1
00:00:00,000 --> 00:00:02,400
Speed 2, the Poseidon Adventure.

2
00:00:02,520 --> 00:00:06,960
Now this is a tale of how we tested one cruise ship over the course of one week.

3
00:00:06,960 --> 00:00:09,280
There were two of us on the vessel, me and a colleague.

4
00:00:09,460 --> 00:00:11,500
Six engines on this ship.

5
00:00:11,500 --> 00:00:12,740
It was quite a big one.

6
00:00:12,900 --> 00:00:14,380
There was a seven meter swell.

7
00:00:14,380 --> 00:00:19,960
Now the weather got quite rough at one point, at which point I found out my colleague was actually quite seasick.

8
00:00:20,540 --> 00:00:22,400
Yeah, it was pretty rough to be honest.

9
00:00:22,660 --> 00:00:32,920
There were 500 Wi-Fi access points distributed across the ship, 500 CCTV cameras, 1,200 crew and over 2,000 passengers.

10
00:00:32,920 --> 00:00:35,940
So this is really really quite a big place.

11
00:00:36,200 --> 00:00:40,540
And there were of course a pile of vulnerabilities, some of which I'm going to tell you about now.

12
00:00:40,660 --> 00:00:43,540
So what is on a brand new cruise ship?

13
00:00:43,540 --> 00:00:47,240
Well it's not only a ship obviously, but it's also a hotel.

14
00:00:47,240 --> 00:00:49,700
It's got to perform all those hotel functions.

15
00:00:49,740 --> 00:00:55,760
You've got shopping malls, so you've got shops, you've got restaurants, you've got all of these different things going on, taking payments and so on.

16
00:00:55,760 --> 00:00:58,360
And lots lots more when you think about it.

17
00:00:58,360 --> 00:01:01,700
When we break it down a bit further, we've got the off-board communication.

18
00:01:01,700 --> 00:01:04,760
So we've got VSAT, Iridium and fleet broadband, things like that.

19
00:01:04,760 --> 00:01:06,000
The ship's radio.

20
00:01:06,200 --> 00:01:12,520
We've got physical security, so how do we stop people getting onto the bridge, into the machine rooms, into the engine room.

21
00:01:12,520 --> 00:01:17,920
We've got to keep the navigation systems up to date and secure so the ship can navigate safely.

22
00:01:18,040 --> 00:01:24,080
You've got all the networking equipment spread across the vessel, both passenger and industrial control side of things.

23
00:01:24,100 --> 00:01:29,300
You've got the load computer and the load monitoring systems to make sure the stability of the vessel is good.

24
00:01:29,300 --> 00:01:31,240
You've got all the ICS equipment.

25
00:01:31,240 --> 00:01:32,520
You're going to have a crew network.

26
00:01:32,520 --> 00:01:37,560
People can browse the internet on their laptops and phones when they're away from home for long periods of time.

27
00:01:37,820 --> 00:01:40,620
And it just gets complex really really fast.

28
00:01:40,620 --> 00:01:42,820
The attack surface is huge.

29
00:01:43,300 --> 00:01:50,440
So a modern cruise ship, and this isn't the one we tested, it's just an image, is divided up into vertical fire zones.

30
00:01:50,680 --> 00:01:53,540
Now these are both fire and water tight barriers.

31
00:01:53,540 --> 00:02:02,570
The idea is if there's a fire or a hole in the vessel it still stays safe, so that fire can't spread quickly and water can't get from one compartment to another.

32
00:02:03,000 --> 00:02:05,040
Now why is this relevant to us?

33
00:02:05,040 --> 00:02:09,060
Well it drives how the network is designed.

34
00:02:09,620 --> 00:02:12,860
So the network is divided up into fire zones.

35
00:02:12,860 --> 00:02:16,360
So we've got something called an RDP, a remote distribution point.

36
00:02:16,360 --> 00:02:19,820
It's essentially a very very large rack of Cisco gear.

37
00:02:20,040 --> 00:02:23,200
There'll be multiple ones of these per fire zone.

38
00:02:23,320 --> 00:02:28,420
Now for each fire zone we need to split that network out into other ones.

39
00:02:28,420 --> 00:02:31,100
So what we have are things called cabin switches.

40
00:02:31,100 --> 00:02:35,460
So we've got multiple loops of cabin switches on each RDP.

41
00:02:35,720 --> 00:02:40,080
So those cabin switches are connected via wired ethernet, the RDPs are connected via fiber.

42
00:02:40,080 --> 00:02:44,420
So we'll have big big loops of cabin switches, maybe 10 or 20 cabins.

43
00:02:44,520 --> 00:02:47,440
So each RDP will have multiple loops on it.

44
00:02:47,760 --> 00:02:53,900
Now to provide a degree of redundancy they actually have port and starboard side RDPs as well.

45
00:02:53,900 --> 00:02:56,360
So they're all connected via a fiber network.

46
00:02:56,480 --> 00:02:58,860
Now of course as well you're going to have servers.

47
00:02:59,020 --> 00:03:06,620
So you've got things like the TV, you've got the Wi-Fi access, you've got the VSAT so you can gain access to the internet when you're on the vessel.

48
00:03:06,700 --> 00:03:08,360
So this is kind of what it looks like.

49
00:03:08,360 --> 00:03:17,080
It's divided up into these fire zones and you've got this massive loop of RDPs connected via fiber with lots of cabin switches connected in loops.

