# Cyberattack Models for Ship Equipment Based on the MITRE ATT&CK Framework
## 3 MITRE ATT&CK-Based Ship Cyberattack Analysis
### Mitre Att?CK-Based Ship Cyberattack Cases
The scenario is mapped using the MITRE matrix in Table 3. This attack scenario was executed in August 2018 by installing the ECDIS software for testing on a real ship in offshore waters off the coast of Norway. The ECDIS needs to periodically update the ENC file. Although marine satellite communication may also be used, many ships are still updated using a CD, DVD, or USB. An update using a USB, CD, or DVD infected with malicious code, e.g., autorun.inf, can automatically execute the malicious code. The analysis of this cyberattack is listed in Table 4 in terms of an MITRE ATT&CK, and Figure 4 shows the overall flow of the attack. operating systems. For instance, an adversary could use CVE-2019-0708. The service pack was not installed on the operating system, Windows XP Embedded, where the ECDIS software was installed. This corresponds with the _Lateral Movement_ phase. An analysis of the cyberattack is listed in Table 5 in terms of the MITRE ATT&CK. Figure 5 shows the overall flow of the attack. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Tactic** & & **Description** \\ \hline \hline _Reconnaissance_ & \(\bullet\) & The adversary acquires ship boarding rights. \\  & \(\bullet\) & The adversary physically accesses the ECDIS software. \\ \hline _Initial Access_ & \(\bullet\) & The adversary uses the ECDIS factory default password (pw: 0000) to gain access. \\ \hline \hline \multirow{6}{*}{_Defense Evasion_} & \(\bullet\) & A fake Windock DLL is loaded. : The procedure for performing a DLL injection attack is as follows.(1) Attach the process—(2) Allocate memory within the process—(3) Copy the DLL or DLL path to the process memory and determine the appropriate memory address—(4) Instruct the process to run the fake DLL. \\  & \(\bullet\) & The adversary injects the payload stored in the USB into the ECDIS. \\  & \(\bullet\) & The adversary activates the keyboard with the “Windows + R” \\  & & keyboard shortcut. \\ \hline _Execution_ & \(\bullet\) & A fake Winstock DLL is copied and installed. \\ \hline _Persistence_ & \(\bullet\) & The adversary executes the payload. \\ \hline _Collection_ & \(\bullet\) & The adversary modifies the Winstock DLL file for an MiTM attack by the ECDIS software. \\ \hline _Command and Control_ & \(\bullet\) & The ship goes off course because the NMEA command is altered. \\ \hline \multirow{3}{*}{_Impact_} & \(\bullet\) & The ECDIS is paralyzed (blue screen). \\  & \(\bullet\) & The ship is stranded. \\  & \(\bullet\) & The ship goes off course. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: MITRE ATT&CK analysis results for attack case 2. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Tactic** & & **Description** \\ \hline \hline _Resource Development_ & \(\bullet\) & The adversary boards the ship. \\  & \(\bullet\) & The adversary uploads the security vulnerability scanning tool. \\  & \(\bullet\) & The adversary scans network ports. \\ \hline _Initial Access_ & \(\bullet\) & The adversary installs the security vulnerability scanning tool. \\  & \(\bullet\) & The adversary performs installation via onboard network or USB devices. \\ \hline _Reconnaissance_ & \(\bullet\) & The adversary identifies the target ECDIS through port scanning. \\ \hline _Execution_ & \(\bullet\) & Network vulnerability scanning on ship networks is performed. \\ \hline _Discovery_ & \(\bullet\) & The adversary identifies a total of 37 security vulnerabilities. \\ \hline \multirow{6}{*}{_Lateral Movement_} & \(\bullet\) & The adversary runs the exploit code to attack the venerability \\  & (CVE-2019-0708). : This vulnerability is called the BlueKeep vulnerability. \\ \cline{1-1}  & & This means that if an unauthenticated attacker connects to the target \\ \cline{1-1}  & & system using the Remote Desktop Protocol (RDP) and sends an attack \\ \cline{1-1}  & & request, the code will be executed without permission. \\ \hline _Impact_ & \(\bullet\) & The adversary manipulates the ECDIS system operation data. \\ \hline \hline \end{tabular}
\end{table} 
Table 5: MITRE ATT&CK analysis results attack case 3.