# Cyberattack Models for Ship Equipment Based on the MITRE ATT&CK Framework
## 3 MITRE ATT&CK-Based Ship Cyberattack Analysis
### Mitre Att?CK-Based Ship Cyberattack Cases
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Tactic** & \multicolumn{2}{c}{**Description**} \\ \hline \multirow{6}{*}{_Reconnaissance_} & \(\bullet\) & The adversary obtains information on the equipment of the target ship. \\  & \(\bullet\) & The adversary searches for marine satellite communication equipment. \\  & & Attackers can utilize IoT search engines. Examples of search keyword in \\  & & censys: services.banner = “salitor 600” \\  & \(\bullet\) & The adversary obtains the BWMS password through the Social Network \\  & & Service of the crew member (Figure 3). \\ \hline \multirow{6}{*}{_Resource Development_} & \(\bullet\) & The adversary identifies the known vulnerabilities of maritime satellite communication terminals (CVE-2013-6034, CVE-2013-6035). Some \\  & & satellite communication devices can be accessed using TCP port 1827 \\  & & without authentication. \\  & & The adversary identifies a valid account at the maritime satellite communication terminal. Some devices use the default \\  & & account (“admin”). \\ \hline \multirow{2}{*}{_Initial Access_} & \(\bullet\) & The adversary accesses the onboard network with a valid account. \\ \hline \multirow{2}{*}{_Lateral Movement_} & \(\bullet\) & The adversary accesses the BWMS via the onboard network. \\ \hline \multirow{6}{*}{_Command and Control_} & \(\bullet\) & The adversary attacks the BWMS attack surfaces. \\  & & \(\bullet\) & The adversary executes the BWMS attack vectors. \\ \cline{1-1}  & & \(\bullet\) & The adversary modulates the pump data (running the port side pump or \\ \cline{1-1}  & & the starboard side pump). \\ \cline{1-1}  & & \(\bullet\) & The adversary turns off the pump alarm. \\ \hline \multirow{2}{*}{_Impact_} & \(\bullet\) & The ship sinks. \\ \cline{1-1}  & & \(\bullet\) & The ship capsizes. \\ \hline \hline \end{tabular}
\end{table} 
Table 3: MITRE ATT&CK analysis results for attack case 1. Figure 3: Scenario of attack case 1. This step corresponds with the _Reconnaissance_ phase. Its aim is to modulate the Winosock dynamic link library (DLL) file for an MiTM attack on the ECDIS software. The target is an NMEA command. NMEA is a CAN-based protocol and has no safeguards, such as encryption. The protocol only involves a checksum, and the checksum can be easily bypassed. This step corresponds with the _Command_ and _Control_ phases. The adversary injects the payload stored on the USB into the ECDIS. This software has a built-in function to prevent keyboard inputs, allowing only mouse operations. However, the \"Windows + R\" keyboard shortcut can be used. An on-screen keyboard can be used for the keyboard input. It is possible to run commands on the operating system and have an administrator log into the ECDIS. This step corresponds with the _Defense Evasion_ phase. Some ECDISs use a factory default password, 0000. This step corresponds with the _Defense Evasion_, _Persistence_, _Privilege Escalation_, and _Initial Access_ phases. A MITRE technique can correspond to multiple tactical phases. The adversary runs the payload from the USB. This step corresponds with the _Persistence_ and _Privilege Escalation_ phases. This tricks the ECDIS software into loading a fake Winosock DLL in a running operating system using administrator privileges. This step corresponds with the _Initial Access_ phase. A fake Winosock DLL is then copied and installed. This step corresponds with the _Execution_ phase. The folder and registry of the ECDIS software are then updated. A fake Winosock DLL modulates the NMEA data or causes an ECDIS to \"blue screen\" when certain waters are reached. This scenario exhibits an air gap method that enables physical access, and the navigation system of the ship can be manipulated. It is possible to make the ship sail off course or go to the wrong destination by altering the NMEA text. Alternatively, the ship could move to shallow waters and be stranded. This step corresponds to the _Command_ and _Control_ phases.