50
00:03:17,320 --> 00:03:19,700
Now this is what one of those RDPs looks like.

51
00:03:19,700 --> 00:03:22,300
This is half of one of them.

52
00:03:22,300 --> 00:03:23,780
So you can see the sheer scale here.

53
00:03:23,780 --> 00:03:28,280
Bear in mind each pair of ethernet cables coming out there, it's actually going through a loop of cabins.

54
00:03:28,420 --> 00:03:32,400
So when you think about the sheer scale of this, it really is quite huge.

55
00:03:33,760 --> 00:03:38,780
Now to look into one of those loops in more detail, I've broken one of those cabin switches out.

56
00:03:39,160 --> 00:03:41,920
Now there'll be a cabin and we've got IPTV.

57
00:03:42,000 --> 00:03:51,600
So you can watch the TV in your cabin and some of it's streamed from servers, there's live broadcasts of the shows on the ship, that will be done over IP.

58
00:03:51,600 --> 00:03:54,720
And it's on a VLAN and it's connected into the cabin.

59
00:03:54,760 --> 00:03:58,560
You've got a VoIP phone as well, so that's another network connection into the cabin.

60
00:03:58,620 --> 00:04:02,160
But then the really interesting one to me was the cabin control system.

61
00:04:02,160 --> 00:04:10,280
And that controls the lighting, it controls the HVAC or the air conditioning, it controls the door, the access control, and it controls the hot water as well.

62
00:04:10,320 --> 00:04:17,620
It's really important that you heat the water up beyond a certain point periodically to prevent Legionnaire's disease on ships.

63
00:04:17,820 --> 00:04:19,520
Now that's quite a lot of control.

64
00:04:19,520 --> 00:04:27,020
The reason they have it is when a cabin's unoccupied, they can turn the lights off, they can turn the HVAC down so that they're not using as much energy.

65
00:04:27,280 --> 00:04:29,640
And yeah, it's an important system.

66
00:04:29,920 --> 00:04:33,280
Now each cabin switch actually worked on a pair of cabins A and B.

67
00:04:33,280 --> 00:04:36,220
They were almost identical in almost all situations.

68
00:04:36,500 --> 00:04:40,620
But some cabin switches also had other networks hanging off them.

69
00:04:40,620 --> 00:04:45,740
So they had Wi-Fi access points, 500 Wi-Fi access points that were distributed across the vessel.

70
00:04:45,740 --> 00:04:50,760
Ships are made of metal, which means you have to have a lot of access points to have good coverage.

71
00:04:50,760 --> 00:04:53,420
But we also had all of the CCTV cameras.

72
00:04:53,460 --> 00:05:01,680
What that means is that that trunk that flows through the cabin switches contains the TV, the cabin control, the Wi-Fi, and the CCTV.

73
00:05:01,820 --> 00:05:04,320
So it's quite an important trunk network.

74
00:05:05,100 --> 00:05:07,320
So what is the threat model here?

75
00:05:07,340 --> 00:05:09,480
Well, I called this talk Speed 2.

76
00:05:09,480 --> 00:05:10,940
Why did I call it Speed 2?

77
00:05:10,940 --> 00:05:19,740
Well, I don't know if you've seen Speed 2, but in Speed 2, an engineer of the shipping company on the vessel, sailing on it, takes control.

78
00:05:19,740 --> 00:05:22,500
He also kills the captain, but we're going to ignore that bit.

79
00:05:22,500 --> 00:05:26,960
He takes control of the ship and he programs it to crash into another ship.

80
00:05:26,960 --> 00:05:30,240
So the important thing here is the attacker was already on board.

81
00:05:30,240 --> 00:05:32,780
It's not always remote attack we're worried about here.

82
00:05:32,780 --> 00:05:38,500
When you regularly invite 2000 people onto your ship, there's a chance that some of them might be malicious.

83
00:05:38,500 --> 00:05:44,280
Now, they might not be malicious enough to crash the ship into another ship, but they still might want to do bad things.

84
00:05:44,360 --> 00:05:45,940
So what are the risks?

85
00:05:45,940 --> 00:05:48,200
Well, Speed 2 highlighted control of the vessel.

86
00:05:48,200 --> 00:05:53,900
Now, if you've got physical access to the controls on the ship, you can nearly always take control of it.

87
00:05:53,900 --> 00:05:58,460
But the thing is, the crew should nearly always be able to stop that.

88
00:05:58,460 --> 00:06:05,720
Despite the fact that all of this fancy control systems connect everything together, you can nearly always take manual control of things.

89
00:06:05,720 --> 00:06:06,980
You can at least stop them.

90
00:06:06,980 --> 00:06:09,820
You can always take control of certain things.

91
00:06:10,300 --> 00:06:14,760
So control of the vessel also needs a fairly strong motivation.

92
00:06:14,760 --> 00:06:20,660
For an attacker to want to steer a ship into another ship, particularly one with 2000 people on it, they've got to have a screw loose.

93
00:06:20,920 --> 00:06:26,840
So although the impact of this is huge, the likelihood is probably quite low.

94
00:06:27,440 --> 00:06:31,560
But the other thing that cruise companies are worried about is loss of passenger services.

95
00:06:31,800 --> 00:06:39,200
So if everybody's suddenly locked out of their cabin and has to visit guest services, that's 2000 people queuing up to get new access cards.

