Australian Ports Resume Operation After Crippling Cyber DisruptionAustralian Ports Resume Operation After Crippling Cyber Disruption
Details of a major cyberattack against Australia's shipping industry remain few and far between, but the economic impact is clear.
November 12, 2023
Four major ports in Australia resumed operation on Monday after a weekend of cyber-induced downtime.
The incident afflicted DP World, a Dubai-based international shipping and logistics company that operates ports in Sydney, Melbourne, Brisbane, and Fremantle. Speaking with ABC Radio Australia on Monday, Clare O'Neil, the country's cybersecurity and home affairs minister, drove home the impact of the attack, claiming that the company is responsible for approximately 40% of all freight into and out of the continent.
"To me, what's unique about this target is the outsized effect it can have on markets and supply chains," says Casey Ellis, founder and chief strategy officer at Bugcrowd. "When viewed through the lens of global trade warfare, a shipping supply line, or the ports which enable them, become a pretty compelling target."
Disruption at Australian Ports
The incident first came to light on Friday, DP World noted in a media statement.
While the exact nature of the attack has not yet been publicized, the statement did note that "a key line of inquiry in this ongoing investigation is the nature of data access and data theft."
Some experts have speculated that ransomware was involved. On Mastodon, cyber-threat researcher Kevin Beaumont fed fuel to the claim, linking the intrusion with Citrix Bleed, a vulnerability in Citrix NetScaler devices given a 7.5 "High" severity rating by the National Institute of Standards and Technology. Dark Reading has reached out to Beaumont for further detail but had not yet received a reply as of posting.
By contrast, "a source close to DP World" told the Sydney Morning Herald that the incident did not involve ransomware. It did involve "unauthorized access," at least, according to one cyber analyst interviewed by Australia's Today Show.
In general, Bugcrowd's Ellis explains, "ports have the same systemic weaknesses that are common to many critical infrastructure verticals. This includes legacy technology, a prioritized focus on availability, and the simple fact that they aren't the first thing that springs to mind when one thinks about critical infrastructure cybersecurity when compared to power, water, and so on."
To stem the attack, the logistics company shut down its local systems through the weekend. As a result, by Sunday, the Financial Review reported that somewhere in the range of 30,000 shipping containers were stuck in port.
It didn't entirely cripple the shipping industry, though. "DP World cranes continue to load and unload ships at Fremantle; the cybersecurity incident has only impacted its landside operations, specifically trucks entering and leaving its laydown area. Ship movements are at this time unaffected," a spokesperson at Fremantle told the Australian media, adding that another company operating at the same port continued its operations uninterrupted.
Supply Chain Concerns Continue
By late Sunday night Eastern time, Monday afternoon in the Far East, DP World Australia returned to normal function.
Still, the country's national cybersecurity coordinator Darren Goldie warned on X, née Twitter, that "although port operations have resumed, it does not mean that this incident has concluded," referencing ongoing remediation and supply chain concerns.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
Passwords Are Passe: Next Gen Authentication Addresses Today's Threats
How to Deploy Zero Trust for Remote Workforce Security
What Ransomware Groups Look for in Enterprise Victims
How to Use Threat Intelligence to Mitigate Third-Party Risk
Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks