring%20and%20management%20systems., accessed
07.02.2023
