CyberAbc 290 Report post Posted November 1, 2013 Avast! New hacks could steer ships into pirates’ grasp Researchers presenting at the Hack in the Box conference in Kuala Lumpur have presented more ways in which a standard ship communication system can be used for ill—potentially forcing vessels to divert from their course and steer into danger. The findings have been presented to the International Telecommunications Union in an attempt to press for fixes. The Automated Identification System (AIS), an international system for broadcasting ship location information and signals regarding navigation, safety, and weather, has already been cited by previous researchers because attackers can spoof messages into the system or jam its Internet-based backbone with DoS attacks. But Trend Micro's Dr. Marco Balduzzi and Kyle Wilhoit, along with independent security researcher Alessandro Pasta, demonstrated a number of new attacks on AIS using low-cost hardware. These hacks of AIS could be used by pirates or others who want to disrupt shipping to misdirect ship's crews or make ships drop off the AIS system altogether. One attack uses the "man-in-the-water" alert sent by an emergency transmitter as a lure to pull ships off course. The researchers demonstrated a Python script that can spoof the data from an AIS transmitter and send it to ships, potentially luring would-be rescuers to a location. Other AIS spoofs could trigger ship's collision alert systems, send fake weather alert data to ships, or even command a ship's AIS system to switch to an unmonitored frequency—making it "disappear" from the network. The hardware used to demonstrate these attacks was a €500 ($674) software-defined radio, but Balduzzi said that "it's possible to do it by using a VHF radio that costs around €100 ($134)—a price that makes the technology accessible to almost anyone (including pirates)." Share this post Link to post Share on other sites
