Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
Security Bug Communications Software Transportation Hardware Technology

Critical Flaws In Maritime Communications System Could Endanger Entire Ships (helpnetsecurity.com) 41

Orome1 shares a report from Help Net Security: IOActive security consultant Mario Ballano has discovered two critical cybersecurity vulnerabilities affecting Stratos Global's AmosConnect communication shipboard platform. The platform works in conjunction with the ships' satellite equipment, and integrates vessel and shore-based office applications, as well as provides services like Internet access for the crew, email, IM, position reporting, etc. The first vulnerability is a blind SQL injection in a login form. Attackers that successfully exploit it can retrieve credentials to log into the service and access sensitive information stored in it. The second one is a built-in backdoor account with full system privileges. "Among other things, this vulnerability allows attackers to execute commands with SYSTEM privileges on the remote system by abusing AmosConnect Task Manager," Bellano shared. The found flaws can be exploited only by an attacker that has access to the ship's IT systems network, he noted, but on some ships the various networks might not be segmented, or AmosConnect might be exposed to one or more of them. The vulnerabilities were found in AmosConnect 8.4.0, and Stratos Global was notified a year ago. But Inmarsat won't fix them, and has discontinued the 8.0 version of the platform in June 2017.
This discussion has been archived. No new comments can be posted.

Critical Flaws In Maritime Communications System Could Endanger Entire Ships

Comments Filter:
  • by mentil ( 1748130 ) on Thursday October 26, 2017 @09:17PM (#55441735)

    Don't worry, there's no way the designer of the system would give details of the backdoor to a sexy enemy spy posing as an industrial espionage spy. Noone could make strategic use of that vulnerability unless they did something audacious like nuke all the colonies at once. /s

    • by cstacy ( 534252 )

      Don't worry, there's no way the designer of the system would give details of the backdoor to a sexy enemy spy posing as an industrial espionage spy. Noone could make strategic use of that vulnerability unless they did something audacious like nuke all the colonies at once. /s

      Well, I'm pretty sure this has all happened before.

  • by willoughby ( 1367773 ) on Thursday October 26, 2017 @09:43PM (#55441813)

    As opposed to endangering only half a ship, I guess...

  • by Goetterdaemmerung ( 140496 ) on Thursday October 26, 2017 @10:39PM (#55442003)

    Article says "Could endanger *entire* ships" If this flaw can't sink or disable the engines it isn't endangering them, much less the *entire* ship.

  • SQL Injection Attacks? What year is this, 2005?

  • Oh, how horrible!

    A vulnerability that allows someone "SYSTEM privileges" is ever so much worse than one which allows "system privileges"!

    Slow security scare day?

  • You guys are refusing to ack it, but you are at WAR. The cyber WAR is already started with Russia. Make no mistake about it.

    Election trolling is one thing, fishing for NSA secrets is another. Troll propaganda yet another. There have been reports of GPS interference near the Russian coast. Several US warships have already been involved in major accidents. Those might be explainable by sheer incompetance of the US Navy apparently current, but dont close your eyes for external influences.

  • by Anonymous Coward

    Imagine the havoc he could wreak with the ships ballast systems!

panic: kernel trap (ignored)

Working...