start	end	text
0	5760	Speed 2, the Poseidon Adventure. Now this is a tale of how we tested one cruise ship over the
5760	11060	course of one week. There were two of us on the vessel, me and a colleague. Six engines on this
11060	15780	ship. It was quite a big one. There was a seven meter swell. Now the weather got quite rough at
15780	21260	one point, at which point I found out my colleague was actually quite seasick. Yeah, it was pretty
21260	28060	rough to be honest. There were 500 Wi-Fi access points distributed across the ship, 500 CCTV
28060	35940	cameras, 1,200 crew and over 2,000 passengers. So this is really really quite a big place.
36200	40540	And there were of course a pile of vulnerabilities, some of which I'm going to tell you about now.
40660	47240	So what is on a brand new cruise ship? Well it's not only a ship obviously, but it's also a hotel.
47240	51580	It's got to perform all those hotel functions. You've got shopping malls, so you've got shops,
51580	55300	you've got restaurants, you've got all of these different things going on, taking payments and so
55300	60520	on. And lots lots more when you think about it. When we break it down a bit further, we've got the
60520	65200	off-board communication. So we've got VSAT, Iridium and fleet broadband, things like that. The ship's
65200	70560	radio. We've got physical security, so how do we stop people getting onto the bridge, into the
70560	75640	machine rooms, into the engine room. We've got to keep the navigation systems up to date and secure
75640	80720	so the ship can navigate safely. You've got all the networking equipment spread across the vessel,
80720	85520	both passenger and industrial control side of things. You've got the load computer and the
85520	90420	load monitoring systems to make sure the stability of the vessel is good. You've got all the ICS
90420	94460	equipment. You're going to have a crew network. People can browse the internet on their laptops
94460	99960	and phones when they're away from home for long periods of time. And it just gets complex really
99960	105600	really fast. The attack surface is huge. So a modern cruise ship, and this isn't the one we
105600	112160	tested, it's just an image, is divided up into vertical fire zones. Now these are both fire and
112160	117980	water tight barriers. The idea is if there's a fire or a hole in the vessel it still stays safe,
117980	122570	so that fire can't spread quickly and water can't get from one compartment to another.
123000	129060	Now why is this relevant to us? Well it drives how the network is designed.
129620	134940	So the network is divided up into fire zones. So we've got something called an RDP,
135040	139820	a remote distribution point. It's essentially a very very large rack of Cisco gear.
140040	145940	There'll be multiple ones of these per fire zone. Now for each fire zone we need to split that
145940	152120	network out into other ones. So what we have are things called cabin switches. So we've got multiple
152120	157880	loops of cabin switches on each RDP. So those cabin switches are connected via wired ethernet,
157880	163580	the RDPs are connected via fiber. So we'll have big big loops of cabin switches, maybe 10 or 20
163580	170160	cabins. So each RDP will have multiple loops on it. Now to provide a degree of redundancy they
170160	176360	actually have port and starboard side RDPs as well. So they're all connected via a fiber network.
176480	181240	Now of course as well you're going to have servers. So you've got things like the TV,
181240	185840	you've got the Wi-Fi access, you've got the VSAT so you can gain access to the internet when you're
185840	190280	on the vessel. So this is kind of what it looks like. It's divided up into these fire zones and
190280	195860	you've got this massive loop of RDPs connected via fiber with lots of cabin switches connected
195860	202860	in loops. Now this is what one of those RDPs looks like. This is half of one of them. So you can see
202860	206480	the sheer scale here. Bear in mind each pair of ethernet cables coming out there, it's actually
206480	211540	going through a loop of cabins. So when you think about the sheer scale of this, it really is quite
211540	218100	huge. Now to look into one of those loops in more detail, I've broken one of those cabin switches
218100	224360	out. Now there'll be a cabin and we've got IPTV. So you can watch the TV in your cabin and
224360	230540	some of it's streamed from servers, there's live broadcasts of the shows on the ship, that will be
230540	236120	done over IP. And it's on a VLAN and it's connected into the cabin. You've got a VoIP phone as well,
236120	240560	so that's another network connection into the cabin. But then the really interesting one to me
240560	245240	was the cabin control system. And that controls the lighting, it controls the HVAC or the air
245240	250280	conditioning, it controls the door, the access control, and it controls the hot water as well.
