Related items

• Marlink strengthens position as Smart Network Solutions provider with repositioning campaign
  in Communications & Cyber Security

  Marlink is strengthening its position as a Smart Network Solutions provider with its new ‘Above and Beyond’ campaign.

• Connectivity demand booms as leisure vessels become safer, reports IEC Telecom
  in Communications & Cyber Security

  Demand for faster and cheaper connectivity at sea is set to increase as sailing is recognised as a safer place to work, travel and holiday during the COVID-19 pandemic says satcom specialist IEC Telecom, which is experiencing an increase in enquiries from vessel operators in the maritime leisure sector.

  With ‘lockdowns’ and restrictions easing in some parts of the world, yacht owners are now able to enjoy ‘social distancing’ onboard their vessels, which is leading to a boost in demand for high-speed connectivity and increased bandwidth capacity. With the focus on social distancing, yachts are becoming increasingly attractive remote offices for those able to attend to business matters while enjoying the open sea, sunshine and fresh air. During this challenging time, sailors have an increased need to stay connected for both personal and operational purposes as well as to avoid the need to go ashore as much as possible.

  The signs are pointing to an upsurge in leisure boating. Yacht chartering is seen as one of the safest ways to enjoy a break at present due to the minimal contact charterers have with other people. Yachts are considered to be more hygienic, given the ratio of crew to guests and the exclusivity of being on a private boat. Affluent consumers are looking for getaways with fewer crowds, more privacy and the ability to gather privately with those closest to them. The Boat Affair platform (whose rentals are available in more than 60 countries) has seen a 23 per cent increase in requests from customers who traditionally would opt for a hotel vacation or a seaside resort but are now seeking a safer alternative. And, according to a new survey by LuggageHero, 25 per cent of travellers report they will try to avoid crowded commercial flights and public transportation in a post-coronavirus world.

  Meanwhile, in countries where travel is still restricted, many larger leisure boats and super yachts remain fully crewed and operational – also leading to increased need for connectivity as crews try to stay in touch with family and friends while conducting as many ship operations as possible via remote techniques. With crew restricted to remaining on the vessel in many places, higher speeds and larger bandwidth capacity is needed to provide leisure activities too.

  The leisure boat sector was initially hit hard by international lockdowns and is now incurring additional costs for deep cleaning, personal protective equipment, virus testing etc which are not generally reflected in the charter fees. As a result, systems which allow to optimise bandwidth consumption in order to reduce expenses on communication are proving popular with consumers looking to install or upgrade yacht connectivity systems.

  Gwenael Loheac, chief executive officer Western & Southern Europe for IEC Telecom said: “Data traffic on leisure vessels has increased during this crisis period because crew, vessel operators and passengers need to exchange information on a more regular basis. In response to COVID-19, we are seeing increased demand for flexible tariffs to enable leisure vessel operators to adapt quickly to fluctuating connectivity requirements. Fortunately, we are well-placed to meet these needs, having a wide portfolio of solutions designed to provide best user experience, while keeping communications costs at bay.

  IEC Telecom recently launched OneGate Marine Compact, a new lightweight digital solution with a network management system which provides full visibility over on-board network assets (both satellite and GSM) and enables vessel owners to control expenses and optimise consumption via a digital dashboard.

  Mr Loheac commented: “OneGate Marine Compact was developed to cater to all major requirements of the leisure boat sector – addressing their needs for speed, bandwidth and cost optimisation. OneGate Marine Compact is an agile, lightweight, highly-adaptable and easy-to-install digital communications system which gives complete access to the benefits of digital connectivity even on smaller vessels. At this challenging time this system is providing many of the answers yacht owners need to enable them to conduct online business and leisure activities safely and securely.”

• We hacked a ship. The owner is liable.
  in Communications & Cyber Security

  Author: Ewan Robinson, director of maritime communications and solutions provider Yangosat. 

  We hacked a ship. The Owner is Liable.

  Well, we hacked the communications system of the ship. Technically we have been doing this for a few years.

  This time we did it like a “bad guy” would.

  We got into the vessel, belonging to a multinational company, and found out everything possible about the system, the setup, the manufacturers information.

  This is a very specialised vessel that was alongside in the capitol city of a major European country, carrying out cargo discharge.

  We could have broken the system so badly, the vessel would have been back to Sat-C and flag signals.

  Any information going through that satcomm would have been able to be collected, checked and used.

  As we are Ethical Hackers, we are obliged to act in certain ways. One of them is that we have to tell everyone involved if we did something during testing.

  We did. Well, we tried to.

  The Owners operators, when we finally managed to get someone in the overworked operations department to listen, didn’t care and ignored us.

  The manufacturers didn’t even bother to respond.

