Ethical hackers Pen Test Partners have highlighted a vulnerability in the load planning processes used by containerships.
“Intercepting and modifying the messaging used in bay planning can be relatively straightforward if you know what you’re doing,” said senior partner, Ken Munro.
“When asked to investigate this, we noticed a lack of security in the validation of the message’s integrity and a simple phishing attack is all it takes to gain access,” he continued.
By modifying the messages, and therefore the loading plan itself, a hacker could cause a vessel to list by swapping the order that the containers are loaded.
Hackers could also cause environmental damage and incur heavy fines for shipping lines by forcing emergency discharge of ballast water as a result of unexpected out-of-trim situations caused by bay plan manipulation.
Refrigerated containers could be switched off spoiling thousands of pounds worth of perishable food and so the list goes on.
Not only that, but Pen Test Partners have discovered that USB sticks are commonly used to transfer the load plans from ship to port. This poses a major security risk as a USB infected with malware could cause series issues for port authorities.
“Ship security has a long way to go to catch up with the level of security we expect in corporate networks. They are remote, difficult to update, and their IT hardware is often old and not well maintained,” added Munro.
“Shipowners and managers need to have a cyber security plan in place and should review their current IT systems to make sure that any potential weak points open to attack are closed as soon as possible.”
In order to negatively influence ship safety through corrupting stowage integrity, you would need to hack and amend in near perfect parity both the vessel stowage plan as well as the terminal yard/inventory data. If only one or the other are deliberately manipulated, there are several standard robust processes (including now VGM) between when a container arrives at a terminal and where it later physically loads whereby such discrepancies will be detected and resolved. So at worst, such an elaborate hack would create some inconvenience, but is extremely unlikely to result in any of the outcomes alluded to here.
Yes – but time = money, and even more so in the container business where vessels have to stick to a schedule. Spending half a day finding the mistake, un-loading and re-loading to correct it, and dealing with the paperwork nightmare that would follow would have a huge impact on the vessel’s subsequent schedule.
I am not in a position to argue the connection to terminal data – I don’t know abou that – but given the complexity of stowage plans on board ships carrying 5 or ten thousand boxes, and turning off the AC on reefers, seems like a huge potential problem.