250320	255160	It's really important that you heat the water up beyond a certain point periodically to prevent
255660	260800	Legionnaire's disease on ships. Now that's quite a lot of control. The reason they have it is when
260920	265460	a cabin's unoccupied, they can turn the lights off, they can turn the HVAC down so that they're
265460	271020	not using as much energy. And yeah, it's an important system. Now each cabin switch actually
271020	276640	worked on a pair of cabins A and B. They were almost identical in almost all situations. But
276640	282300	some cabin switches also had other networks hanging off them. So they had Wi-Fi access points,
282300	287720	500 Wi-Fi access points that were distributed across the vessel. Ships are made of metal, which
287720	292180	means you have to have a lot of access points to have good coverage. But we also had all of the CCTV
292180	298680	cameras. What that means is that that trunk that flows through the cabin switches contains the TV,
298680	304320	the cabin control, the Wi-Fi, and the CCTV. So it's quite an important trunk network.
305100	310940	So what is the threat model here? Well, I called this talk Speed 2. Why did I call it Speed 2?
310940	315500	Well, I don't know if you've seen Speed 2, but in Speed 2, an engineer of the shipping company
315500	321660	on the vessel, sailing on it, takes control. He also kills the captain, but we're going to ignore
321660	326960	that bit. He takes control of the ship and he programs it to crash into another ship.
326960	331600	So the important thing here is the attacker was already on board. It's not always remote attack
331600	336480	we're worried about here. When you regularly invite 2000 people onto your ship, there's a
336480	340760	chance that some of them might be malicious. Now, they might not be malicious enough to crash the
340760	346340	ship into another ship, but they still might want to do bad things. So what are the risks? Well,
346340	351140	Speed 2 highlighted control of the vessel. Now, if you've got physical access to the controls on
351140	356600	the ship, you can nearly always take control of it. But the thing is, the crew should nearly always
356600	362400	be able to stop that. Despite the fact that all of this fancy control systems connect everything
362400	366980	together, you can nearly always take manual control of things. You can at least stop them.
366980	373960	You can always take control of certain things. So control of the vessel also needs a fairly strong
373960	377680	motivation. For an attacker to want to steer a ship into another ship, particularly one with
377680	383740	2000 people on it, they've got to have a screw loose. So although the impact of this is huge,
383740	389480	the likelihood is probably quite low. But the other thing that cruise companies are worried about
389480	394960	is loss of passenger services. So if everybody's suddenly locked out of their cabin and has to
394960	400460	visit guest services, that's 2000 people queuing up to get new access cards. If the ship can't
400460	406060	sail from a port or the ship can't dock at a port, they're going to have to pay money. If people can't
406060	410960	pay for things in the shop, if they can't order in the restaurant, it costs the cruise company money.
410960	415700	And this is what we were trying to investigate, mainly on this test. What impact could we cause
415700	421640	by impacting the passengers? I'm going to talk about a few issues here. The first one,
421640	428160	the satisfying Wi-Fi. Now there was guest Wi-Fi on this ship, so these access points were spread
428160	432180	about the vessel. Now they gave access to the corporate network, they gave access to the
432180	437260	passenger management system that we'll talk about later, but they also had the guest Wi-Fi. Now we
437260	441700	could connect to that obviously, and then we could start exploring the network. Now one of the first
441700	445860	things that we do when we connect to a guest network like this is we do a trace route. And we
445860	451480	did a trace route out to Google DNS, and what we could see was the first few ping times were 25
451480	456500	milliseconds, give or take, which means we're on the vessel. The ones after that jump up to 700
456500	463120	plus milliseconds. That means we've gone over that VSAT link. VSAT satellite connections are latent,
463120	468640	we know those first three steps in the routes are on the vessel, so we decided to explore them
468640	474700	in more detail. And what we found was, in fact, that second to last hop allowed us access to
474700	480960	equipment in the VSAT rack. So from the guest Wi-Fi, we can connect through to the VSAT rack.
