Diplomacy & Crisis News

The Islamic State has ramped up its Russian-language recruitment.

And Western countries need a plan to defuse the threat they pose.

Critics fear Trump administration will politicize diplomatic corps with unprecedented pick.

En compétition à Cannes en 2014, sacré meilleur film aux Césars en 2015, Timbuktu, du Mauritanien Abderrahmane Sissako, qui évoquait l'occupation djihadiste de Tombouctou en 2012, a rassemblé plus d'un million de spectateurs. Ce triomphe n'a pas pour autant incité les distributeurs français à prêter (...) / Afrique, Burkina Faso, Côte d'Ivoire, France, Francophonie, Mali - 2017/11

In Vienna, the center-right and populist right are vying for power. All of Europe is watching.

An officer wards off boredom with bad food, booze, and Russia Today during a layover in Al Udeid.

“Having served as an infantryman for four and a half years, I learned more about tactics and how to employ Marines more effectively in the 10 days spent at the experiment in the desert than I did in the entirety of my service."

Air Force paying to build contractor fighter force; South Korea says no nukes.

The Spanish region’s leaders believe punishment can be a path to redemption – as long as they’re not the ones who suffer.

As sectors of the domestic and world economy become more dependent on the internet and the cloud, their vulnerability to new forms of attack and disruption increases. Cybersecurity is not just a national defense issue, but must also become a cost of doing business.

It is clear that the shipping industry is susceptible to cyber-attacks. These attacks can be as harmful as the damage caused by storms. In many ways, they might be more harmful, because they can come out of nowhere.

Maersk and NotPetya

In June 2017, Maersk was subject to a cyber-attack centered in Ukraine. The malware, called NotPetya, is a variation on the ransomware called Petya, but NotPetya does not appear to be supported by a desire to get rich, just a willingness to cause mayhem.

Unlike Petya, which did act as ransomware, NotPetya scrambles the target computer’s file system — everything is lost. No possibility of paying in Bitcoin exists.

The NotPetya attack knocked out Maersk’s network for several days, and Maersk expects the total loss from the attack to be in the neighborhood of $200-$300 million. While operations resumed quickly, the attack led to the complete shutdown of Maersk’s operations worldwide.

Vulnerabilities

The industry relies on computers to function, and GPS equipment is connected to worldwide networks. Engines are run using computers.

The number of vulnerability points, both on-shore, and at-sea, is large and growing. If the construction of self-driving ships becomes a widespread reality, more vulnerabilities will appear.

Email systems are vulnerable to hacking. Cyberkeel, for example, discovered hacking activity in a shipping firm’s systems. A virus planted in the system monitored emails originating in or destined for the finance department. The virus changed the text of the message to change the bank account number to that of the hackers.

It cost the company several million dollars before they noticed.

Cyberkeel was founded three years ago and established to provide cyber security. One of their programs was to provide penetration testing of shipping firms’ systems. At first, they met with little success, because firms were complacent with their systems. Perhaps the greatest vulnerability is complacency.

Many shipping systems are not encrypted. The lack of encryption makes the shipping line and its vessels vulnerable to cyber attacks. Regardless of encryption, many ships’ crews are not trained in cyber security. One survey indicated that in 2015, 43% of crew members were aware of their company’s cyber security policies, while only 12% had received training.

Piracy

One shipping firm was hacked by pirates — sophisticated pirates.

Instead of seizing a vessel and holding the crew hostage pending ransom payment, these pirates gained access to sensitive information regarding ships, cargos, containers and contents. They boarded the vessel, opened the specific containers containing the valuables and left with the loot.

Unlike what happens in many hijackings, the pirates released the crew and never asked for a ransom.

The company eventually became suspicious, determined the pirates had hacked the computerized manifest, and they took steps to prevent further unauthorized access.

Propellers and Charts

Another vulnerability is in the systems which control a ship’s operation. One container ship in an Asian port was shut down when a switchboard which managed the power supply to the propeller, and other mechanical components were shut down by ransomware.

