All At Sea. Thought Your OT/IT Infrastructure Was Complex? Try Doing It On A Cruise Ship - Ken Munro

Good morning, Marathon. Thank you for inviting me back. How you wanted me back after last year, I don't know. Uh yeah, planes for fun last time. Anyone seen the uh story about Wonder Lions playing um GPS? >> Yeah, massively overstated things. Anyway, so I'm here to talk about shipping. Uh and yeah, first time I've done this talk. I'm not a particular expert at shipping. and have spent time at sea. Uh but most of this comes from many of my colleagues and I want to tell you a few fun stories and anecdotes about some of the things that we learn about ships and why you should be really careful on board cruise particularly. Why do we have history

done all sorts of weird things over the years take remote control of things like mods which are sterile propellers engines binging systems all sorts of fun and crazy stuff along the way. We've learned loads. I just want to share some of that. Where come from back in the day shipping was isolated. It didn't really have a problem with security because it wasn't connected. Everything changed with Visa. So very small terminal satcoms which brought the cost of satellite connectivity down from dollars per kilobyte to pretty much always on as far as you start. with a problem. Everyone connected vessels without solving any problems on board vessels which have frankly carry 10, 15, 20 years of technical debt which make huge

challenge. We've seen a lot of maritime vendors, technology vendors don't really show each other's cyber security and frankly most of the crew don't have the first clue and even when we're approaching organizations often get involved at the design phase of new vessels and review their architectural diagrams even then after we give them guidance they've done a good job of the architectural design what the then builds can be really quite varied but I do want to make one really important point is commercial vessels use completely different separately use protocols called NEA 2000 which is bizarrely electrically compatible with CAN from vehicles. What I'm going to be talking about are protocols involving MEA0183 which even more bizarrely are very

similar protocols to GPS sentences. So your GPS phone watch uses the same protocols that some ships use. So when we start obvious place to go was looking at the terminals that connected vessels to the internet bring it on and in the early days great example of running before you can walk everyone connect their terminals. No one realized you had to do anything about configuring and securing them and left them available to show. So if you knew what you're looking for, you would find accessible compromisable terminals even better than that. They even on the um landing page software version number what the vulnerabilities were although many times they hadn't bothered to change the password and default so you could jump

on that's improved massively. So whilst it's still possible to find these terminals most of them are nowadays on private networks or kept up to date and secure. However, let's go back to date. So this is about 10 days ago. You probably saw the press story. Bunch of Iranian vessels got brick. They went dark. Their sack on terminals were taken online. And if you want to read more, there's a few press articles online, but Risky Biz does quite a good job of covering it. So went into a little bit more detail. We we dug harder to see what was going on. We looked at some of the disclosures. There were referencing some software from Falcon. Now from our

previous book, we've seen Falcon used on some direct satellite terminals. So we started following the breadcrumbs and that led us back to of course defcon talk last year 32 32 there was a really interesting talk about uh finding vulnerabilities in IDirect satcom downloads you can go on YouTube now it's always our lesson well patch yeah well it would be wonderful but yeah classic example of organizations not updating the terminals in light of vulnerabilities that are now a year old crazy right and we see this all the with vessels that technical debt problem keeps carrying on. No one's quite sure who's responsible. Is it the owner of the boat? Is probably a bank? Is it the

operator of the boat? Is it the data party? Is the tech text provider? And this lack of clarity results in stuff not being updated. And on top of that, you got to add to it old school views of industrial control systems where if it ain't broke, you don't fix it. So, we've got to deal with that. So what have we been seeing in the last year or so? What often gets in documentation oversight documentation actually the documentation representing what's actually on the vessel segmentation huge problem and also these cluster of third party gateways. So the challenge in industrial control environment in OT is you've got to be really quick but also really safe. A cruise ship is one

of the most complicated environments you can imagine. It's a power station. It's a water treatment facility. It's got sewage treatment. It's got a hotel on board. It's got cabins. It's got everything else you would see with a ship. All mashed into one with multiple thousand people on board and mixed up the sea. You cannot imagine a more complicated environment. So, you need to move really fast when you're on board. And that's where a mind doesn't talk. It calls network fret because what is a ferret? You got to move fast. You got to move quickly. You got to fit around the network to find stuff. This is my colleague Andrew. You would own this talk, but sadly speaking at OAS

