# Cybersecurity Challenges in the Maritime Sector
## 4 Cyberattack Cases from the Maritime Transport Sector  
Increased automation and artificial intelligence appear to be opening up new avenues for cyberattacks against the shipping industry, which has experienced serious cybersecurity incidents in recent years [24; 49; 50]. The technology needed to \"spoof\" a vessel is not expensive and us becoming easier to find and download online. Spoofing incidents have already been reported in the Black Sea, where a number of ships reported anomalies with their GPS-derived position and found themselves apparently located at an airport [51]. In the same area as the incident above, a ship was also exposed to GPS spoofing. The ship was at sea, but the geolocation system onboard claimed that the ship was on land [33]. Moreover, ship collisions and sea accidents due to the malfunction of navigation systems have been observed many times [52; 53; 54]. In May 2017, a spoofing attack led to a collision between a U.S. Navy ship and a South Korean fishing boat [53]. In February 2017, an 8250 Twenty-Foot Equivalent Unit (TEU) vessel was completely hacked in route from Cyprus to Djibouti [54]. For about 10 h, the attacker took over the ship's navigation system and the captain was helpless to do anything to put the ship back into operation. In a previous GPS jamming attack, more than 280 vessels were reported by South Korea to have experienced navigational system issues; the GPS signal was jammed by hackers, causing some GPS signals to die and others to receive incorrect data [55]. When GPS fails to function properly, there is a very high risk of a disaster with catastrophic consequences for the crew, the ship, and the environment. In a recent incident [56], the onboard control system network of a U.S. vessel was infected with malware. This network is usually used to update electronic charts, manage cargo data, and communicate with shore-side facilities. The FBI reported that the lack of security strategies on the vessel was the main reason for such an attack, which caused critical credential mining of the vessel's control systems. In another similar incident, hackers remotely compromised the onboard computers of a U.S. Navy contractor, stealing massive amounts of highly sensitive data (614 GB) [57]. In recent years, the shipping industry has become an attractive target for ransomware attacks due to a perceived lack of investment in cybersecurity and the potential for significant operational disruptions [33]. In 2020, \begin{table}
\begin{tabular}{l l l} \hline \hline
**Systems** & **Vulnerabilities** & **Consequences** \\ \hline Propulsion and & - Malware attack & - Ship hijacking \\ machinery & - DoS/DDoS attacks & - Diversion of the ship \\ management & - Smuggling & - PS could be interrupted \\ and power & - Stealing & - Ship damage \\ control systems & - Manipulation attacks & - Financial damage \\  & & - Disclosure of sensitive data \\ \hline Very Small & - Fake signals & - Theft of sensitive data \\ Aperture Terminal & - Malware attack & - Upload of malware \\ (VSAT) & - Stealing & - Change of GPS coordinates \\ \hline  & - Poor access control & - Upload malware \\  & - DoS/DDoS attacks & - Unauthorised physical access \\  & - Weak password policies & - Unauthorised logical access \\  & - Malware attacks & - Loss of confidential documents \\  & - Poor patch management & - Financial damage \\  & - Improper security configuration & - Theft of sensitive data \\ IT network & - Poor security documentation & - Reputation damage \\ systems & - Lack of network segmentation & \\  & - Lack of firewalls & \\  & - Lack of encryption & \\  & - Weak remote access policies & - Weak USB policy \\  & - Lack of training for SOS & \\ \hline \hline \end{tabular} OS: Operating System. NS: Navigational System. ACM: Access Control Management. SO& Secure Operations of the System. PS: Propulsion System.  
\end{table} 
Table 2: \(Cont.\)two ships were infected by the ransomware Hermes 2.1 via the AZORult trojan.