96
00:06:39,320 --> 00:06:45,300
If the ship can't sail from a port or the ship can't dock at a port, they're going to have to pay money.

97
00:06:45,300 --> 00:06:50,960
If people can't pay for things in the shop, if they can't order in the restaurant, it costs the cruise company money.

98
00:06:50,960 --> 00:06:54,020
And this is what we were trying to investigate, mainly on this test.

99
00:06:54,020 --> 00:06:57,820
What impact could we cause by impacting the passengers?

100
00:06:58,840 --> 00:07:00,580
I'm going to talk about a few issues here.

101
00:07:00,580 --> 00:07:03,400
The first one, the satisfying Wi-Fi.

102
00:07:03,660 --> 00:07:09,180
Now there was guest Wi-Fi on this ship, so these access points were spread about the vessel.

103
00:07:09,180 --> 00:07:16,480
Now they gave access to the corporate network, they gave access to the passenger management system that we'll talk about later, but they also had the guest Wi-Fi.

104
00:07:16,720 --> 00:07:20,960
Now we could connect to that obviously, and then we could start exploring the network.

105
00:07:21,000 --> 00:07:25,600
Now one of the first things that we do when we connect to a guest network like this is we do a trace route.

106
00:07:25,600 --> 00:07:34,460
And we did a trace route out to Google DNS, and what we could see was the first few ping times were 25 milliseconds, give or take, which means we're on the vessel.

107
00:07:34,460 --> 00:07:37,900
The ones after that jump up to 700 plus milliseconds.

108
00:07:37,900 --> 00:07:40,840
That means we've gone over that VSAT link.

109
00:07:40,840 --> 00:07:50,040
VSAT satellite connections are latent, we know those first three steps in the routes are on the vessel, so we decided to explore them in more detail.

110
00:07:50,160 --> 00:07:56,980
And what we found was, in fact, that second to last hop allowed us access to equipment in the VSAT rack.

111
00:07:57,140 --> 00:08:00,960
So from the guest Wi-Fi, we can connect through to the VSAT rack.

112
00:08:01,040 --> 00:08:08,960
Now we've worked a lot on VSAT equipment in the past, so we know the default passwords for most of the bits of equipment.

113
00:08:08,960 --> 00:08:14,420
So we found that we could log into the modem, we found that we could log into the router, so we could log into the modem.

114
00:08:14,520 --> 00:08:18,540
Now the modem tunnels all traffic on and off the vessel.

115
00:08:18,540 --> 00:08:28,220
What my colleague did was spend a period of time looking at the firmware, examining how that device operated, and what he found was that he could gain route access to that device.

116
00:08:28,420 --> 00:08:34,340
So now we've got route access on a device that all of the off-board traffic's going in and out of.

117
00:08:34,340 --> 00:08:38,520
We could therefore intercept it, so we could intercept everything going on and off the vessel.

118
00:08:38,520 --> 00:08:42,920
So any credentials in plain text, anything unencrypted, was ours to see.

119
00:08:42,920 --> 00:08:47,460
So this is quite a serious problem, especially as we could do it from anywhere on the guest Wi-Fi.

120
00:08:48,040 --> 00:08:51,740
So the problem here was the passenger Wi-Fi had access to the VSAT equipment.

121
00:08:51,920 --> 00:08:54,480
There were default passwords on the VSAT equipment.

122
00:08:54,540 --> 00:08:59,920
There was a vulnerability that allowed route access, which allowed us to intercept all off-board traffic.

123
00:09:00,040 --> 00:09:02,440
Now the thing was this could be solved at multiple stages.

124
00:09:02,620 --> 00:09:09,600
The network could be altered so the passenger Wi-Fi couldn't access all of these management interfaces on those devices.

125
00:09:09,880 --> 00:09:16,640
The VSAT installer, a third party, could have changed the passwords on those so that we couldn't just trivially guess them.

126
00:09:16,640 --> 00:09:21,600
The vendor could have not had a vulnerability in their device, which could have prevented us doing this.

127
00:09:21,600 --> 00:09:24,020
But you'll notice I mentioned the third party there.

128
00:09:24,020 --> 00:09:28,760
All of the VSAT equipment is installed by a third party, not the cruise company.

129
00:09:28,900 --> 00:09:33,340
So that will come in back in a few vulnerabilities.

130
00:09:34,580 --> 00:09:37,120
Issue two, just another hole in the wall.

131
00:09:38,320 --> 00:09:42,720
Now one of the most important things for safety of a ship is stability.

132
00:09:42,840 --> 00:09:49,060
So you've got to make sure that the fluid levels in all of your tanks keep the vessel stable.

133
00:09:49,140 --> 00:09:52,720
So if you ride too high in the water, you could be unstable.

134
00:09:52,720 --> 00:09:55,880
If you ride too low in the water, the ship's inefficient.

135
00:09:55,880 --> 00:10:00,260
If you put too much stress on the hull, the ship could become unsafe.

136
00:10:00,660 --> 00:10:05,420
Now ships are hugely complex now, and you can't do these calculations on paper.

137
00:10:05,420 --> 00:10:07,420
So you use something called a load computer.

138
00:10:07,440 --> 00:10:09,940
And this will take readings from all the tanks around the vessels.

139
00:10:09,940 --> 00:10:12,020
It will take things like the passenger manifest.

140
00:10:12,020 --> 00:10:16,660
It will take things like the stores telling you how much food, beer, wine is on board.

