Cookies help us deliver the best experience on our website. By using our website, you agree to our use of cookies Dismiss

New GTMaritime solution protects shipboard systems from cyber-threats before they emerge

Jamie Jones, operations director, GTMaritime. Image Courtesy of GTMaritime. Jamie Jones, operations director, GTMaritime. Image Courtesy of GTMaritime.

A new solution from GTMaritime counters a major cyber security weakness of ships at sea today by deploying critical software and security patches to protect shipboard systems before threats emerge. GTDeploy provides a software deployment platform to deliver security updates to ships wherever they are in the world ‘in the background’ without requiring intervention by IT staff or distracting crew.

{mprestriction ids="1,2"} Hackers actively exploit the lack of urgency given by organisations to updating software, even though software patch management can be as vital to cyber-risk management as overtly defensive measures such as email filtering, network segregation and unified threat management. GTDeploy has been designed to make patch management integral to the maritime IT environment.

GTDeploy supports automatic updating – as seen on smartphones – for pushing out software fixes as soon as a newer version becomes available. It can add, refresh or uninstall security updates, patches or entire applications and gives fleet IT managers the flexibility to prioritise updates based on urgency and chose when and/or where they take place.

GTMaritime head of operations, Jamie Jones, said: “Software updates get pushed down the list of priorities for a variety of reasons. Sometimes there are simply more immediate problems that need dealing with but often this is to do with pressure on budgets: the cost of sending someone out to a vessel may be hard to justify. GTDeploy removes that pressure.”

Whether updates are better performed when a vessel is under way or postponed until reaching port, GTDeploy allows applications to be managed through an intuitive drag-and-drop dashboard interface. Its use saves ship operators time and money by reducing the logistical burden of either manually updating every PC remotely or sending IT personnel or local agents to visit ships in person.

GTDeploy is airtime agnostic, which means it will function regardless of the type and capability of satellite communications set up on a ship. This is particularly relevant for mixed or managed fleets, where ships have different hardware and varying configurations. If an application needs additional library files, for example, these are fetched automatically and included in the transmission package.

GTDeploy helps vessel owners cope with the proliferation of software onboard as the industry embraces digitalisation and transitions to data-centric operating practices. “As the number of onboard systems multiply and complexity grows, so does the urgency and resources needed to maintain them,” said Jones.

GTDeploy paves the way for a more pro-active approach to managing onboard software, he adds. With cyber-security due to come under the scope of Safety Management System of the ISM Code from next January, vessel operators must demonstrate that robust and systematic processes are in place to address vulnerabilities and reduce exposure to malicious code. 

GTDeploy is built on FastNet, a data connectivity platform developed by GTMaritime to manage ship/shore data flow intelligently as shipping companies embrace and transition to a more digital way of working. It comprises a package of services for encrypting, compressing and prioritising data communications to make best use of the satellite link and available bandwidth. {/mprestriction}

Related items

  • We hacked a ship. The owner is liable.

    Author: Ewan Robinson, director of maritime communications and solutions provider Yangosat. 

    We hacked a ship. The Owner is Liable.

    Well, we hacked the communications system of the ship. Technically we have been doing this for a few years.

    This time we did it like a “bad guy” would.

    We got into the vessel, belonging to a multinational company, and found out everything possible about the system, the setup, the manufacturers information.

    This is a very specialised vessel that was alongside in the capitol city of a major European country, carrying out cargo discharge.

    We could have broken the system so badly, the vessel would have been back to Sat-C and flag signals.

    Any information going through that satcomm would have been able to be collected, checked and used.

    As we are Ethical Hackers, we are obliged to act in certain ways. One of them is that we have to tell everyone involved if we did something during testing.

    We did. Well, we tried to.

    The Owners operators, when we finally managed to get someone in the overworked operations department to listen, didn’t care and ignored us.

    The manufacturers didn’t even bother to respond.

    All of the test was documented, peer reviewed and otherwise substantiated by trusted persons.

    The lawyers are going to have a field day and be very happy.

    Ship owners are not.

    Owners and operators are being badly supported and advised by these super providers, who use third party engineers, or poorly trained engineers, and leave systems in an exposed state. Equipment manufacturers and developers are so guilty of poor techniques and security that using “industry best practice” is a total contradiction.

    Lawyers, P&I and Class are going to be so busy refusing claims in the event of a cyber incident, that the poor owners are not going to know where to turn.

    Owners are forced into accepting sub-standard equipment. This equipment cannot be made secure in its current format, and yet the manufacturers and developers, fail to update and secure them.

    The providers supply this equipment, along with the bandwidth and engineers who install them, and then incorrectly configure and allow public access to them. The Owner is still liable.

    So how were they failed?

    We have been presenting at various conferences over the last few years, highlighting how exposed we are as an industry to ‘hackers’ and bad actors.

