# Cyberattack Models for Ship Equipment Based on the MITRE ATT&CK Framework
## 3 MITRE ATT&CK-Based Ship Cyberattack Analysis
### Mitre Att?CK-Based Ship Cyberattack Cases  
We examined ship cyberthreats through a review of the literature. Based on this review, four cases with high impacts of cyberattacks on ships were selected. Case 1 is a ship sinking, Cases 2 and 3 are the wrong route, and Case 4 is an attack on the ship control system. MITER ATT&CK is described as TTPs (tactics, techniques, procedures). We analyzed the threats of the investigated ship systems, mapped them with techniques, and mapped the tactics and procedures connected to them. This explains the mitigation, as well. The four cases are as follows:  
* Case 1: the IRGC plan to attack and sink ships;
* Case 2: cyberattacks on the INSs on ships, analyzed using the MITRE;
* Case 3: security vulnerabilities of the ECDIS of real training ships;
* Case 4: a threat analysis report of a ship's OT system. 1. Use Case 1: The IRGC BWMS Cyberattack Plans to Cause a Ship to Sink or Overturn  
A cyberattack report created by the Intelligence Team 13 of the IRGC was revealed [10] that includes methods for hacking the BWMS on a ship to sink it. The BWMS system consists of a tank installed at the bottom of the ship as well as on the left and right sides of the hull to maintain the ship's center of gravity when the ship is operating. A pump is used to fill or empty the tank with seawater. Under international law, its installation is mandatory to avoid environmental contamination, such as ecosystem disruption caused by the ballast water stored in the tank. The ship's pumps are controlled by the Human Machine Interface (HMI) and can be monitored onshore through a satellite communication system. The report studied methods of intrusion from publicly available information. There have been cases of similar attacks. In December 2020, an Iranian hacker group hacked Israel's water facility industrial control system (ICS) and released a video that showed them accessing the HMI system. In this system, the Modbus/TCP port 502 was open to the Internet, and it was vulnerable to unauthorized access. The adversary was able to manipulate the water pressure and temperature [32]. This example supports the prediction of attacks on the BWMS of a ship. A plan devised by a cyberattack force to hack a ship and inflict physical damage is threatening. A BWMS is generally installed on bulker and tanker ships. To prevent the ship from capsizing when it is tilted, the BWMS pump must operate with precision, and failure of this system may cause the ship to sink. The attack begins by sending commands remotely from land to the ship via maritime satellite communications equipment. This attack would use a Seagull 5000i and Sealink CIR, which are marine satellite communication devices mounted on ships. Onboard and onshore connections have increased with the increasing need to access ships remotely. \begin{table}
\begin{tabular}{c c c c} \hline
**System** & **Threat** & **Impact** & **Reference** \\ \hline \multirow{8}{*}{other} & Designed without security, malicious & \multirow{2}{*}{Hijacking, smuggling, theft} & [PERSON], [PERSON] et al. [29] \\  & version, malware & & \\ \hline \multirow{8}{*}{other} & NMEA: unencrypted message & Injection of fake messages & \multirow{2}{*}{[PERSON] et al. [24]} \\  & DoS attacks & System shutdown & \\ \cline{1-1}  & Inaccurate ENC file & \multirow{2}{*}{Sinking of the ship} & \multirow{2}{*}{[PERSON] and [PERSON] [23]} \\ \cline{1-1}  & Default account and password & Elevation privilege & [PERSON] et al. [26] \\ \cline{1-1}  & Default password and the & Access system inside the ship & \multirow{2}{*}{[PERSON] et al. [27]} \\ \cline{1-1}  & passenger’s Wi-Fi & Information intercept & \\ \cline{1-1}  & Described the risk levels of these attack surfaces using risk & \multirow{2}{*}{[PERSON] et al. [8]} \\ \cline{1-1}  & assessment methodologies & & \\ \cline{1-1} \cline{2-2} \multirow{2}{*}{Proposed a risk assessment method for ship control systems using fuzzy & \multirow{2}{*}{[PERSON] et al. [22]} \\ \cline{1-1}  & sets and attack trees & & \\ \hline \end{tabular}
\end{table}