  All of the test was documented, peer reviewed and otherwise substantiated by trusted persons.

  The lawyers are going to have a field day and be very happy.

  Ship owners are not.

  Owners and operators are being badly supported and advised by these super providers, who use third party engineers, or poorly trained engineers, and leave systems in an exposed state. Equipment manufacturers and developers are so guilty of poor techniques and security that using “industry best practice” is a total contradiction.

  Lawyers, P&I and Class are going to be so busy refusing claims in the event of a cyber incident, that the poor owners are not going to know where to turn.

  Owners are forced into accepting sub-standard equipment. This equipment cannot be made secure in its current format, and yet the manufacturers and developers, fail to update and secure them.

  The providers supply this equipment, along with the bandwidth and engineers who install them, and then incorrectly configure and allow public access to them. The Owner is still liable.

  So how were they failed?

  We have been presenting at various conferences over the last few years, highlighting how exposed we are as an industry to ‘hackers’ and bad actors.

  It normally consisted of a prepared victim vessel, using a system that had been poorly configured by the provider, or the providers appointed/trained engineer, and accessing the equipment onboard, normally the antenna or satcomm system. It’s a quick way to display to an audience just how much we are ‘displaying publicly’.

  recently someone asked “what could someone actually do?”

  A relevant question we thought, so we tested to see what we could actually do.

  As a basic attack, an intruder could lock out all the users from accessing the equipment. They could turn off the satcom, or prevent systems and users onboard gaining access to the internet or to systems onshore or stop onshore reaching the vessel.

  OK, so this is annoying and disruptive, costing from a few hundreds to several tens or hundreds  of thousands if the charterer deems “off hire” status due to lack of communications.

  Well, that’s quite expensive, potentially.

  But what can we learn from the systems we can get at?

  A lot.

  Given the amount of systems that are exposed to the internet, with poor configuration, it is relatively easy to find a ‘victim’, and to maximise the information gained by using the tools available and exposed by the simplest of mistakes.

  Default admin passwords.

  There is a need for it, but no excuse for it.

   Service Providers, who manage several thousands of vessels, still use engineers who leave default admin usernames and passwords.

   So, it’s a fault on one vessel, but it cant really hurt can it?

  It can. And it does.

   Our target vessel was found.

  That took 7 minutes to locate.

  It belonged to a very large multinational corporation. The default username and password was still in effect on the VSAT system.

  Access was made to the administration area, so all usernames and passwords could be changed. Also available was access to the system by FTP. Even if this had not already been enabled, as we were in the Admin area, we could have enabled it.

   This is where major security flaw #1 was found. The FTP access gave access to the entire operating system of the device, not just the FTP area.

  Major security flaw #2 was putting a text file in every folder with a map of the entire structure of the operating system.

  This allowed for finding and copying the ‘hidden’ password file to our local machine. It was actually encrypted.

   2 hours later, it wasn’t.

  So now we had all the manufacturers usernames and passwords.

   Now we can access the publicly available machines where they have changed the default admin username and password, by using the manufacturers. They have these so the engineers can always get in. Great for business and support, not so for security.

   The network connections listed in the antenna setup were then investigated.

   The VSAT Modem was accessed, again using default connections on SSH, with publicly available usernames and passwords.

  Command line access to the modem was achieved, allowing us to take control and alter the configuration. In effect we could now control the communications in 2 different places.

   Such systemic failures, at the developmental and operational level, are going to have huge issues when Cyber 2021 comes into force next year.

  Class and P&I will be left wondering who to refuse claims and who to sue for negligence when there are events, while the operators are trusting the providers to implement correctly, and the manufacturers and developers are failing at such basic levels, they will likely be left with the legal responsibility in the first instance.

  The lesson of life in todays marine communications environment?

  Don’t trust what’s being given to you.

  Unless you have had your own trusted IT check what’s gone before, why would you blindly trust a stranger with your vessels now?

  The Owner is Liable.

  Yangosat is a maritime communications and solutions provider, helping shipowners and providers realise new systems and invigorate existing ones. This article has been reproduced with the author's permission. 

   

• NSR: Maritime satcom buoyed by broadband demand despite COVID-19 impact
  in Communications & Cyber Security

  

  Northern Sky Research (NSR) has published the 8^th edition of its Maritime SATCOM Markets report that finds mixed impact to Maritime Satcom Markets in the near-term, a challenging middle period, yet optimism for longer-term sector health.

• Satcom Global launches Aura crew calling initiative
  in Communications & Cyber Security

  Satcom Global has announced a crew calling initiative which is providing free telephone vouchers to each of its Satcom Global Aura VSAT customers, as part of efforts to support seafarer welfare during the COVID-19 pandemic.