481040	487940	Now we've worked a lot on VSAT equipment in the past, so we know the default passwords for most
487940	491640	of the bits of equipment. So we found that we could log into the modem, we found that we could
491640	497520	log into the router, so we could log into the modem. Now the modem tunnels all traffic on and
497520	502180	off the vessel. What my colleague did was spend a period of time looking at the firmware, examining
502180	508220	how that device operated, and what he found was that he could gain route access to that device.
508420	514340	So now we've got route access on a device that all of the off-board traffic's going in and out of.
514340	518520	We could therefore intercept it, so we could intercept everything going on and off the vessel.
518520	523760	So any credentials in plain text, anything unencrypted, was ours to see. So this is quite a serious
523760	529120	problem, especially as we could do it from anywhere on the guest Wi-Fi. So the problem here was the
529120	534480	passenger Wi-Fi had access to the VSAT equipment. There were default passwords on the VSAT equipment.
534540	539080	There was a vulnerability that allowed route access, which allowed us to intercept all off-board
539080	544360	traffic. Now the thing was this could be solved at multiple stages. The network could be altered so
544360	549600	the passenger Wi-Fi couldn't access all of these management interfaces on those devices.
549880	555280	The VSAT installer, a third party, could have changed the passwords on those so that we couldn't
555280	559700	just trivially guess them. The vendor could have not had a vulnerability in their device, which
559700	564460	could have prevented us doing this. But you'll notice I mentioned the third party there. All of
564460	570260	the VSAT equipment is installed by a third party, not the cruise company. So that will come in
570780	577120	back in a few vulnerabilities. Issue two, just another hole in the wall.
578320	584080	Now one of the most important things for safety of a ship is stability. So you've got to make sure
584080	590400	that the fluid levels in all of your tanks keep the vessel stable. So if you ride too high in the
590400	596500	water, you could be unstable. If you ride too low in the water, the ship's inefficient. If you put
596500	602720	too much stress on the hull, the ship could become unsafe. Now ships are hugely complex now,
602720	607420	and you can't do these calculations on paper. So you use something called a load computer.
607440	610820	And this will take readings from all the tanks around the vessels. It will take things like the
610820	615520	passenger manifest. It will take things like the stores telling you how much food, beer,
615520	619800	wine is on board. And it will calculate if the vessel's stable or not and tell you what to do
619800	626480	to make it stable. Now it's vital for a modern ship that this is there. And we managed to
626480	631200	compromise it in this instance. But not only compromised the load computer, we also managed
631200	637900	to cause a denial of service to bridge systems that were important for day-to-day operations.
638520	642600	Now most of these ships have something called an integrated control and monitoring system.
642600	647400	So that's all the screens on the bridge. That's all the screens and HMIs, all the PLCs down in
647400	652420	the engine room. So it glues all of the industrial equipment on that ship together. So that'll be
652420	657860	the power, the generators, the propulsion, the rudder. Everything is glued together by this
657860	663600	massive system. Now it's a blend of IP and serial networks like you'd see in most industrial control
663600	670240	systems. Now ideally it should be segregated. There should be an air gap between those two of them.
670240	674700	So we've got the passenger network on one side and we've got the bridge network on the other.
674780	680800	But quite often we find that this gets eroded by changes that are made by third parties.
680800	686020	Now when we look into the bridge system in a bit more detail, we've got the IP devices. So the PCs
686020	692240	driving the screens and so on. But they also need to interact with serial connected devices. So that
692240	697720	would be things like GPS, anemometers, speed loggers, all of these different bits of equipment.
