# Cyberattack Models for Ship Equipment Based on the MITRE ATT&CK Framework
###### Abstract  
Cybersecurity is important on ships that use information and communication technology. On such ships, the work, control, and sensor systems are connected for steering, navigation, and cargo management inside the hull, and a cyberattack can have physical consequences such as sinking and crashing. Research on ship cybersecurity is a new challenge, and related studies are lacking. Cyberattack models can provide better insight. With this study, we aim to introduce a cyberattack analysis method based on the MITRE ATT&CK framework so that a cyberattack model for ships can be established. In addition, we identify the characteristics of the attack phase by analyzing cases of hacking and vulnerability research for ship systems using tactics, techniques, and procedures, and suggest the minimum measures essential for defense. Using the ship cyberattack model, we aim to identify the characteristics of the systems used for ship navigation, communication, and control; provide an understanding of the threats and vulnerabilities; and suggest mitigation measures through the proposed model. We believe the results of this study could guide future research. maritime cybersecurity; cyber threat; MITRE ATT&CK; information sharing; security risk analysis +
Footnote †: journal: Sensors  
0000-0001-5000-0000-0000-0000-0000-0000-0000-0000-00000-00000-00000-0000-00000-00000-00000-00000-00000-00000-00000-00000-00000-00000-00000-0000-00000-0000  
2014, [PERSON] also discovered a vulnerability that could enable data in the voyage data recorder (VDR), which acts as a black box on a ship, to be tampered with remotely. In 2017, a security company researcher explained that a defect in the web application of CommBox, a Norwegian maritime satellite communication terminal produced by KVH Industries, could leak crew and ship information (such as the Automatic Identification System (AIS) information), which could lead to spear phishing attacks based on the personal information of the crew. In 2019, the United States Coast Guard (USCG) issued a marine alert after confirming that the onboard network of a container ship sailing into New York Port was infected with malware and unable to operate [5; 6]. In 2019, a security vulnerability assessment of the Electronic Chart Display and Information System (ECDIS; version JAN-901B) mounted on a Japanese training ship discovered vulnerabilities in the server message block (SMB) used by Windows Embedded, an outdated operating system, which allowed remote attacks [7]. An investigation and quantification of the attack surfaces of ships in 2019 found that the email, NMEA 0183 protocol, ECDIS, AIS, Ship Planning System, Cobham Satcom terminal, and VDR used by crews were the attack surfaces posing the highest risk [8]. In 2021, the risk level of the network protocols NMEA 2000, NMEA 0183, and AIS used in the steering and navigation systems of ships was described to be higher than that of general TCP/IPv6 with respect to attack types such as denial-of-service (DoS) attacks, spoofing attacks, packet sniffing attacks, and relay or man-in-the-middle (MiTM) attacks [9]. In 2021, the Islamic Revolutionary Guard Corps (IRGC) investigated how to sink ships through a cyberattack on the ballast water management system (BWMS) [10]. Since the 2021 incident, maritime-related organizations such as shipbuilders, ship owners, the IMO, and classification societies in various countries have announced laws and regulations regarding cybersecurity on ships. The IMO released the Maritime Cyber Risk Management in Safety Management Systems to manage maritime cybersecurity from 1 January 2021. The Classification Society has also introduced a type of approval process for cybersecurity frameworks.