# Cyberattack Models for Ship Equipment Based on the MITRE ATT&CK Framework
## 3 MITRE ATT&CK-Based Ship Cyberattack Analysis  
Since IOActive [17] researchers conducted a vulnerability assessment study on ship black box systems in 2014, various types of vulnerability analyses and studies on the hacking of the communication, navigation, and steering management systems on ships have been published. This section analyzes ship hacking techniques reported in academia and by the maritime industry. Using MITRE ATT&CK analysis, the attack process and attack characteristics of each hacking technique are analyzed and organized using a consistent framework. [PERSON] [4] described the backdoors, hardcoded credentials, insecure protocols, undocumented protocols, and password reset weaknesses found in satellite communication terminals, further describing the falsification scenarios for ECDIS, ship status information, and cargo information based on the security vulnerabilities associated with SAILOR 900 VSAT (Cobham, Denmark) and JUE-250 FB (Japan Radio Co. Ltd., Tokyo, Japan) terminals. Various cyberattack threats to ship AIS systems were classified by [PERSON] et al. [16], who argued that AIS malfunction, AIS jamming, and spoofing were the most commonly found attack types. In addition, [PERSON] et al. [18] described a cyberattack scenario arising from integrated navigation systems (INSs), electronic chart display, and information systems. In this scenario, the malware modifies the Global Positioning System (GPS) coordinates with an MiTM attack. The attack causes the ship's system to crash to a \"blue screen\", or the ship sails to different coordinates. [PERSON] et al. [7] performed a quantitative cyber risk assessment using a security vulnerability scanning tool on the JAN-901B ECDIS system (Japan Radio Co. Ltd., Tokyo, Japan), which was installed on the Japanese training ship _Fukae-maru_. The interface of this system consisted of an Ethernet local area network (LAN; 10/100 Mbps) and IEC61162-1/2, USB, and was run on a Windows XP system. Ten threats were found as a result. [PERSON] et al. [19] further performed a security vulnerability assessment for a Transas Navi Sailor 4000 ECDIS installed on a Windows 7 operating system using a vulnerability \begin{table}
\begin{tabular}{c p{142.3 pt}} \hline \hline
**Tactic** & **Description** \\ \hline _Reconnaissance_ & The adversary attempts to gather information they can use to plan future operations. \\ \hline _Resource Development_ & The adversary attempts to establish resources they can use to support operations. \\ \hline _Initial Access_ & The adversary attempts to gain access to the target network. \\ \hline _Execution_ & The adversary attempts to run malicious code. \\ \hline _Persistence_ & The adversary attempts to maintain their progress. \\ \hline _Privilege Escalation_ & The adversary attempts to obtain higher-level permissions. \\ \hline _Defense Evasion_ & The adversary attempts to avoid detection. \\ \hline _Credential Access_ & The adversary attempts to steal account names and passwords. \\ \hline _Discovery_ & The adversary attempts to determine the target environment. \\ \hline _Lateral Movement_ & The adversary attempts to move through the target environment. \\ \hline _Collection_ & The adversary attempts to gather data of interest to their goal. \\ \hline _Command and Control_ & The adversary attempts to communicate with compromised systems to control them. \\ \hline _Exfiltration_ & The adversary attempts to steal data. \\ \hline _Impact_ & The adversary attempts to manipulate, interrupt, or destroy the target systems and data. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: MITRE ATT&CK tactics. scanning tool in the ECDIS software practice environment of a university. Vulnerable versions of SMB and Remote Desktop Protocol (RDP) used in the system were described as a critical vulnerability. [PERSON] et al. [20] performed a security vulnerability assessment using a scanning tool on the Navi Sailor 4000 ECDIS (Wartsila Transas, Finland), installed on the training/research ship _Kraljica Mora_.