697720	701820	But it also has to interact with the ballast tank monitoring system, the fuel tank monitoring
701820	706580	system, and the hull stress monitoring system. So you've got these things called IP to serial
706580	713260	converters. They go from an IP network through to a serial network. RS-232, RS-485, Modbus,
713260	720140	something like that. So you can interact with these serial devices. They look like this. So on
720140	724160	one side you've got Ethernet coming in, on the other side you've got serial. There's lots and
724160	727900	lots of different brands. Moxa are probably one of the most popular ones. If you've done any
727900	734100	industrial control system work you'll recognize these. Now you remember I mentioned the load
734100	738140	computer? Now that has to get those readings from the ballast tanks and the fuel tanks.
738500	742800	So how does it do that? Well they've got a load computer server that's buried in a machine room
742800	747920	and it's got its own IP to serial converter that connects into one of the serial networks
747920	752800	that's on the bridge that interacts with all of these different monitoring systems.
753920	759440	Now to actually use the load computer there's got to be a UI, which is another computer set
759440	763560	up on the bridge. So you've got a problem. How do you connect the two of them together?
763560	768320	Now if you've ever worked on a ship you can't just go drilling holes through the floor, you can't
768320	773800	just make holes in walls. You've got to go through specific cable penetrations and then put fire
773800	779280	sealant around it, change requests, it's really really awkward. So if you've got to go down three decks
779880	785800	you probably don't want to have to run a cable. Now this load computer was installed by a third party
786580	793820	and what they found was that they could plug into any wall port and connect together.
794220	798060	So that load computer server down in a machine room, there's a wall port near it, they plugged
798060	802600	into it, they plugged the load computer into another wall port on the bridge and they found
802600	808080	they could connect to each other. So they used it. That's a lot easier than making a hole through
808080	815040	multiple decks. Now on this vessel what happened was if you plugged into a wall port, if you had
815040	820460	an 8021X certificate for the corporate network or an 8021X certificate for the PMS, you'd gain access
820460	826640	to that network. But if you didn't, you ended up in a tar pit, a specific VLAN and a specific network
826640	831800	that didn't have internet access, didn't have access to other networks on the ship, but it was
831800	838100	its own network and devices could communicate with each other. So this was what the load computer
838100	844360	company exploited. They found they could just plug in, get tar pitted and communicate. But that becomes
844520	850980	a bit of a problem because me as an attacker, I can come along and I can plug into a wall port in
850980	857140	the bar, I can plug into a wall port next to the swimming pool and I gain access to that same tar
857140	864300	pit. So now I had access to the load computer, UI and server. Now we've tested ships with this same
864300	870180	load computer system on it before and what we found was there's a default username and password stored
870180	875480	in an .ini file. Now with physical access to the machine, of course, you can read that username and
875480	881840	password. A big problem on ships is that you can't lock computers on the bridge because they've got
881840	887200	to be used and got to be used quickly. You can't be remembering a complex password, typing it in
887200	891660	to gain access to something. So they stay unlocked. So we found this default username and password on
891780	897320	a previous test. With that, what we could do was connect to that load computer server. We could
897320	903240	then pivot through it to take control of the IP to serial converter. Now you've got those ballast
903240	907560	tank levels, the fuel tanks, the whole stress monitoring system and I've now got the ability
907560	912740	to inject messages onto there. Now serial networks have got a bit of an issue here. You can just
912740	918520	generally spoof messages. If the ballast tank is sending out a message of a given type, you can send
918520	923060	out another message of the same type onto that serial network. There's no way to tell that you've
923060	929800	been spoofing that. The problem here is, of course, is the bridge systems will trust that data. So what
929800	934820	we found is we could inject our own ballast tank levels, our own fuel tank levels, onto this system.
936380	940700	So the problem here, the load computer system needed a network connection and the third party
940700	945640	found that arbitrary wall ports connected together. So they used them. That meant the load computer is
945640	950120	accessible from any wall port. A shared password that we learned on a previous test allowed us to
950120	955320	gain access to that load computer. We could pivot to the IP serial converter. We could inject tank
955320	961480	readings onto the control network and then we could spam the bridge ICMS. We could spam all of the
961480	966160	screens on the bridge, giving them wrong ballast tank readings. Now what's the ICMS going to do when
966160	970160	it's receiving two different readings? It's going to probably toggle between the two. There might be
970160	974780	some filtering. What happens if we spam twice as fast? What happens if we change how the messages are
974780	980460	sent? The thing here is when you're on the bridge you want to concentrate on navigating. You want to
980460	985460	concentrate on safety. If suddenly you're getting loads and loads of alarms showing up saying that
985640	990580	a fuel tank's empty, that a ballast tank's full, that something's leaking, that would be really bad.
