Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Worms Hardware Technology

Ships Infected With Ransomware, USB Malware, Worms (zdnet.com) 132

Posted by BeauHD from the happens-more-often-than-you-think dept.
An anonymous reader writes: IT systems on boats aren't as air-gapped as people think and are falling victims to all sorts of cyber-security incidents, such as ransomware, worms, viruses, and other malware -- usually carried on board via USB sticks. These cyber-security incidents have been kept secret until now, and have only been recently revealed as past examples of what could go wrong, in a new "cyber-security guideline" released by 21 international shipping associations and industry groups. One of the many incidents: "A new-build dry bulk ship was delayed from sailing for several days because its ECDIS was infected by a virus. The ship was designed for paperless navigation and was not carrying paper charts. The failure of the ECDIS appeared to be a technical disruption and was not recognized as a cyber issue by the ship's master and officers. A producer technician was required to visit the ship and, after spending a significant time in troubleshooting, discovered that both ECDIS networks were infected with a virus. The virus was quarantined and the ECDIS computers were restored. The source and means of infection in this case are unknown. The delay in sailing and costs in repairs totaled in the hundreds of thousands of dollars (U.S.)." The document also highlights an incident involving ransomware. "For example, a shipowner reported not one, but two ransomware infections, both occurring due to partners, and not necessarily because of the ship's crew," reports ZDNet. Another ransomware incident occurred because the ship failed to set up proper (RDP) passwords: A ransomware infection on the main application server of the ship caused complete disruption of the IT infrastructure. The ransomware encrypted every critical file on the server and as a result, sensitive data were lost, and applications needed for ship's administrative operations were unusable. The incident was reoccurring even after complete restoration of the application server. The root cause of the infection was poor password policy that allowed attackers to brute force remote management services successfully. The company's IT department deactivated the undocumented user and enforced a strong password policy on the ship's systems to remediate the incident.
This discussion has been archived. No new comments can be posted.

Ships Infected With Ransomware, USB Malware, Worms More

Ships Infected With Ransomware, USB Malware, Worms

Comments Filter:

  • Windows, right? (Score:5, Insightful)

    by JustAnotherOldGuy ( 4145623 ) on Wednesday December 12, 2018 @11:38PM (#57796034) Journal

    Don't run ships on Windows, for obvious reasons.

    Also, not carrying ANY paper charts as a backup? Dumb, dumb, DUMB.

    • Running windows? Wrong, they don't, they have at least that much of a clue.
      No paper charts, that's a different story. WTF do they do after a lightning strike?

      oh, by the way, I own a boat, and have paper charts.

      • "Running windows? Wrong, they don't, they have at least that much of a clue.
        No paper charts, that's a different story."

        Given that knowing where are you in the middle of the sea has been a most important matter for seamen for thousands of years ans still they do such a dumb thing as not having paper charts, what makes you think there remains anything of a clue with them?

        Then, what other systems but Windows do you think use Remote Desktop for an access protocol?

      • Re: Windows, right? (Score:1)

        by Anonymous Coward

        I used to work for a company making radar and ECDIS, they do run on Windows and in some cases really quite old versions of Windows. We made equipment for big ships, not boats.

        • Re: Windows, right? (Score:2, Interesting)

          by Anonymous Coward

          I can confirm this. I've personally been on 3 large ships in the last couple years and I remember being shocked at the Windows XP screens.

      • If you had the technical accumen you claim you would know that RDP is Microsoft Windows Remote Desktop Protocol. Most major corporations are still so technically inept that they still run Windows. What made you think these ships administrators would be smarter?

        • Re: (Score:3)

          by sosume ( 680416 )

          > Most major corporations are still so technically inept that they still run Windows

          Yes, so sad, as this is the year of Linux on the Desktop, ofcourse! A Linux desktop won't present any issues at all - large ships can be easily patched mid-sea with a new kernel should a security issue occur! And as everyone knows only Windows is hackable, Linux is completely hackerproof. the X desktop is very well suited for day to day work, users just love its window composition, choice of available software and design.

          • You are a fucking incompetent idiot.

          • None of these issues apply in the real world to how these systems would be used if they were sensibly designed. It doesn't matter how much software is available to systems which should never run any software they didn't ship with. You don't patch, you replace the whole image while you're in port — preferably from physical media, not OTA. There's few enough ships to where this remains reasonable. If you want to do some accounting or play games you use a wholly different system, preferably one air-gappe

      • I was curious after your statement what operating system is actual on ships. And according to this site, IT IS WINDOWS.
        https://www.marinemec.com/news... [marinemec.com]
        Shipowners should update their onboard computer systems to the latest Windows operating system, if they are on Windows XP for instance, to avoid viral disruptions. They should also consider upgrading satellite communications with VSAT and a smart communications module, such as Speedcast's Sigma Gateway.

