According to an article published in Freight Waves, email phishing tactics have been added to the list of methods being used by outsiders to hack into commercial cargo vessel operations and navigation information.
Safety bulletin issued
Based on a maritime regulators report and a safety bulletin published by the U.S. Coast Guard (USCG) on May 24, “adversaries are attempting to gain sensitive information including the content of an official Notice of Arrival (NOA)” in requests that use email addresses posing as official Port State Control (PSC) authorities.
Foreign vessels’ urged to file NOA
Foreign vessel operators are required file NOAs at least four days in advance of arrival at a U.S. port to allow the USCG to prioritize vessel inspections.
In addition, the agency said it also recently received reports of malware “designed to disrupt shipboard computer systems.” A malware attack was used by hackers to infiltrate the operations of container shipping giant Maersk two years ago, which ended up indirectly affecting FedEx.
Validity of the sender to be verified
Vessel operators and land-side ship company managers should be verifying the validity of email senders before responding to unsolicited emails, the USCG asserted in the bulletin.
“If there is uncertainty regarding the legitimacy of the email request, vessel representatives should try contacting the PSC authority directly by using verified contact information,” is recommended. “Additionally, vessel owners and operators should continue to evaluate their cyber defense measures to reduce the effect of a cyber-attack.”
Suspicious activities reported
Despite the latest attacks, the USCG noted that vessel masters have been reporting suspicious activity to its National Response Center, in accordance with federal regulations, which is helping the agency to identify and counter cyber threats around the world.
Coast Guard officials were not immediately available to provide more details on the latest cybersecurity attacks.
Awareness of cyber risk
U.S. Representative John Garamendi (D-California), a member of a subcommittee that oversees the U.S. Coast Guard, said at a public forum in April that there is not enough attention being paid to the growing cyber risks in the maritime sector, including the spoofing of vessel GPS devices.
Continuous GPS interference
The USCG warned in October and November of 2018 that “significant” GPS interference continues to be reported by vessels operating in the eastern Mediterranean Sea, concentrated near Port Said, Egypt; the Suez Canal; and near Jeddah Port, Saudi Arabia. “This interference is resulting in lost or otherwise altered GPS signals affecting bridge navigation, GPS-based timing, and communications equipment,” the agency stated at the time.
Strategic plan to address vulnerability
Apart from the most recent safety bulletin warning of the renewed threats, the USCG is attempting to address cybersecurity vulnerability by sharing prevention procedures with maritime companies, as outlined its four-year (2018-2022) strategic plan.
As part of a directive from the International Maritime Organization, it will also ensure that shipowners address cyber risks within their vessels’ safety management systems by 2021.
Did you subscribe to our daily newsletter?
It’s Free! Click here to Subscribe!
Source: FreightWaves