990580	996660	It distracts the navigators on the bridge. So it causes a denial of service to certain services.
996680	1000280	It might be the case that when this happens someone would have to go around and do something
1000280	1004420	called manual tank dippings. You actually dip a weight with a string into the tanks to find out
1004420	1011300	how much is in them. It becomes time consuming, so something you want to avoid. Now issue three,
1011300	1018000	time and tide wait for no VLAN. Yeah these puns are bad, sorry. Now coming back to the idea of the
1018000	1023760	cabin switch, it's got that black trunk network flowing through it that's got all of these TV,
1023760	1028720	VoIP phones, Wi-Fi, all of these different VLANs that are quite interesting to us as an attacker.
1028780	1033480	Now the problem is this cabin switch was located in the passageway, the corridor between the cabins.
1033480	1038160	They're quite narrow on a cruise ship, so I had to open a panel, I had to open the box it was in,
1038160	1042520	I had to then physically unscrew the switch and then connect to it to mess about with it. The
1042520	1048340	problem with this is 500 CCTV cameras, people walking up and down the passageways, you're
1048340	1052640	getting in the way, you're going to get noticed. So we thought, well what can we do to make this
1052640	1057440	easier? What can we do to access this from our cabin? So coming back just down to one individual
1057440	1063360	cabin, what we did first off was we disconnected our TV and VoIP phone. So we just unplugged the
1063360	1068860	ethernet cables from the back of them. We then went to the cabinet in the wall in the passageway
1068860	1075720	and we bridged directly onto the trunk with those cables. So we took our cabin switch out of the
1075720	1080980	network. So it was feeding into our cabin via this structured cabling that was already installed.
1081140	1087140	We then put our own switch into that loop. So now we were part of that VLAN trunk. We were
1087140	1092800	connected in that big loop. What that meant was we could intercept all of the traffic flowing
1092800	1097960	about that VLAN and we could connect to all of the devices on those VLANs as well. So this gave us
1098180	1102900	a lot of power. We found out the TVs had default passwords. We couldn't really do much apart from
1102900	1107140	stop them working though. The VoIP phones, again default passwords, we could change their settings
1107140	1112280	so they didn't work. The Wi-Fi was actually really quite secure. There wasn't much we could do to that.
1112440	1119080	The CCTV however, the CCTV VMS, the video management system, connected out to all of the cameras
1120300	1125420	using RTSP, which is a plain text protocol. Now there was authentication, the cameras did require
1125420	1130600	login, but we could intercept as well as connect to the cameras. So we could see the password flying
1130600	1135360	about on the network, which meant we could connect to all of the cameras on the ship and view all of
1135360	1141840	them just from the comfort of our own cabins. So this was a bit of an issue. Now coming back to
1141840	1147620	that cabin control system that does the lighting, the HVAC, door and water. Now most systems like
1147620	1152380	this that have got hundreds of nodes will connect back to a server. So they make a connection from
1152380	1157080	the device through to the server. This one's a bit weird though. It worked the other way around.
1157080	1163120	The cabin control server established connections out to the cabin controls in the cabins. This was
1163560	1167920	a bit weird, but what that meant was we didn't have to compromise the cabin control server to
1167920	1172980	interact with the cabin controls. We were on the VLAN that they were all on. So we could come along
1172980	1178700	with our switch and we could actually compromise all of the cabin controls. So we could turn the
1178700	1183380	lights on and off. We could mess about with the aircon. We could lock people out of their cabins.
1183380	1188920	We could even open doors on the accessibility cabins, the ones with automated doors. Quite a
1188920	1194760	lot of power. Again, you're impacting the passengers. You're costing them. You're making
1194760	1199020	them uncomfortable, which means they're going to complain. It's going to cost you money.