141
00:10:16,660 --> 00:10:21,400
And it will calculate if the vessel's stable or not and tell you what to do to make it stable.

142
00:10:22,160 --> 00:10:25,820
Now it's vital for a modern ship that this is there.

143
00:10:25,860 --> 00:10:28,260
And we managed to compromise it in this instance.

144
00:10:28,260 --> 00:10:37,900
But not only compromised the load computer, we also managed to cause a denial of service to bridge systems that were important for day-to-day operations.

145
00:10:38,520 --> 00:10:42,600
Now most of these ships have something called an integrated control and monitoring system.

146
00:10:42,600 --> 00:10:44,020
So that's all the screens on the bridge.

147
00:10:44,020 --> 00:10:48,220
That's all the screens and HMIs, all the PLCs down in the engine room.

148
00:10:48,220 --> 00:10:52,020
So it glues all of the industrial equipment on that ship together.

149
00:10:52,020 --> 00:10:56,280
So that'll be the power, the generators, the propulsion, the rudder.

150
00:10:56,280 --> 00:10:59,480
Everything is glued together by this massive system.

151
00:10:59,660 --> 00:11:04,620
Now it's a blend of IP and serial networks like you'd see in most industrial control systems.

152
00:11:05,480 --> 00:11:07,720
Now ideally it should be segregated.

153
00:11:07,720 --> 00:11:10,240
There should be an air gap between those two of them.

154
00:11:10,240 --> 00:11:14,700
So we've got the passenger network on one side and we've got the bridge network on the other.

155
00:11:14,780 --> 00:11:20,800
But quite often we find that this gets eroded by changes that are made by third parties.

156
00:11:20,800 --> 00:11:25,440
Now when we look into the bridge system in a bit more detail, we've got the IP devices.

157
00:11:25,440 --> 00:11:27,580
So the PCs driving the screens and so on.

158
00:11:27,580 --> 00:11:31,920
But they also need to interact with serial connected devices.

159
00:11:31,980 --> 00:11:37,720
So that would be things like GPS, anemometers, speed loggers, all of these different bits of equipment.

160
00:11:37,720 --> 00:11:44,160
But it also has to interact with the ballast tank monitoring system, the fuel tank monitoring system, and the hull stress monitoring system.

161
00:11:44,260 --> 00:11:47,640
So you've got these things called IP to serial converters.

162
00:11:47,660 --> 00:11:50,400
They go from an IP network through to a serial network.

163
00:11:50,400 --> 00:11:54,260
RS-232, RS-485, Modbus, something like that.

164
00:11:54,260 --> 00:11:57,360
So you can interact with these serial devices.

165
00:11:58,520 --> 00:11:59,940
They look like this.

166
00:11:59,940 --> 00:12:03,480
So on one side you've got Ethernet coming in, on the other side you've got serial.

167
00:12:03,480 --> 00:12:05,200
There's lots and lots of different brands.

168
00:12:05,200 --> 00:12:07,180
Moxa are probably one of the most popular ones.

169
00:12:07,180 --> 00:12:10,680
If you've done any industrial control system work you'll recognize these.

170
00:12:11,520 --> 00:12:14,900
Now you remember I mentioned the load computer?

171
00:12:14,920 --> 00:12:18,140
Now that has to get those readings from the ballast tanks and the fuel tanks.

172
00:12:18,500 --> 00:12:19,500
So how does it do that?

173
00:12:19,500 --> 00:12:32,800
Well they've got a load computer server that's buried in a machine room and it's got its own IP to serial converter that connects into one of the serial networks that's on the bridge that interacts with all of these different monitoring systems.

174
00:12:33,920 --> 00:12:40,220
Now to actually use the load computer there's got to be a UI, which is another computer set up on the bridge.

175
00:12:40,260 --> 00:12:41,560
So you've got a problem.

176
00:12:41,560 --> 00:12:43,560
How do you connect the two of them together?

177
00:12:43,560 --> 00:12:49,920
Now if you've ever worked on a ship you can't just go drilling holes through the floor, you can't just make holes in walls.

178
00:12:50,180 --> 00:12:57,640
You've got to go through specific cable penetrations and then put fire sealant around it, change requests, it's really really awkward.

179
00:12:57,640 --> 00:13:03,180
So if you've got to go down three decks you probably don't want to have to run a cable.

180
00:13:03,340 --> 00:13:13,820
Now this load computer was installed by a third party and what they found was that they could plug into any wall port and connect together.

181
00:13:14,220 --> 00:13:24,160
So that load computer server down in a machine room, there's a wall port near it, they plugged into it, they plugged the load computer into another wall port on the bridge and they found they could connect to each other.

182
00:13:24,980 --> 00:13:26,220
So they used it.

183
00:13:26,220 --> 00:13:29,300
That's a lot easier than making a hole through multiple decks.

184
00:13:30,640 --> 00:13:41,560
Now on this vessel what happened was if you plugged into a wall port, if you had an 8021X certificate for the corporate network or an 8021X certificate for the PMS, you'd gain access to that network.

185
00:13:41,560 --> 00:13:55,540
But if you didn't, you ended up in a tar pit, a specific VLAN and a specific network that didn't have internet access, didn't have access to other networks on the ship, but it was its own network and devices could communicate with each other.

186
00:13:55,580 --> 00:13:59,560
So this was what the load computer company exploited.

187
00:13:59,560 --> 00:14:03,580
They found they could just plug in, get tar pitted and communicate.

