# Cyberattack Models for Ship Equipment Based on the MITRE ATT&CK Framework
## 3 MITRE ATT&CK-Based Ship Cyberattack Analysis
### Mitre Att?CK-Based Ship Cyberattack Cases
Table 7 describes the results of the analysis by the MITRE ATT&CK for ICS for the communication system. Table 8 shows the results of the analysis by the MITRE ATT&CK for ICS for the propulsion, machinery, and power control systems. Finally, Table 9 shows the results of the analysis by the MITRE ATT&CK for ICS for the navigation system. Figure 4: Scenario of attack case 2. Figure 5: Scenario of attack case 3. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Type** & & **System** \\ \hline \multirow{4}{*}{_Communication Systems_} & \(\bullet\) & Satellite communication system \\  & \(\bullet\) & Integrated communication system \\  & \(\bullet\) & Voice over internet protocol \\  & \(\bullet\) & Wireless LAN \\ \hline \multirow{4}{*}{_Propulsion, Machinery and Power_} & \(\bullet\) & Engine governor system \\  & \(\bullet\) & Fuel oil system \\  & \(\bullet\) & Alarm monitoring and control system \\  & \(\bullet\) & Power management system \\  & \(\bullet\) & Emergency generator and batteries \\ \hline \multirow{4}{*}{_Navigation Systems_} & \(\bullet\) & ECDIS \\  & \(\bullet\) & RADAR \\  & \(\bullet\) & AIS \\  & \(\bullet\) & GPS \\  & \(\bullet\) & Dynamic Positioning System \\  & \(\bullet\) & Global Maritime Distress and Safety System \\  & \(\bullet\) & VDR \\ \hline \multirow{2}{*}{_Cargo Management System_} & \(\bullet\) & Cargo control room \\  & \(\bullet\) & Ballast water system \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Ship OT system types and their components. \begin{table}
\begin{tabular}{c c} \hline \hline
**Tactic** & **Description** \\ \hline \multirow{2}{*}{_Command and Control_} & \(\bullet\) & The use of a weak protocol is susceptible to data falsification. \\  & \(\bullet\) & The adversary attacks vulnerable protocols such as HTTP and TELNET. \\ \hline \multirow{2}{*}{_Lateral Movement_} & \(\bullet\) & The adversary takes advantage of the default settings and passwords set by the manufacturer on the ICS system device. \\  & \(\bullet\) & The factory default password is written in the manual. \\ \hline \multirow{2}{*}{_Execution_} & \(\bullet\) & The adversary attacks the web interface used on the ship. \\ \hline \multirow{2}{*}{_Initial Access_} & \(\bullet\) & The adversary executes targeted phishing attacks on crew members using malware. \\ \hline \multirow{2}{*}{_Discovery_} & \(\bullet\) & Network eavesdropping on Voice over Internet Protocol (VoIP) can expose sensitive information. \\ \hline \multirow{2}{*}{_Inhibit Response Function_} & \(\bullet\) & It is difficult to rapidly update software for OT systems. \\  & \(\bullet\) & The denial-of-service attack on VoIP disrupts hull communication. \\ \hline \multirow{2}{*}{_Impact_} & \(\bullet\) & Communication failure occurs. \\  & \(\bullet\) & The ship collides. \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Communication system analysis results. Figure 6: Attack scenario using CVE. Auto-Maskin remote panels (RPs) and DCU control units were used to control and monitor ship engines. The adversary can attempt to use the factory default password (DCU/1234) from the manual of the RP 210E product installed on the bridge or use CVE-2018-5401 and CVE-2018-5402 to gain access without permission. In DCU 210E, CVE-2018-5400 can be used for spoofing or relay attacks with Modbus-TCP. Arbitrary messages can be sent to DCU or RP devices remotely without entering the engine room.