Manchester last night and you are going to do a lot of footsteps and explore a lot of weird places very fast in order to find where well you got to do it safely working at any OTM running. You got to be super careful it you can't port scan it. You can't run vulnerability scanners. You can't run exploit safely. So you're going to start paper you might then do a little bit of art and based on risk you might prove a little bit further but in the last 6 years we've never used an exploit on board the ship you don't need to it's easy start with docs any of you have worked in networks the documentation is probably going to be

out of date you have exactly the same problem ships sometimes you get beautiful well-maintained documentation you get electronically you get it in advance And most of the time they find it's been printed out and annotated and even then with the annotation probably still doesn't represent what's really going on in there. So you have to go hunting. You have to go looking for weird stuff. So on my right you can probably see there's actually a local cruise ship. You've got a sack mediator which basically aggregates multiple VAS antennas and breaks the data into cabin and lots of other weird and wonderful things. You also need to go exploring with Wi-Fi kit because of those third party vendors.

They put Wi-Fi access points everywhere and don't do it because it's easier for them because it means they don't have to get keys and just connect to stuff. Fantastic. And then you find access points that no one knows will be used for. None of the times we got to say what's this? We don't know. Should we unplug it and see what happens? Yes. Brilliant. Way to go. And then you find devices everywhere. I'm going to go into the one on the top left, the MBET in a minute, but you find lots of other crazy devices used for fiber, segation, bridging, and they are a huge source of problems. Cruise ships who cruise ship are old enough

to go on a cruise ship the average age by about anyway. So, I asked to give me show too much confidential data. I asked Darly to do a picture of showing golf simulator rubbish. Anyway, Christians get bored. They want to practice their golf swing. Do something. They find golf simulators. We found a golf simulator. Really interesting. Went out the back, found a PC. Thought that's interesting. Okay. Clearly, they need to connect to that PC to play the game. I need to update it remotely to support it and update the software on the golf courses. Of course, that device was committed. Now, the CR this particular case have done the right thing. They've done a dirty VLAN,

something you didn't trust. They put it into a TAN they called it. Unfortunately, we've had a bunch of issues with segregation. Uh it had Team View personal running on it, which isn't a great start. So, should be easy to get the credentials at that point. Yeah. through a series of configuration issues ended up going through the business network in the wire network in the property management system sorry the performance manage system and then the voice recorder I'm going to come back to the in a minute what was the voice recorder we'll talk a bit more about those minute is a really really device and it's a black box of a plane but it's on it's got two

components it's got a a danger unit storage area and a float free module. So ship goes down storage floats free floats around on surface mean that I'm going to work out why you're underground but hey at least knew right. So that voice data recorder was connected through a series of misconfigurations in the golf simulator and there's that we can break the VR break is not legal to so you can stop that cruise ship movement. What about more easier segregation? I'm going to touch on um another interesting device. This is the emergency generator. Really, really important device. It's really important for legal requirements as well. Regulations called solar safety of lives at sea mandate that your

emergency generator kicks in within 30 seconds and power misconfigurations are one of the reasons why the MV crashes the bridge of course and result in loss of six lives. Awful awful incident. Now you'd expect that the management system for managing a generator which provides emergency power is going to be suitably segated and it was done using one of our favorite MB end M end to end devices. Interesting. So how is it configured? Well MD MD spy it's a pretty basic device. It's got a LAN and a W. interesting device segregation for the environment by in one subnet the ship's land and another subnet the generator controllers and we had to use our lead hacking skills and just change our IP