1199020	1202440	The other thing we thought would be amusing would be writing something on the side of the ship.
1202440	1207700	Now, some ships have this functionality where through the cabin control system, you can actually
1207700	1211820	write things on the side of the vessel. This isn't the one we tested, but it'd be great to write
1211820	1218000	something on the side of a ship that big. The other problem with this cabin control system was
1218000	1222440	that the switches were physically accessible to us. Now, of course, we had to be in the passageway,
1222440	1226580	but there's an attack that we carry out against switches quite a lot of the time. Now, it does
1226580	1232060	require physical access. Most Cisco switches have something called password recovery mode.
1232060	1237200	What that means is you can reboot it, and through the serial console on it, you can dump the
1237200	1242040	existing config file off it. The idea of this mode is that you can change the password if you've
1242040	1246780	forgotten it with physical access. But we're relying on dumping the config off a device and
1246780	1252100	it containing interesting information. Now, it can take things like what VLANs are. It will also
1252100	1258320	contain hashes or possibly even encrypted versions of the passwords. So we managed to dump a config
1258320	1262360	off one of the cabin control switches. It took about two or three minutes to get this,
1262360	1267040	which isn't too bad, and they were hashed passwords. We put them on our cracking rig.
1267040	1271940	It took, I think, about two days of effort to recover the password. Now, the password wasn't
1271940	1276340	bad. It was a reasonably good password. I mean, I know two days isn't too long, but it wasn't Cisco.
1276340	1284940	It wasn't ship. And we tried that against the cabin switches, but none of them had a network
1284940	1289080	logon. So you could plug into them via serial and connect, but that's not particularly bad.
1289260	1294640	However, remember, we've got access to this trunk, which means we've got access to those RDPs.
1294640	1299820	And what we found was one of the RDPs had left its management interface exposed to the trunks
1299820	1305700	that we could access. And that RDP had left the web interface enabled. That username and password
1305700	1311020	recovered from one cabin switch worked on that single RDP. Now, it turns out that during
1311020	1316440	commissioning, that single RDP hadn't fully been commissioned. So they hadn't changed the password
1316440	1322240	on it. We gained access to that RDP, and that allowed us to intercept all of the traffic on
1322240	1326620	that fiber trunk. So it wasn't just the things on the cabin switch loops anymore. It was pretty
1326620	1331500	much everything on the vessel outside of the ICMS, the industrial control systems.
1332440	1337180	So these VLAN trunks run all over the ship, and you can connect from inside the cabin using the
1337180	1343180	phone cables. And it allows access to many, many systems. But it also allows sniffing to get any
1343180	1349560	plain text auth. So not using HTTPS actually had impact here. The cabin switches had that brute
1349560	1354600	forcible password, and that password worked on just one part of the core network. That allowed
1354600	1359640	us to intercept all of the VLAN trunks. So we've got a pretty significant compromise here. Now,
1359640	1363520	this was just an omission, and it did take quite a lot of effort to get to this point. But it was
1363920	1370780	a problem, a vulnerability. Issue four, I'm the captain now. Now, if you've been on a cruise
1370780	1378160	recently, you'll probably notice that a lot of the crew will carry tablets. So when you muster,
1378160	1382960	if there's a safety drill, they'll be taking muster on a tablet. If you order in one of the
1382960	1387320	restaurants, it will be on a tablet. If they come to your room with room service, they will have
1387540	1394160	a tablet. And this is quite broadly called a passenger management system, a PMS. And it deals
1394160	1397720	with lots of things. It does cabin assignment. It does access control. So quite often, it will
1397720	1402180	be linked into the access control system so that your card works on your cabin. It does restaurant
1402180	1406760	booking and the billing in the restaurant. It does mustering. And it also can hold your passport
1406760	1413020	details for immigration. It's kind of core to how the vessel operates. Now, what we found was all of
1413020	1417780	the tablets on this vessel used 8021X certificates for the Wi-Fi. And the tablets were actually
1417780	1422540	quite well hardened. We couldn't get anything off them easily. So we couldn't get those certificates
1422540	1428960	to gain access to the Wi-Fi. And we could have spent time doing something to possibly root one
1428960	1434500	of the tablets or gain the creds from somewhere else. But remember, we've got access to every
1434500	1439500	VLAN on the vessel, including the VLAN that carries the Wi-Fi traffic from all of the tablets.