188
00:14:03,600 --> 00:14:17,820
But that becomes a bit of a problem because me as an attacker, I can come along and I can plug into a wall port in the bar, I can plug into a wall port next to the swimming pool and I gain access to that same tar pit.

189
00:14:17,900 --> 00:14:22,000
So now I had access to the load computer, UI and server.

190
00:14:22,340 --> 00:14:31,460
Now we've tested ships with this same load computer system on it before and what we found was there's a default username and password stored in an .ini file.

191
00:14:31,880 --> 00:14:36,260
Now with physical access to the machine, of course, you can read that username and password.

192
00:14:36,360 --> 00:14:43,740
A big problem on ships is that you can't lock computers on the bridge because they've got to be used and got to be used quickly.

193
00:14:43,740 --> 00:14:48,240
You can't be remembering a complex password, typing it in to gain access to something.

194
00:14:48,240 --> 00:14:49,180
So they stay unlocked.

195
00:14:49,180 --> 00:14:52,940
So we found this default username and password on a previous test.

196
00:14:53,060 --> 00:14:56,880
With that, what we could do was connect to that load computer server.

197
00:14:56,880 --> 00:15:01,480
We could then pivot through it to take control of the IP to serial converter.

198
00:15:01,820 --> 00:15:09,900
Now you've got those ballast tank levels, the fuel tanks, the whole stress monitoring system and I've now got the ability to inject messages onto there.

199
00:15:09,920 --> 00:15:12,220
Now serial networks have got a bit of an issue here.

200
00:15:12,220 --> 00:15:14,640
You can just generally spoof messages.

201
00:15:14,640 --> 00:15:21,580
If the ballast tank is sending out a message of a given type, you can send out another message of the same type onto that serial network.

202
00:15:21,580 --> 00:15:24,400
There's no way to tell that you've been spoofing that.

203
00:15:24,460 --> 00:15:29,200
The problem here is, of course, is the bridge systems will trust that data.

204
00:15:29,440 --> 00:15:34,820
So what we found is we could inject our own ballast tank levels, our own fuel tank levels, onto this system.

205
00:15:36,380 --> 00:15:43,040
So the problem here, the load computer system needed a network connection and the third party found that arbitrary wall ports connected together.

206
00:15:43,040 --> 00:15:44,200
So they used them.

207
00:15:44,340 --> 00:15:47,380
That meant the load computer is accessible from any wall port.

208
00:15:47,380 --> 00:15:52,060
A shared password that we learned on a previous test allowed us to gain access to that load computer.

209
00:15:52,060 --> 00:15:54,320
We could pivot to the IP serial converter.

210
00:15:54,320 --> 00:16:00,220
We could inject tank readings onto the control network and then we could spam the bridge ICMS.

211
00:16:00,220 --> 00:16:04,880
We could spam all of the screens on the bridge, giving them wrong ballast tank readings.

212
00:16:04,880 --> 00:16:07,840
Now what's the ICMS going to do when it's receiving two different readings?

213
00:16:07,840 --> 00:16:09,760
It's going to probably toggle between the two.

214
00:16:09,760 --> 00:16:10,900
There might be some filtering.

215
00:16:10,900 --> 00:16:12,820
What happens if we spam twice as fast?

216
00:16:12,820 --> 00:16:15,580
What happens if we change how the messages are sent?

217
00:16:15,740 --> 00:16:20,160
The thing here is when you're on the bridge you want to concentrate on navigating.

218
00:16:20,160 --> 00:16:21,980
You want to concentrate on safety.

219
00:16:21,980 --> 00:16:30,580
If suddenly you're getting loads and loads of alarms showing up saying that a fuel tank's empty, that a ballast tank's full, that something's leaking, that would be really bad.

220
00:16:30,580 --> 00:16:33,460
It distracts the navigators on the bridge.

221
00:16:33,460 --> 00:16:36,660
So it causes a denial of service to certain services.

222
00:16:36,680 --> 00:16:41,520
It might be the case that when this happens someone would have to go around and do something called manual tank dippings.

223
00:16:41,520 --> 00:16:45,800
You actually dip a weight with a string into the tanks to find out how much is in them.

224
00:16:45,800 --> 00:16:49,020
It becomes time consuming, so something you want to avoid.

225
00:16:50,180 --> 00:16:53,520
Now issue three, time and tide wait for no VLAN.

226
00:16:53,700 --> 00:16:55,380
Yeah these puns are bad, sorry.

227
00:16:56,360 --> 00:17:08,720
Now coming back to the idea of the cabin switch, it's got that black trunk network flowing through it that's got all of these TV, VoIP phones, Wi-Fi, all of these different VLANs that are quite interesting to us as an attacker.

228
00:17:08,780 --> 00:17:13,480
Now the problem is this cabin switch was located in the passageway, the corridor between the cabins.

229
00:17:13,480 --> 00:17:22,320
They're quite narrow on a cruise ship, so I had to open a panel, I had to open the box it was in, I had to then physically unscrew the switch and then connect to it to mess about with it.

230
00:17:22,320 --> 00:17:30,180
The problem with this is 500 CCTV cameras, people walking up and down the passageways, you're getting in the way, you're going to get noticed.

231
00:17:30,520 --> 00:17:32,960
So we thought, well what can we do to make this easier?

232
00:17:32,960 --> 00:17:35,140
What can we do to access this from our cabin?