address and bypass all segregation and then have control of the generator bad day the emergency generator that don't work you aren't going to see again so your creature cannot be legal to fail not a good idea next really interesting place is a big driver everyone at the moment in if we increase operators is to manage performance better. What do I mean by performance? I mean things like least routing so we've got tailwinds not headwinds stable for our passenger so it's comfortable but most importantly burn the minimum amount of fuel carbon dioxide carbon emissions but also cost. So we want to manage performance. Now in order to manage performance I need lots of data. I'm going to need things like

the speed such as log. I'm going to need to know the wind. I'm going to know the depth. I'm going to need lots and lots of really reagenting information. And getting access to all is complicated because it's spreading around the ship, which means lots of cable, lots of drain holes, lots of space. But we've got a thing that gathers all that for us already. It's called the oil data recorder cuz that's the thing that gathers all the data just in case something goes really badly wrong. So a lot of performance um management vendors want to interface with the VDR the one critical device that's absolutely essential that must operate we don't go to see so lots of your third party

vendors who aren't particularly good at cyber security want to talk to the most critical device on the vessel that's the VDR that's the free module up top so if it all goes wrong pop off it goes and we find out where we all died uh anyway they're really interesting devices really complicated go inside you can see all the stere speed, depth, burn, all sorts of interesting things. And in this particular case, the cruise uh line operator said, "We'd like to understand if this mining management company are doing the thing by connecting the think station to the side of the voice recorder and interfacing with senses and they proposed something. You need to know a little bit about VR." So

the way the forest data record works it will have essentially a forensically sound uh data recording in the DRU and if this doesn't speak but actually access then the investigator connects the DU with a particular uh forensic uh tool and then act as longterm storage to see what went on. If we didn't get that ship back then we'd be inspecting the plate free capsule. If you've ever been to the um Mib, the marine accidents investigation board, they do recovery hardware, the the flash memory from the free capsules after they win seaw water for a really interesting organization. Anyway, so what the proposal was is they wanted to dual so they wanted to connect into a Windows

box dual into the switch into data recording. It was probably a reasonable way of doing it. But it turns out what they've actually done is public disag

network cuz someone plugged the wrong thing in. Bad day. Just There you go. You got three connected to the network. Bad. Bad day. And there is gooey on the voice data recorder. Okay. It's one thing I can read, but I'm going to stop the ship sailing. Want to brick it. So, went a bit further. Um, I've never seen the word password misspelt before. But any So, it was a tricky password obviously access to complete trash company and it's all over the ship. Don't go nowhere. Okay. Back ships specifically bad movies side venture don't we love it? So the measures you remember is a scenario over you haven't watched it don't bother it's a movie but anyway

let's talk about whether we can do that now stability loading the vessel is absolutely critical we talk about trim and we talk about necessary height which causes the ship to roll you roll too much it's uncomfortable for passengers you don't want to travel too little cuz it's stressful and so can we mess around with the loading computers and in order to do that we're going to need to connect to the ICMS really the critical system that drives everything on the vessel. So we also need to understand that many cruise ships work in fire zones and you'll also find that many of the IT architectures also in fire zones will run in loop. So if you have fire in

the fire zone, don't lose the embarrass. There are a single point of failure. If you haven't watched the Netflix documentary about the push ship just a few a few weeks ago, it's worth a watch. Engineering fire took out all the power cables inside vessel which stop toilets working 4 days later. It was a bit of a issue. Anyway, so let's talk about fire zones. Now it's one of those five zones of redundancy in the cabin switch connected through to a loop network which then other segments for example

data critical environment and this time is special one that we bridge into the ICMS because it's a really Cool stuff there. Now we often find a lot of serial communication in I'm sure many of you with that serial cards are great. They do degrade over long distance. So what we tend to do is encapsulate them over IP and then send them over IP and decapsulate. To do that we're going to need a serial IP converter. Hundreds and hundreds of these in any OT environment and we won't talk about the security of those. So anyway, how are we going to get between them? Well, so we somehow got to get into the ICMS and hit the

