Attacks/Breaches
10/11/2013
07:28 PM
Connect Directly
RSS
E-Mail
50%
50%

Researchers Highlight Security Vulnerabilities In Ship-Tracking System

At the Hack in the Box conference, a group of researchers will demonstrate how attackers could fool a system meant to help ships avoid collisions

When it works normally, the Automatic Identification System (AIS) used by ships can be a captain's best friend, helping him or her avoid collisions on the high seas. Under the control of a hacker however, AIS could become a captain's worst enemy.

At the upcoming Hack in the Box Security Conference in Malaysia, a team of security researchers are preparing to demonstrate how an attacker could hijack AIS traffic and perform man-in-the middle attacks that enable them to turn the tracking system into a liability.

AIS is an automatic tracking system intended to help identify and locate vessels electronically to help avoid collisions on the water. AIS transponders on the ships include a GPS receiver and VHF transmitter, which transmits information to other vessels or base stations. AIS is required on many vessels, including international voyage ships weighing 300 tons or more and all passenger ships regardless of size.

According to Trend Micro's Kyle Wilhoit, one of the researchers who worked on the project, says the attacks can be broken up into two categories: those that target the AIS Internet providers that collect and distribute AIS information, and those that target flaws in the actual specification of the AIS protocol used by hardware receivers in all of the vessels. Without getting too deep into the vulnerabilities ahead of the presentation, which is slated for Oct. 16, Wilhoit explains that the upstream providers fail to authenticate AIS sentences coming from ships.

"I could go out, and I could pretend to be a boat, and they don't even fact-check it," he says. "They don't look at, OK ... is this AIS sentence actually a boat? They don't check any of that. So it's all accepted as is. It's accepted as true."

According to Wilhoit, these conditions could allow an attacker to tamper with valid AIS data and do everything from modify a ship's position to creating a fake vessel with the same details to fool anyone monitoring ships at sea.

The researchers are also prepared to demonstrate how the other set of attacks could be used to perform a variety of malicious actions, including fake "man-in-the-water" distress beacons -- which would trigger alarms on any vessels using AIS within approximately 50 KM -- as well as fake a CPA (closest point of approach) alert and trigger a collision warning alert.

"The complexity of the attack is what I would consider 'somewhat complex,'" Wilhoit says. "This is because the AIS protocols are typically not ... researched by security researchers. Therefore, there's a learning curve with the protocols, uses, [and] implementations of AIS. However, once you gain access to the AIVDM sentences, it's in clear text, which makes it somewhat easy to modify. Also, you have to reverse engineer the AIVDM sentences and be able to put them back together in order to correctly perform attacks -- which proved to be somewhat difficult."

The cost of performing the attack is relatively cheap: The necessary equipment can be purchased for between $100 and $300, depending on the attack.

The researchers are working with upstream providers and others on addressing the vulnerabilities, Wilhoit says.

"From the online Web providers, such as Marinetraffic.com, implementing authentication from every vessel submitting sentences would help mitigate the problem fairly quickly," he notes. "However, the fundamental problems with the AIS protocols would require a complete overhaul -- which is difficult because it's implemented worldwide in thousands of devices."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Peter Fretty
50%
50%
Peter Fretty,
User Rank: Apprentice
11/14/2013 | 7:32:36 PM
re: Researchers Highlight Security Vulnerabilities In Ship-Tracking System
Closing vulnerabilities is part of keeping the fortress secure, especially in today's evolving threat landscape. Sophos offers some great advice here: http://nakedsecurity.sophos.co...

Peter Fretty
Nicca619
50%
50%
Nicca619,
User Rank: Apprentice
11/14/2013 | 5:34:34 AM
re: Researchers Highlight Security Vulnerabilities In Ship-Tracking System
Here are some good thoughts in reply to all the Buzz about AIS Hacking

http://www.portvision.com/news...
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-6651
Published: 2014-07-31
Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary files via a .. (dot dot) in the path parameter to (1) add_headers.php or (2) minify.php.

CVE-2014-2970
Published: 2014-07-31
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-5139. Reason: This candidate is a duplicate of CVE-2014-5139, and has also been used to refer to an unrelated topic that is currently outside the scope of CVE. This unrelated topic is a LibreSSL code change adding functionality ...

CVE-2014-3488
Published: 2014-07-31
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

CVE-2014-3554
Published: 2014-07-31
Buffer overflow in the ndp_msg_opt_dnssl_domain function in libndp allows remote routers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS Search List (DNSSL) in an IPv6 router advertisement.

CVE-2014-5171
Published: 2014-07-31
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.

Best of the Web
Dark Reading Radio