233
00:17:35,600 --> 00:17:42,360
So coming back just down to one individual cabin, what we did first off was we disconnected our TV and VoIP phone.

234
00:17:42,420 --> 00:17:45,420
So we just unplugged the ethernet cables from the back of them.

235
00:17:45,500 --> 00:17:52,700
We then went to the cabinet in the wall in the passageway and we bridged directly onto the trunk with those cables.

236
00:17:52,700 --> 00:17:56,660
So we took our cabin switch out of the network.

237
00:17:56,660 --> 00:18:00,980
So it was feeding into our cabin via this structured cabling that was already installed.

238
00:18:01,140 --> 00:18:04,720
We then put our own switch into that loop.

239
00:18:04,760 --> 00:18:06,960
So now we were part of that VLAN trunk.

240
00:18:06,960 --> 00:18:09,200
We were connected in that big loop.

241
00:18:09,200 --> 00:18:17,380
What that meant was we could intercept all of the traffic flowing about that VLAN and we could connect to all of the devices on those VLANs as well.

242
00:18:17,440 --> 00:18:19,160
So this gave us a lot of power.

243
00:18:19,160 --> 00:18:21,500
We found out the TVs had default passwords.

244
00:18:21,500 --> 00:18:24,260
We couldn't really do much apart from stop them working though.

245
00:18:24,260 --> 00:18:28,380
The VoIP phones, again default passwords, we could change their settings so they didn't work.

246
00:18:28,540 --> 00:18:30,580
The Wi-Fi was actually really quite secure.

247
00:18:30,580 --> 00:18:32,280
There wasn't much we could do to that.

248
00:18:32,440 --> 00:18:43,000
The CCTV however, the CCTV VMS, the video management system, connected out to all of the cameras using RTSP, which is a plain text protocol.

249
00:18:43,500 --> 00:18:48,860
Now there was authentication, the cameras did require login, but we could intercept as well as connect to the cameras.

250
00:18:48,880 --> 00:18:58,840
So we could see the password flying about on the network, which meant we could connect to all of the cameras on the ship and view all of them just from the comfort of our own cabins.

251
00:18:59,040 --> 00:19:00,440
So this was a bit of an issue.

252
00:19:01,220 --> 00:19:05,880
Now coming back to that cabin control system that does the lighting, the HVAC, door and water.

253
00:19:06,300 --> 00:19:11,320
Now most systems like this that have got hundreds of nodes will connect back to a server.

254
00:19:11,320 --> 00:19:13,920
So they make a connection from the device through to the server.

255
00:19:13,920 --> 00:19:15,540
This one's a bit weird though.

256
00:19:15,580 --> 00:19:17,080
It worked the other way around.

257
00:19:17,080 --> 00:19:22,520
The cabin control server established connections out to the cabin controls in the cabins.

258
00:19:22,580 --> 00:19:29,500
This was a bit weird, but what that meant was we didn't have to compromise the cabin control server to interact with the cabin controls.

259
00:19:29,500 --> 00:19:31,980
We were on the VLAN that they were all on.

260
00:19:31,980 --> 00:19:37,800
So we could come along with our switch and we could actually compromise all of the cabin controls.

261
00:19:37,960 --> 00:19:39,680
So we could turn the lights on and off.

262
00:19:39,680 --> 00:19:41,500
We could mess about with the aircon.

263
00:19:41,500 --> 00:19:43,380
We could lock people out of their cabins.

264
00:19:43,380 --> 00:19:48,480
We could even open doors on the accessibility cabins, the ones with automated doors.

265
00:19:48,480 --> 00:19:49,720
Quite a lot of power.

266
00:19:50,700 --> 00:19:52,720
Again, you're impacting the passengers.

267
00:19:52,720 --> 00:19:53,900
You're costing them.

268
00:19:54,020 --> 00:19:56,800
You're making them uncomfortable, which means they're going to complain.

269
00:19:56,800 --> 00:19:58,200
It's going to cost you money.

270
00:19:58,640 --> 00:20:02,440
The other thing we thought would be amusing would be writing something on the side of the ship.

271
00:20:02,440 --> 00:20:09,120
Now, some ships have this functionality where through the cabin control system, you can actually write things on the side of the vessel.

272
00:20:09,120 --> 00:20:13,860
This isn't the one we tested, but it'd be great to write something on the side of a ship that big.

273
00:20:14,560 --> 00:20:20,560
The other problem with this cabin control system was that the switches were physically accessible to us.

274
00:20:20,560 --> 00:20:26,100
Now, of course, we had to be in the passageway, but there's an attack that we carry out against switches quite a lot of the time.

275
00:20:26,100 --> 00:20:28,380
Now, it does require physical access.

276
00:20:28,500 --> 00:20:32,060
Most Cisco switches have something called password recovery mode.

277
00:20:32,060 --> 00:20:39,200
What that means is you can reboot it, and through the serial console on it, you can dump the existing config file off it.

278
00:20:39,200 --> 00:20:43,900
The idea of this mode is that you can change the password if you've forgotten it with physical access.

279
00:20:43,980 --> 00:20:49,040
But we're relying on dumping the config off a device and it containing interesting information.

280
00:20:49,260 --> 00:20:51,180
Now, it can take things like what VLANs are.

281
00:20:51,180 --> 00:20:56,440
It will also contain hashes or possibly even encrypted versions of the passwords.

282
00:20:56,560 --> 00:21:00,220
So we managed to dump a config off one of the cabin control switches.