1439500	1446140	And we can intercept that traffic, which is what we did. So we found that the tablets, although
1446140	1452100	they're using 8021X, that was actually implemented by the cruise company. They decided they wanted to
1452100	1458480	layer that security on top. However, the PMS used HTTP. There was no encryption between the tablets
1458480	1464640	and the server. That let us sniff credentials and other things going backwards and forwards.
1465460	1470460	What we found, of course, was that there was a SQL server which was passing its username and
1470460	1476060	password in the plane across this network. So once we gained access to those VLAN trunks,
1476060	1480780	we could get this username and password. We could then add our own user into the passenger
1480780	1486400	management system, and we could pretty much do what we want. So I could book myself into the
1486400	1493000	best restaurant on the ship and not have to pay for it, for example. But perhaps more fun was we
1493000	1498180	worked out how to log in as the captain on this system. So we could go to the restaurant,
1498180	1502160	we could order the most expensive bottle of wine, and we could bill it to the captain.
1502500	1506380	So this isn't good, really. This is a serious impact.
1508520	1512780	The PMS had good Wi-Fi security that was put in place by the cruise company,
1512780	1518300	but the PMS vendor used HTTP for the communications. It just wasn't secure enough.
1518360	1522500	We've covered those common SQL creds. We've not managed to test them on any other ships.
1522500	1527160	They could be the same across other ships. And with that, we could become anyone.
1527500	1532360	We could wipe details. We could order things in restaurants. It's pretty crazy.
1532740	1538180	So I think we pretty comprehensively owned this ship. It was a really, really good fun test.
1538600	1544080	So what is the conclusion here? Well, these attacks did require detailed knowledge.
1544480	1548360	We had to be on the vessel. We had to have a good level of understanding.
1548360	1556180	We weren't really strictly detected. One of the problems with a ship is it's hard to perform
1556180	1561260	things like intrusion detection remotely. So you might be able to sniff traffic and things like
1561260	1565220	that, but you've only got a limited amount of bandwidth to send that back to a SOC.
1565460	1572840	So no one really noticed us. We dressed smartly. And the couple of times that people noticed us
1572840	1575960	opening cabinets and things like that, no one said anything.
1575960	1580800	Now, interestingly, most of the risks on the ship were actually introduced by third parties.
1580800	1585280	The cruise company had done a lot to secure those networks, but it was third parties putting
1585280	1591160	systems in and making mistakes and not doing security properly that introduced most risks.
1591480	1597440	Now for a ship, denial of service is very costly. If you can stop a cruise ship leaving its berth,
1597440	1601080	especially in one of the smaller ports where there's only one or two berths,
1601080	1605380	and another ship's waiting to come in, the port can charge you huge sums of money.
1605380	1610500	We're talking tens or even possibly hundreds of thousands of dollars per day. You've got passengers
1610500	1614740	complaining. You're going to possibly have to reschedule flights, get hotels for people,
1614740	1619860	your next cruise may be delayed. So causing any denial of service, whether that's locking people
1619860	1624660	out their cabins or stopping the ship sailing, can cost you huge sums of money. So don't always
1624660	1628540	think about it as steering another ship into another ship. Think about how you can impact
1628540	1633460	the passengers. But lastly, cruise ships are massive amounts of fun. It's rare that you'd
1633460	1640260	be able to explore such huge complex machines with such level of detail. Definitely one of the
1640260	1646620	most fun tests I've been on this one. Thanks for listening. I'm Cyber Gibbons on Twitter.
1646620	1651880	If you've got any questions or you want to know anything more, just ping me a DM or
1651880	1655880	send me a message on Twitter. That'd be great. Thanks for listening. Bye.