Electronic Chart Displays are rarely protected by anti-virus software. Charts are, of course, crucial to navigation, especially in restricted and coastal waters. The chart display of one tanker in Asia was infected by crew carelessness.

A crew member brought a USB flash drive on board to print paperwork. The flash drive was infected with the malware, which only activated when another crew member tried to update the charts before departure, also using USB. The problem was detected while still in port, and it was fixed. Had the problem occurred at sea, however, the situation could have become dangerous.

Taking Control

Independent cyber security firms and analysts are confident that hackers could cause catastrophic results. It is possible to take control of the systems from afar and cause a collision. They have performed tests on the systems and succeeded in penetrating them.

An attack could also change the coordinates displayed by GPS, although in coastal waters the crew would likely spot the difference and adjust for it. But at least one ship’s open satellite system had the username “admin”, which needed to use the password “1234” to access the system, which means that someone at the shipping company was careless.

It is likely hackers did not cause the recent collisions between USS Fitzgerald and John S. McCain and merchant vessels. The U.S. Navy aggressively encrypts its systems, which should deter hackers from invading their confidential information. Current indications are that crew and command errors led to the collisions. There’s no indication the merchant vessels were hacked, either, but both collisions are under investigation.

South Korea reported that 280 vessels had to return to port in April 2016 due to problems with their navigation and other systems. South Korea believes North Korea was responsible for these hacks.

In addition, jamming devices fitted to lighthouses have been tested and can affect GPS receivers up to 16 nautical miles. Some GPS devices died, while others provided false information. Jamming devices on ships can cause even more chaos.

Solutions

The industry has begun to recognize the risks it faces. Awareness that a problem exists is always the first step toward solving the problem.

Shipping lines — and the industry as a whole — should follow a set of guidelines for cyber security, and those guidelines should be strong and effective.

You must train your crews and alter their behavior. Make crews aware of the cyber risks and what they can and can’t do with the computer systems on board. While printed copies of bills of lading and other information remains important, ensuring computers and printers can’t be compromised by an infected flash drive should be a top priority.

The industry also needs to create standards to allow insurance companies to cover damage from cyber-attacks. You must identify the risk so insurance underwriters can evaluate what you identify.

Cyber security is as necessary as physical security. Companies expend significant resources ensuring their buildings remain safe. Companies should realize their electronic systems are just as vulnerable to attack, and extend the same level of resources ensuring the safety of their ships and crews — and business.

—

Cory Levins serves as the Director of Business Development for Air Sea Containers.  Cory oversees the development and implementation of ASC’s internal and external marketing program, driving revenue and profits from the Miami FL headquarters.

 

The post Could the Shipping Industry Be Susceptible to Cyber-Attacks? appeared first on Foreign Policy Blogs.

We need to demand accountability from social media companies — and from U.S. diplomats.

The war against the Islamic State concealed the Kurds' political and economic weaknesses. The loss of Kirkuk has made them impossible to ignore.

Le photographe Sebastian Castelier a accompagné Damien Lefauconnier lors d'un déplacement dans le cadre de son enquête sur l'une des centrales nucléaires les plus dangereuses du monde, à Metsamor, en Arménie. Tous deux ont obtenu l'autorisation de visiter les lieux. Les clichés reproduits ci-dessous (...) / Arménie, Énergie, Nucléaire civil, Santé - 2017/11

For years, the U.S. military secretly flew Russian aircraft. Now it needs a cheaper option.

The “sonic attacks” in Cuba aren’t the first suspected instance of invisible attacks on U.S. diplomats.

Fearing the Kremlin’s grand design, and another nuclear disaster, Vilnius has turned a power plant into a battleground.

His eyes bulged out, as the tip of the pistol slammed into the back wall of his throat.

A big Halloween roundup

Experts doubt a coherent space policy from the Trump administration.

The Russia collusion scandal is closing in on America’s commander-in-chief of fake news.