    It normally consisted of a prepared victim vessel, using a system that had been poorly configured by the provider, or the providers appointed/trained engineer, and accessing the equipment onboard, normally the antenna or satcomm system. It’s a quick way to display to an audience just how much we are ‘displaying publicly’.

    recently someone asked “what could someone actually do?”

    A relevant question we thought, so we tested to see what we could actually do.

    As a basic attack, an intruder could lock out all the users from accessing the equipment. They could turn off the satcom, or prevent systems and users onboard gaining access to the internet or to systems onshore or stop onshore reaching the vessel.

    OK, so this is annoying and disruptive, costing from a few hundreds to several tens or hundreds  of thousands if the charterer deems “off hire” status due to lack of communications.

    Well, that’s quite expensive, potentially.

    But what can we learn from the systems we can get at?

    A lot.

    Given the amount of systems that are exposed to the internet, with poor configuration, it is relatively easy to find a ‘victim’, and to maximise the information gained by using the tools available and exposed by the simplest of mistakes.

    Default admin passwords.

    There is a need for it, but no excuse for it.

     Service Providers, who manage several thousands of vessels, still use engineers who leave default admin usernames and passwords.

     So, it’s a fault on one vessel, but it cant really hurt can it?

    It can. And it does.

     Our target vessel was found.

    That took 7 minutes to locate.

    It belonged to a very large multinational corporation. The default username and password was still in effect on the VSAT system.

    Access was made to the administration area, so all usernames and passwords could be changed. Also available was access to the system by FTP. Even if this had not already been enabled, as we were in the Admin area, we could have enabled it.

     This is where major security flaw #1 was found. The FTP access gave access to the entire operating system of the device, not just the FTP area.

    Major security flaw #2 was putting a text file in every folder with a map of the entire structure of the operating system.

    This allowed for finding and copying the ‘hidden’ password file to our local machine. It was actually encrypted.

     2 hours later, it wasn’t.

    So now we had all the manufacturers usernames and passwords.

     Now we can access the publicly available machines where they have changed the default admin username and password, by using the manufacturers. They have these so the engineers can always get in. Great for business and support, not so for security.

     The network connections listed in the antenna setup were then investigated.

     The VSAT Modem was accessed, again using default connections on SSH, with publicly available usernames and passwords.

    Command line access to the modem was achieved, allowing us to take control and alter the configuration. In effect we could now control the communications in 2 different places.

     Such systemic failures, at the developmental and operational level, are going to have huge issues when Cyber 2021 comes into force next year.

    Class and P&I will be left wondering who to refuse claims and who to sue for negligence when there are events, while the operators are trusting the providers to implement correctly, and the manufacturers and developers are failing at such basic levels, they will likely be left with the legal responsibility in the first instance.

    The lesson of life in todays marine communications environment?

    Don’t trust what’s being given to you.

    Unless you have had your own trusted IT check what’s gone before, why would you blindly trust a stranger with your vessels now?

    The Owner is Liable.

    Yangosat is a maritime communications and solutions provider, helping shipowners and providers realise new systems and invigorate existing ones. This article has been reproduced with the author's permission. 

     

  • GTMaritime offers customisable news service to support crew welfare

    GTMaritime is introducing a fully-customisable news distribution service for vessel owners and operators helping them keep their crews up-to-date on events unfolding in their home countries as well as offering a selection of lighter content to help maintain morale.

  • Cybersecurity start-up secures £1.8m in new funding

    cyberowl apr 30

    From left to right: David Baker, Mercia, with Daniel Ng and Ken Woghiren, CyberOwl.

    Cybersecurity start-up CyberOwl has secured £1.8 million in funding to help develop its cybersecurity solution for the shipping and maritime industries.

  • CYSEC helps ESA to protect ship tracking communications from cyber-attack

    Cybersecurity 4 rsz

     

    CYSEC, a cybersecurity company from Switzerland, has been awarded a contract by the European Space Agency (ESA) to develop a solution mitigating the cyber risks related to ship tracking using satellite communications.

  • ABS Consulting delivers cyber risk services

    ABS Consulting, a subsidiary of the American Bureau of Shipping (ABS), has launched a range of cybersecurity services to help waterway facilities throughout the United States implement a cyber risk management program to comply with existing Maritime Transportation Security Act (MTSA) regulations.

Joomla SEF URLs by Artio

Login/Register

Register or Login to view even more of our content. Basic registration is free.

Register now

Digital Ship magazine provides the latest information about maritime satellite communications technology, software systems, navigation technology, computer networks, data management and TMSA. It is published ten times a year.

 

Address:
Digital Ship Ltd
Digital Ship - Digital Energy Journal
39-41 North Road
London
N7 9DP
United Kingdom

Copyright © 2019 Digital Ship Ltd. All rights reserved           Cookie Policy         Privacy Policy

x