        Navios group IT director Katerina Raptaki explai

      • Running windows? Wrong, they don't, they have at least that much of a clue.

        You sure about that? Hell, I remember when they announced that *nuclear submarines* would be running on *Windows NT*.

        So much for "military grade security".

    • Re: (Score:2)

      by PPH ( 736903 )

      Remember Windows for Warships [wired.com]? One app divided by zero and crashed the entire network. First time we lost a navy ship to a zero [palmflying.com] since WWII.

      • often COTS run windows, the navigation/sensors tends to be seperate network. Like all systems you need management and maintenance of those systems just like the engine etc

        The problem comes when no one takes responsibility

         

    • "Don't run ships on Windows"

      I saw the header and I thought: is this about "IT systems on boats" or "Windows on boats"? Then I saw the part about RDP passwords and it became clear. This is, again, about Windows.

      Yeah, someone will come here to tell, once more, "oh, if other systems were as popular as Windows, then they would be equally cracked", but somehow, it is still Windows, Windows, Windows.

      Even if it only were a bit of "security through obscurity" and it were only to work for a few years, choosing "wha

    • Re: (Score:2)

      by AmiMoJo ( 196126 )

      Remember Windows for Warships [wikipedia.org]?

      Windows isn't the problem though. As the summary pointed out, it was due to weak passwords leading to remote management services being brute forced. Running Linux doesn't make the IT department magically more competent, in fact it can have the opposite effect as they turn to Stack Overflow for help with an unfamiliar system.

      • I guess that depends on if the undocumented user was there at install time as a Windows default or not.

        • Re: (Score:2)

          by AmiMoJo ( 196126 )

          Windows doesn't have undocumented users there at install time.

          It must have been someone installing it for easy maintenance. Probably an admin user set up specifically for RDP.

          • That is a claim you make, not a fact you know.

            • Re: (Score:2)

              by AmiMoJo ( 196126 )

              If it was an undocumented account that existed at install time it would have been widely publicised by now, not least in this report on ship cybersecurity. Obviously no-one can prove a negative, but unless you have evidence of this extraordinary claim then the probability of it being true is extremely low.

              Considering the amount of scrutiny that Windows is under I find it hard to believe that an entire user account which could be logged in to remotely could exist and not be discovered. It would have to be hi

    • Re: (Score:2)

      by sad_ ( 7868 )

      what's also dumb is no backups and a weak security configuration.

    • Also, not carrying ANY paper charts as a backup? Dumb, dumb, DUMB.

      Shouldn't this be, like, illegal? Nobody should be piloting that much metal around the planet without knowing what they are doing with it.

      • Shouldn't this be, like, illegal? Nobody should be piloting that much metal around the planet without knowing what they are doing with it.

        Interesting point.

        I don't know if it's illegal or not, but honestly, it's mind-boggling to me that a ship of any size would head out to sea without paper backup charts. The captain must be a genuine dumbfuck not to think ahead about the possibility of some sort of computer failure occurring, whatever the cause.

        I mean, who the hell is that confident in their computer systems? A briefcase of "emergency" charts would have made this a non-story that we probably never would have even have heard of.

    • Heh I used to always make sure I brought a paper map on offroad rallies as a backup to the tablet-based navigation system. These days it's not so important as I now have the exact same setup on my phone, but I haven't bothered to take the folded paper map out of the navigator's clipboard...

      Closest I came to needing it is when the tablet's microSD card spontaneously ejected into a field somewhere, good thing I had that backed up and the map files were in onboard storage...haven't put a microSD back in it sin

  • LOL @ terminology (Score:3)

    by Dunbal ( 464142 ) * on Wednesday December 12, 2018 @11:45PM (#57796066)
    If you are allowing people to plug USB sticks into your computer you aren't as "air gapped" as you think you are. Sneaker-net is still a net. Air-gapped means no connection to the outside AT ALL.

    • I think that's rather the point of this article. However, some of this is just plain stupid--critical systems should be kept pretty strictly locked down, very possibly with either no ability to communicate or only able to receive messages for the humans aboard to access. (If you want to be really paranoid, lock that down to plaintext only.)

      And, y'know, never ever ever be so moronic as to not have non-computer backups. Especially for your navigation. Maybe they were sailing under flags chosen in part bec

    • Being airgapped isn't the problem. They should look into watergapping. I bet that's how those pesky viruses got on the ship. (water == conductor. It's elementary!)

    • Actually that is the very definition of air gapped. In order to transfer files you sneaker-net. How else do you propose to apply updates and do other requisite file transfers?

      • Re: (Score:2)

        by sosume ( 680416 )

        If it's airgapped no updates will ever be needed. And file transfers would be strictly forbidden as well.

