Thread by @cybergibbons

I broadly agree with this thread, but there's a few aspects where I think the scale and magnitude of the issues on modern ships is maybe not clear.

The number of modern vessels that have all their critical safety systems air gapped is getting lower and lower.

https://twitter.com/johnkonrad/status/1775307764073365920

What do I mean by critical systems?

Steering (which, oddly, depends on the type of vessel)
Propulsion (which can be the same as steering)
Power management system
ECDIS (electronic charts, which may or may not directly impact navigation)

Let's look at a few of the times we've found air gaps eroded on vessels.

This is the console used to control dynamic positioning on an offshore support vessel. This is designed to hold position, with control over propulsion and steering.

It's running on two Windows boxes, which are rather old.

Let's have a look in that control cabinet.

What's that?

A modem.

An ISDN modem, connected to Fleet Broadband (FBB, the slowest and oldest satellite connection).

This is not an air gap.

This is one of the generators on a similar offshore support vessel.

We knew there was a condition monitoring system, feeding back data allowing for predictive maintenace to take place. How is that information getting back?

Inside the control cabinet is a little cellular router.

We're on the bottom plates, so no cell signal, and the antenna isn't fitted and there is no SIM.

Oddly, the little router has a WAN/LAN port - not discrete ports like on most routers.

How could it be firewalling or securing the generators?

Well, it wasn't. It was just two subnets.

Change your IP address and you can route to the other subnet.

The controllers for the generators were exposed to this network. Download a little tool, and you can interact with them over the network.

But how can you gain access to that network?

Well, each cabin had a little box for satellite TV. Turns out network segmentation had not been put in place.

This is not an air gap.

This is a little embedded PC we found on a container ship. Some kind of gateway for performance monitoring.

It made one connection out to the ECDIS, but this was one way.

But to communicate with the engine, it used Modbus - this can't be a one way connection as it is request/response.

The kicker was that the box had an active TeamViewer connection. And could interact with the main engine.

This is not an air gap.

These systems are incredibly common.

Only one ship that we have tested - which was built in 1982 - has not had any of the critical systems connected to external entities.

On one super yacht we even found out the main engines had their own dedicated satellite connection for diagnostics.

The other aspect I don't agree with is how often these connections are "one way".

Often they are described as one-way, sometimes they are designed in such a way, but often this is a pretty token attempt at protection.

There are devices called data diodes that only allow data to flow one way, but we rarely see these.

A common control is only using one half of a serial connection.

If you can only receive data, then that's fine. This is a performance monitoring system using this method.

Far more common is the use of "gateways" or firewalls. Now, these are a security control, but that doesn't mean they are perfect.

Often we find ways around them.

But more to the point - it doesn't matter - they are no longer air gapped.

If the vendor who installed them can use them for remote access, so can an attacker.

A common theme across all of the systems above was that they weren't documented and the risk wasn't properly understood.

We had to find them and examine them in depth to understand them.

Often the crew know there is a system, sometimes they know where parts of it are, but on many occassions we've had to root around to find them.

In one case, it's entirely conceivable that a cellular modem designed to allow remote servicing of the STAGE CURTAINS on a cruise ship could result in us impacting fire alarms, lighting and propulsion.

It took two of us a day to find this cellular modem...

So once again - no, we can't say if the Dali was hacked.

But we need to be aware that air gaps are becoming very rare.

In my notes on tests, 32 different gateway systems made by many vendors.

Did we break all 32? No, of course not.

But some of them, we very much broke them.

And to be clear, a dynamic positioning vessel is very different to a container ship.

The helm and main engine controls are much less complex on a container ship and far more likely to remain air gapped.