locator. Now the third party that described the in well it was server and UI on the bridge someone to manage make sure and ser down to connect some connectivity great server you now the way that we do that we connect network on fine but in order to do this properly They're going to have to drill seven deck penetrations, right? So, first of all, they're steel, so they're difficult to drill. Secondly, they also have to water and fire proof to be safe, which means drilling seven deck penetrations to connect the server to the user interface was going to be really expensive. This is what we often see is maritime tech venders will try to find the buffer of the least resistance. So,

how do we get in? Well, looking at these devices, we started looking at various vessel carries and the operator really thought about these and they g well we don't want anything that we don't trust connected to this environment. So, we're going to use Knack and so if your device doesn't present an 8021X stiffer, you cancel the network. Good, right? We like that, right? That's a good idea and if you're going to go to a target but unfortunately tech vend that did this hadn't put any isolation between devices in the target so you went into the black hole target you could talk anything else in there so all we needed to do is connect the tech member taking advantage

of that not provided the S2 access and got the UI through the target saving some demonstrations but also unfortunately exposing it to Anybody else with a laptop that plugged into any award without providing certificate wa what a fool as a result of that they get complete compromise of low computer server access to modified ballast distribution work and that has a convential impact on those stretch you break the back of vessel by loading it let alone tipping it over fun hey yeah we love this anyways

uh after failing my degree I ended up working for 3 and a half years in hotels. So I've got quite a lot of experience working in property management systems used to manage hotel. So wow this was great but we haven't actually disclosed my ability by the way over there on the cruise ship for you. We have told we're okay. Uh this is MXP and this is a property management system for this will do things like rooms can um do room access control. You can do it you can do your ability to pay for stuff to the bar all those sort of things. X does it all great but it just unfortunately it's not very well designed. So it has

mostly done on iPad clients but actually we also have desktop clients and it talks to their server client server unfortunately you access the settings that's good idea and then we just go wasn't actually there so just server okay that's a good start and the credentials were the same we found on another vessel with the same installation made of digits not going to take long to prove that but I'm not telling you what it is and as a result of that it gave us the ability to send us to all procedures do the works and we have completely compromised of the SQL server which gave us everything. At this point we now have high privilege on the

property management system. So at this point we could lock everybody out of the rooms. We lock everybody in the rooms. We could build anything we wanted for the cat's account for something and completely trash the system. So bit of a major reason we did disclose this. respect to MXP. Oh my gosh. Uh 5 years ago, they said it was going to take 2 years to fix it. Anyway, so back to those fire zones. These are quite unique to these fire zones. So the great thing about um pest and I appreciate is you can often do it in the bar and if you sweet the bar staff and say can I jack into one of your network

walls which my wonderful collectibly segmented put one of the uh UPS's in the wrong zone and left it accessible from customer bar uh network ports as a result we can reconfigure that some really weird link local address didn't really understand but they've misconfigured the crew Wi-Fi probably your biggest risk on board the most likely source of attack is probably going to be one of your own crew and the reason being they'll get a fixed band or Wi-Fi access and when they run out of trade with each other if run out as well they'll often be looking for ways to bypass the captive vehicles so your crew is probably your biggest threat vector because they just want internet access

so they will do anything they to buy stuff. So we remember we were sat at the bar bounced up on the UPS's realized they'd actually put the captive portal for W the wrong firewall interface and realized that gave us access to the local computer systems that is the graphical display of what is going on the bridge from the bar. We had full control vessel fun and just to prove it. So very top you probably see Nappa NA. So that is a massive technology vendor of maritime tech. So yeah we've got access amusingly they're hosting an event that we're speaking at home in December. It's going to be quite awkward all the vulnerabilities. Anyway that's another story. Other stupid we found

along the way. Um, so this is a different attack against cabin switching with physical access. You can insert your own switch and get access to the Wi-Fi CTV. So you have access to every CCTV camera on the vessel. That was quite fun. We also have access to the lighting system. More recent cruise ships, they've got the ability to turn the lights on and off on the cruise ship. We asked our permission. Nobody laughed and said no chance. Oh, come on. I said to you, please. Um, also this is one of my colleague Andrew's finest achievements. He managed to over a period of time and being on board the vessel discover a number of bugs that eventually gave him

remote control of the antipod from his sofa at home. You know that is the ultimate change pack fully remote unauthenticated compromise taking control of the vessel. He had control of nuts. And finally, this is one of the disclosing

[Music]

that network stage moved over. Anyway, uh that's the reason we haven't published that yet. I think soon if you want to rip rock crazy. So move on. Um because as in last play I thought we could have some fun talking about hacking. Now of course there are two extremely famous English movies about hacking ships and the first one our favorite hackers. What an amazing movie. Now if you've actually watched it like last time I actually the plot is around the Vinci virus which is used to capsize to offer a distraction from $25 million heist. None of that made any technical sense. So it was fun too. Um yeah I actually paid to go and rewatch these

two. Can I adise you don't? It's utterly shocking few words single in history. Anyways, what's interesting about it is some of the hacks they use are actually quite even nowadays the fiction predict the truth. So for those of you who haven't yet, I'm about to swallow the clock. So hands on your eyes and over yours. So essentially what happens is uh the character will def play an auto software engineer developer who's been fired by his employees the cruise line which makes absolutely no sense because I've never met a cruise line operator autopilot software. They're all written by third parties like that. So it doesn't make any sense. And then you have to be subjective to

the point. The idea is is to crash into an old near St. Martin and cause chaos and then some bullet Patrick through some horrific acting and an awful plot holes but amazingly hacks kind of as a hack. So let's go through this and cream shall we? So amazingly it's red ship and it's still a float. It's uh it was written by Kingman launched in the I think 1994. Moving was made in 97 and they hired it for I think 6 weeks at a cost of $38,000 a day. It's now called Star Engine Legend and the reason I put that the red line there is because it's just gone out to CN2. [Music] So it's now a little bit longer. It

genuinely exists. It's a real ship that they used. So what happens now? I tried to take some screenshots but I did it too late and didn't have time to do it properly. So the idea is in his cabin and then he takes away some scene and there is the fire backbone the entire vessel. Okay. First of all there wasn't really much fiber on vessels in the early '90s and it doesn't run through the ceilings that wouldn't be safe. So actually the way runs it runs through vertical trunking. Uh if you ever go to a cru you'll see a panel next to your door and that's where the trunking runs. That's where the camera switches on. So,

that doesn't really work. Um, the next thing we did, we used to switch. Now, I'm old enough and I've got rare enough hair to remember beige boxes. If you zoom in, it actually says fiber connector, which blows my mind. Now, I spent quite a bit of time going back to trying to find a look like that. I had one that looked exactly like that and it was a parallel switch print parallel print and you have to 25 parallel cables. You can switch between multiple PCs and multiple printers. I'm old, right? Pitting me. Anyway, so I think the first thing is they made that up so they just stick on an old power box. Okay, so

whatever. He then went to network control. The best image I could get this when he calls a distraction in the engine room which caused the crew to leave the engine inputs in a 15 pin diesel connector that modifies the rest of the network valve connector. Don't want those crazy when does anything with a 15 pin dies. Um okay so that then causes two of the engines. Okay. Now my first question is hang on there's two props. Most ships will actually have direct drives. So if you two props, you might have two engines, two prop shafts and two independent engines. Now genuinely, I checked this up. The single legend actually had four. It looks like it's generating

electricity to drive the drive shafts. You'll even see a pods because there's no real way to get an engine inside. They're all electrically driven. Massive, massive generators. And then the engine explodes. Now, I'll be honest with you, causing a marine engine explosion isn't actually that easy because they have really good protection. It's best to shut them down. So, a good example how you might shut down a marine engine. So, you might send a radius depth. So, the ship's lock depth bit. If you sent that to the engine control system and said, "Look, it's shallow." You thought you're about to run around, it'll automatically shut down the engine. So, that was easy. Uh there's also some controls that will look at the