        • You are a moron. Not all updates are security updates. You never heard of bugfixes? How about feature set improvement? Seriously, this is the second time you have shown what an incompetent idiot you are in as many replies to my posts. Get an education and STFU until you do.

  • My dinghy runs on BeOS.

  • Air gaping in network terms means no connection possible. More in fluid flow terms, a semi abuse of language from a time of solely wired connections. Air gapped really means no connections allowed, wired or unwired. Ships by their very nature can not be air gapped, communications need to be maintained.

    The ships system should be locked down though only capable of taking input from wired connections, never ever wireless and that USB port should be locked behind a safe in the Captains cabin. Flexible == to in

    • Beat me to the air gap point.
      As to your other. You don't understand shipping, and they're clueless. Need to be educated.
    • Bullshit. Air gapped means no network connection from the LAN to the WAN. It has nothing to do with wireless vs wired connections. What makes you think that a wired connection to the outside world is significantly safer than a well encrypted wireless one?

    • Right they should be air gapped.

      Why aren't they?

      Because if you air gap them then the manufacturer of the software and control systems can't monitor their performance, provide bug fixes, and record data on their customers.

      Yeah for the same reason other systems aren't air gapped. Its good for the corporation who made the systems and bad for the customer. Just like for all the other systems that use computer software.

      Why is Windows used instead of Linux or a proprietary system?

      For the same reason Windows is us

  • Worms? (Score:3)

    by fredrated ( 639554 ) on Wednesday December 12, 2018 @11:50PM (#57796082) Journal

    Once it was the wood-eating teredo worm that sank ships, now it's data-eating worms!

  • A new-build dry bulk ship was delayed from sailing for several days because its ECDIS was infected by a virus. The ship was designed for paperless navigation and was not carrying paper charts.

    Not foreseeing malware problems can be kinda forgiven if you're ignorant of IT. But not having paper charts on board? That's utter stupidity. You're going to risk the ship and the life of everyone on board because you don't want to pay about $100 for a set of waterproof charts? Never mind malware. What happens if

    • I think you can get maps for free at a Texaco station - but perhaps I am dating myself.

      It's almost inconceivable to go out into the middle of the ocean with *no charts*. If nothing else, put the charts on a backup iPad or something at least good enough to find a safe port.

    • ECDIS does much more than just simple google style nav. ECDIS also understands ship draft, water depth, turning radius, etc and is designed to keep the ship from doing something stupid like the Valdez did. ECDIS also looks for dynamic collision dangers fro other ships with radar feeds. So even if a ship has paper charts, the regulators, insurers or owners will not risk a drowsy watch running into a rock thus risking life, limb or billion dollar damage/fine payout. Would you fly intercontinental if you k

  • Ships are not air-gapped, they are water-gapped!

    And everyone knows that salt water conducts.

  • What? No backup systems? (Score:5, Insightful)

    by techno-vampire ( 666512 ) on Thursday December 13, 2018 @01:30AM (#57796326) Homepage
    I was in the Navy back in the early '70s, when LORAN [wikipedia.org] was still king. Our ship not only had paper charts for the Quartermaster's Mates to track our position by dead reckoning, we took regular star sightings with a sextant for Celestial Navigation. And, we still had two mechanical chronometers that were kept wound, even though the ship's navigator had an Omega watch that was more accurate. The USN doesn't take chances with things like this and I'd bet that today's ships still use dead reckoning, hand-wound chronometers and sextants even with today's highly accurate GPS, just to keep in practice in case of an emergency.

    • Re: (Score:1)

      by Anonymous Coward

      Given the recent collisions my guess is that seamanship isn't the US Navy's strong suit at the moment.

  • "I'm the Nigerian Prince of the world!"

  • Since they usually propogate via USB *drives* (not "sticks") then I'm going to go ahead and say they are exactly as air gapped as one might think.
  • Comment removed based on user account deletion
  • They have satellite internet.
    Some even fast enough connection to watch movies.
    Air gap means NO outside connection.
    Ships are NOT air gapped.

  • There is absolutely no good reason to keep Autorun on USB devices as a thing. People just need to learn to open Windows Explorer, and browse to an .exe to run if they need to install something. If it is drivers they are worried about, then provide simple steps on the device in print for where to download drivers. That is it, end-stop-goodbye.

  • ... shadowing the goddam ship's starboard aft and hopping a WiFi that was just a LAN?

    The root cause of the infection was poor password policy that allowed attackers ...

    Or did they land an Internet-connected drone on the deck and snake an Ethernet cable down to the server to "attack," it? What is "air gap" again?

  • iamthecaptainnow.exe

  • When they remotely infected that ship,
    was the wek password 16309, or 123456?

Slashdot Top Deals

For God's sake, stop researching for a while and begin to think!

Close