283
00:21:00,220 --> 00:21:05,160
It took about two or three minutes to get this, which isn't too bad, and they were hashed passwords.

284
00:21:05,260 --> 00:21:07,040
We put them on our cracking rig.

285
00:21:07,040 --> 00:21:10,880
It took, I think, about two days of effort to recover the password.

286
00:21:10,880 --> 00:21:12,460
Now, the password wasn't bad.

287
00:21:12,460 --> 00:21:13,880
It was a reasonably good password.

288
00:21:13,880 --> 00:21:16,340
I mean, I know two days isn't too long, but it wasn't Cisco.

289
00:21:16,340 --> 00:21:17,600
It wasn't ship.

290
00:21:18,140 --> 00:21:25,620
And we tried that against the cabin switches, but none of them had a network logon.

291
00:21:25,620 --> 00:21:29,080
So you could plug into them via serial and connect, but that's not particularly bad.

292
00:21:29,260 --> 00:21:34,640
However, remember, we've got access to this trunk, which means we've got access to those RDPs.

293
00:21:34,640 --> 00:21:41,200
And what we found was one of the RDPs had left its management interface exposed to the trunks that we could access.

294
00:21:41,320 --> 00:21:44,340
And that RDP had left the web interface enabled.

295
00:21:44,400 --> 00:21:49,760
That username and password recovered from one cabin switch worked on that single RDP.

296
00:21:49,980 --> 00:21:54,900
Now, it turns out that during commissioning, that single RDP hadn't fully been commissioned.

297
00:21:54,900 --> 00:21:57,200
So they hadn't changed the password on it.

298
00:21:57,200 --> 00:22:03,340
We gained access to that RDP, and that allowed us to intercept all of the traffic on that fiber trunk.

299
00:22:03,340 --> 00:22:06,200
So it wasn't just the things on the cabin switch loops anymore.

300
00:22:06,200 --> 00:22:11,500
It was pretty much everything on the vessel outside of the ICMS, the industrial control systems.

301
00:22:12,440 --> 00:22:18,480
So these VLAN trunks run all over the ship, and you can connect from inside the cabin using the phone cables.

302
00:22:18,480 --> 00:22:21,260
And it allows access to many, many systems.

303
00:22:21,340 --> 00:22:24,480
But it also allows sniffing to get any plain text auth.

304
00:22:24,480 --> 00:22:27,920
So not using HTTPS actually had impact here.

305
00:22:28,300 --> 00:22:33,880
The cabin switches had that brute forcible password, and that password worked on just one part of the core network.

306
00:22:33,880 --> 00:22:37,340
That allowed us to intercept all of the VLAN trunks.

307
00:22:37,340 --> 00:22:39,460
So we've got a pretty significant compromise here.

308
00:22:39,460 --> 00:22:42,900
Now, this was just an omission, and it did take quite a lot of effort to get to this point.

309
00:22:42,900 --> 00:22:45,380
But it was a problem, a vulnerability.

310
00:22:46,600 --> 00:22:48,880
Issue four, I'm the captain now.

311
00:22:49,520 --> 00:22:56,400
Now, if you've been on a cruise recently, you'll probably notice that a lot of the crew will carry tablets.

312
00:22:56,620 --> 00:23:02,060
So when you muster, if there's a safety drill, they'll be taking muster on a tablet.

313
00:23:02,060 --> 00:23:04,780
If you order in one of the restaurants, it will be on a tablet.

314
00:23:04,780 --> 00:23:08,320
If they come to your room with room service, they will have a tablet.

315
00:23:08,700 --> 00:23:13,680
And this is quite broadly called a passenger management system, a PMS.

316
00:23:13,680 --> 00:23:14,800
And it deals with lots of things.

317
00:23:14,800 --> 00:23:16,060
It does cabin assignment.

318
00:23:16,060 --> 00:23:17,120
It does access control.

319
00:23:17,120 --> 00:23:21,340
So quite often, it will be linked into the access control system so that your card works on your cabin.

320
00:23:21,340 --> 00:23:24,140
It does restaurant booking and the billing in the restaurant.

321
00:23:24,140 --> 00:23:25,280
It does mustering.

322
00:23:25,280 --> 00:23:28,260
And it also can hold your passport details for immigration.

323
00:23:28,260 --> 00:23:31,040
It's kind of core to how the vessel operates.

324
00:23:31,620 --> 00:23:36,540
Now, what we found was all of the tablets on this vessel used 8021X certificates for the Wi-Fi.

325
00:23:36,720 --> 00:23:38,920
And the tablets were actually quite well hardened.

326
00:23:38,920 --> 00:23:41,460
We couldn't get anything off them easily.

327
00:23:41,460 --> 00:23:44,520
So we couldn't get those certificates to gain access to the Wi-Fi.

328
00:23:44,800 --> 00:23:51,880
And we could have spent time doing something to possibly root one of the tablets or gain the creds from somewhere else.

329
00:23:51,900 --> 00:23:59,500
But remember, we've got access to every VLAN on the vessel, including the VLAN that carries the Wi-Fi traffic from all of the tablets.

330
00:23:59,500 --> 00:24:03,020
And we can intercept that traffic, which is what we did.

331
00:24:03,500 --> 00:24:10,680
So we found that the tablets, although they're using 8021X, that was actually implemented by the cruise company.

332
00:24:10,680 --> 00:24:14,220
They decided they wanted to layer that security on top.