oil missing inside the crank case because it's to a certain point of oil becomes explosive. Boom. So you can send excess oil miss value and that will cause the engine to shut down too. But causing it to blow up is actually quite hard. Now I'm going to come on to this about there is your average marine engine. That's the very top bit. Uh you got the exhaust valves at the very top. Got turbochargers up there as well. If you're going have an engine blow, it's going to come out from the side. Now, it is cruise control that blows up top. [Music] That's not where it goes. If you got an explosion, it's going to come from the

crank cases on the side. And there's some videos on YouTube of some pretty nasty explosions where the crank explosion was like this thick, just blasted across the engine room. So, that's where you would blow up. Um, the other thing you'll notice if you really want to watch speed controls, there's crazy vibrations as the engine shuts down and it takes 10 minutes to shut down. But like I main engines that run at 55 to 60 RPM, the only you stop injecting fuel or that engine, it's just going to stop. That's all it's going to take. Now, yeah. the crew in a mechanic trying to stop the engine shutting down. Honestly, if you want to stop engine or take control

of it, you're going to these three sticks. So, every large marine drain diesel have six. You don't want to do that cuz you're going inside the unmanned machinery space, which is incredibly noisy, very unplayable place to be. Massive defenders, not nice. But you just ride the six, you just manually change the fuel mixture and you're in a good place. Um, what about defending? What what Sandra Bulock do? Well, they suggested flooding power tanks. Now, they referenced adding million L of water. That's actually quite plausible and it it would slow the ship down a little bit because it would increased mass affect the trim. So, the weted area drag, but not much. It'd be much better

to affect the trim forward and half. So, the forward bus tanks will make ship ride low water at the front. probably propellers slightly out of water. Be much better getting out of trim and then it really goes silly is in the movie they flood the ball tanks and it appears that open the ballast water doors the outside into the deck area but and the small kid has to be rescued cuz you're getting washed away by the ballast water. Real world ballast tanks the whole places the only time anyone goes inside them when they're trying to do that still easy during ride preparation. So that's utter goblers. That bit didn't work. And then Jason Patrick decides in

order to stop the um engine to jump overboard and wrap a great big steel cable around it because I've had wrap on a yacht. Not a nice thing to happen. It does work, but you don't need to. Just go to steering control room. Couple hydraulic rams there that every morning before they depart, um they'll do a manual swing of the rudder from the control station. to just get there and press a button that makes it go that way and you don't have to worry. And I think finally the last bit the bit that just had me laughing and shouting at TV and I've forgotten this from when I first watched the movie in the late '9s is the

way they cause the ship to move is they manually operated the B thruster and they manually operated it by diving down winding right and manag to move by a few degrees. Now, number one, for the autopilot, right? Any autopilot will immediately. And number two, I did check this. The power output you're going to need to shift the nose of the vessel is in the mega range. So, the average bow thruster on a resized cruise ship is around 5 megaw. So, Jason Patrick ain't going to work. Anyway, so couple of things to wrap up with. Good news for us all. Okay. appreciate no one's going to go and try and accurately my story. Anyway, uh there was some

marathon regulations that was supposed to prove everything. So I see 42898 very complicated was supposed to um improve site security ships. Not very much happens and people registers not much everything changed last year. So the international association of classification societies so these are the countries that kind of do you for your ship and without yours insured you're not legal you can't go so I came up with unified regulation E6 to 27ing technology on vessels and into vessels and any new build which was first of July last year they're talking a year build comes into gets launched it has to be compliant with these rates or it's not worthy and therefore not durable. However, I think there's a huge shortage

of expertise within the industry to actually certify these vessels. The organizations are the classification societies that are supposed to do this physical vessels. Is that water tight? Is the engine safe? Is your system doing it properly? They're not cyber skilled for a couple that are making progress. For example, DND reasonable job making progress, but there still a huge decline in terms of getting our existing fleets of ships much more secure. So anyway, that's me questions. Thank you.

[Music] safe. It's fine.