# Cyberattack Models for Ship Equipment Based on the MITRE ATT&CK Framework
## 3 MITRE ATT&CK-Based Ship Cyberattack Analysis
### Mitre Att?CK-Based Ship Cyberattack Cases

Table 2: _Cont._The IRGC planned the attack in three phases. The first step is to determine the model of the marine satellite communication equipment that can access a ship at sea from the land through an IoT search engine. Thuraya and Widgeye, which are manufacturers of marine satellite communication equipment in the UAE and Singapore, respectively, were mentioned. As of July 2021, 43 BWMS models have obtained type approval, and an adversary could select one of these models as a target. Because systems mounted on ships undergo mandatory approval, it is easy to obtain the manufacturer and model information. This step corresponds with _Reconnaissance_. The Thuraya devices mentioned in the report have hardcoded credentials vulnerabilities that have been identified in CVE-2013-6034 and CVE-2013-6035. Ship equipment is more difficult to update and patch than information technology equipment. Many ships still in service may have this vulnerability. This step corresponds with _Resource Development_. The adversary can gain access to the ship's network through a known valid account, which can also be executed remotely, and corresponds with _Initial Access_. The next step involves modulating the data collected and processed by the BWMS system from the marine satellite communication terminal inside the hull. A PC is connected to the control and monitoring system that manages the BWMS on board. The BWMS of the internal network should be accessible from the marine satellite communication terminal, and hence the terminal and BWMS are connected by the same network. This step corresponds with _Lateral Movement_. During the analysis in this study, a new threat corresponding with the _Reconnaissance_ phase was discovered. A scene showing the password (\"1111111\") to the ship's BWMS was uploaded by a crew member to a social network service and identified (Figure 2). This information is useful to an adversary. Other media uploaded by this crew member included information such as the name of the ship and onboard equipment, which could make it a target. The first step would be to execute a sinking scenario, which requires identifying the attack vector for the attack surface of the BWMS. As mentioned in the report, in terms of cybersecurity, this is explained by the attack surface and vectors that affect the BWMS system and cause physical sinking. In terms of hardware, the attack interferes with the accurate operation of the pump and pressure gauge by inducing sensor malfunction or blocking/modulating sensor status information. This step corresponds with _Command and Control_. In terms of software, the attack corrupts the management server file system or causes server errors. A file tampering attack is required if the pump management software is updated. This step corresponds with _Impact_. Table 3 shows an analysis of the plan devised by the Intelligence Team 13 in terms of an MITRE ATT&CK. Figure 3 shows the overall flow of the attack. Figure 2: BWMS password exposure via SNS images of the crew. (2) Use Case 2: INS Attack [17]  
The INS is a system that integrates and manages multiple devices connected with the ship radar, ECDIS (an electronic chart system), sonar, and GPS. Integrity among the systems is important for ships to operate on a normal route. A method was proposed for conducting an attack on the INS while the attacker is on board. System information is obtained by physically accessing a laptop with the ECDIS software installed, and the operating system information, the ship's network IP, and the port number are identified.