333
00:24:14,220 --> 00:24:16,580
However, the PMS used HTTP.

334
00:24:16,580 --> 00:24:20,020
There was no encryption between the tablets and the server.

335
00:24:20,020 --> 00:24:24,640
That let us sniff credentials and other things going backwards and forwards.

336
00:24:25,460 --> 00:24:33,540
What we found, of course, was that there was a SQL server which was passing its username and password in the plane across this network.

337
00:24:33,840 --> 00:24:37,820
So once we gained access to those VLAN trunks, we could get this username and password.

338
00:24:37,820 --> 00:24:43,960
We could then add our own user into the passenger management system, and we could pretty much do what we want.

339
00:24:44,340 --> 00:24:50,700
So I could book myself into the best restaurant on the ship and not have to pay for it, for example.

340
00:24:50,960 --> 00:24:56,780
But perhaps more fun was we worked out how to log in as the captain on this system.

341
00:24:56,780 --> 00:25:02,160
So we could go to the restaurant, we could order the most expensive bottle of wine, and we could bill it to the captain.

342
00:25:02,500 --> 00:25:04,120
So this isn't good, really.

343
00:25:04,120 --> 00:25:06,380
This is a serious impact.

344
00:25:08,520 --> 00:25:16,560
The PMS had good Wi-Fi security that was put in place by the cruise company, but the PMS vendor used HTTP for the communications.

345
00:25:16,560 --> 00:25:18,300
It just wasn't secure enough.

346
00:25:18,360 --> 00:25:20,180
We've covered those common SQL creds.

347
00:25:20,180 --> 00:25:22,500
We've not managed to test them on any other ships.

348
00:25:22,500 --> 00:25:24,940
They could be the same across other ships.

349
00:25:25,220 --> 00:25:27,160
And with that, we could become anyone.

350
00:25:27,500 --> 00:25:28,860
We could wipe details.

351
00:25:28,860 --> 00:25:31,100
We could order things in restaurants.

352
00:25:31,100 --> 00:25:32,360
It's pretty crazy.

353
00:25:32,740 --> 00:25:36,100
So I think we pretty comprehensively owned this ship.

354
00:25:36,100 --> 00:25:38,180
It was a really, really good fun test.

355
00:25:38,600 --> 00:25:40,380
So what is the conclusion here?

356
00:25:40,660 --> 00:25:44,080
Well, these attacks did require detailed knowledge.

357
00:25:44,480 --> 00:25:46,020
We had to be on the vessel.

358
00:25:46,260 --> 00:25:48,360
We had to have a good level of understanding.

359
00:25:48,360 --> 00:25:51,560
We weren't really strictly detected.

360
00:25:52,260 --> 00:25:59,220
One of the problems with a ship is it's hard to perform things like intrusion detection remotely.

361
00:25:59,360 --> 00:26:05,220
So you might be able to sniff traffic and things like that, but you've only got a limited amount of bandwidth to send that back to a SOC.

362
00:26:05,460 --> 00:26:07,580
So no one really noticed us.

363
00:26:07,780 --> 00:26:09,700
We dressed smartly.

364
00:26:09,820 --> 00:26:15,960
And the couple of times that people noticed us opening cabinets and things like that, no one said anything.

365
00:26:15,960 --> 00:26:20,800
Now, interestingly, most of the risks on the ship were actually introduced by third parties.

366
00:26:20,800 --> 00:26:31,160
The cruise company had done a lot to secure those networks, but it was third parties putting systems in and making mistakes and not doing security properly that introduced most risks.

367
00:26:31,480 --> 00:26:34,760
Now for a ship, denial of service is very costly.

368
00:26:34,760 --> 00:26:45,380
If you can stop a cruise ship leaving its berth, especially in one of the smaller ports where there's only one or two berths, and another ship's waiting to come in, the port can charge you huge sums of money.

369
00:26:45,380 --> 00:26:49,460
We're talking tens or even possibly hundreds of thousands of dollars per day.

370
00:26:49,460 --> 00:26:51,420
You've got passengers complaining.

371
00:26:51,420 --> 00:26:56,840
You're going to possibly have to reschedule flights, get hotels for people, your next cruise may be delayed.

372
00:26:56,880 --> 00:27:04,200
So causing any denial of service, whether that's locking people out their cabins or stopping the ship sailing, can cost you huge sums of money.

373
00:27:04,200 --> 00:27:07,240
So don't always think about it as steering another ship into another ship.

374
00:27:07,240 --> 00:27:09,540
Think about how you can impact the passengers.

375
00:27:09,620 --> 00:27:12,500
But lastly, cruise ships are massive amounts of fun.

376
00:27:12,500 --> 00:27:19,160
It's rare that you'd be able to explore such huge complex machines with such level of detail.

377
00:27:19,380 --> 00:27:22,480
Definitely one of the most fun tests I've been on this one.

378
00:27:23,280 --> 00:27:24,680
Thanks for listening.

379
00:27:24,860 --> 00:27:26,620
I'm Cyber Gibbons on Twitter.

380
00:27:26,620 --> 00:27:33,560
If you've got any questions or you want to know anything more, just ping me a DM or send me a message on Twitter.

381
00:27:33,560 --> 00:27:34,420
That'd be great.

382
00:27:34,420 --> 00:27:35,380
Thanks for listening.

383
00:27:35,380 --> 00:27:35,880
Bye.