From Click to Sink: Utilizing AIS for Command and Control in Maritime Cyber Attacks

Abstract

The maritime domain is among the critical sectors of our way of life. It is undergoing a major digital transformation introducing changes to its operations and technology. The International Maritime Organization urged the maritime community to introduce cyber risk management into their systems. This includes the continuous identification and analysis of the threat landscape. This paper investigates a novel threat against the maritime infrastructure that utilizes a prominent maritime system that is the Automatic Identification System (AIS) for establishing covert channels. We provide empirical evidence regarding its feasibility and applicability to existing and future maritime systems as well as discuss mitigation measures against it. Additionally, we demonstrate the utility of the covert channels by introducing two realistic cyber attacks against an Autonomous Passenger Ship (APS) emulated in a testing environment. Our findings confirm that AIS can be utilized for establishing covert channels for communicating Command & Control (C&C) messages and transferring small files for updating the cyber arsenal without internet access. Also, the establishment and utilization of the covert channels have been found to be possible using existing attack vectors and technologies related to a wide range of maritime systems. We hope that our findings further motivate the maritime community to increase their efforts for integrating cyber security practices into their systems.

Literature review on maritime cybersecurity: state-of-the-art

“…Scholars, industry experts, and government and municipal authorities have jointly advocated for more solid cybersecurity checks and balances in every part of the maritime system, navigator competency enhancement (Hareide et al, 2018;Akpan et al, 2022) to recognise and deal with cyber-attacks appropriately, and a build-up of synthetic reliable systems, including raising awareness of cybersecurity, improving the competence of involvers, maintaining robustness risk estimation framework, deploying confrontational methodologies and models, and designing flexible counterpart plans (Amro and Gkioulos, 2022). It is essential to develop the incentive to actively collect cyber-attacks evidence with scrutiny of every part of the maritime shipping industry under every minor or significant threat.…”

Electronic Attacks as a Cyber False Flag against Maritime Radars Systems

“…Leite Junior et al [29] describe an attacker using the electromagnetic spectrum to send a sequence of forged pulses for commanding and controlling the attacks executed by an onboard cyber component. Amro et al [30] also show that an attacker can establish similar covert channels with the Automatic Identification System (AIS) radio frequencies. Although they do not refer to radar attacks, the authors exploit a link between electronic and cyber domains like our threat model.…”