WEBVTT 00:00.000 --> 00:02.400 Speed 2, the Poseidon Adventure. 00:02.520 --> 00:06.960 Now this is a tale of how we tested one cruise ship over the course of one week. 00:06.960 --> 00:09.280 There were two of us on the vessel, me and a colleague. 00:09.460 --> 00:11.500 Six engines on this ship. 00:11.500 --> 00:12.740 It was quite a big one. 00:12.900 --> 00:14.380 There was a seven meter swell. 00:14.380 --> 00:19.960 Now the weather got quite rough at one point, at which point I found out my colleague was actually quite seasick. 00:20.540 --> 00:22.400 Yeah, it was pretty rough to be honest. 00:22.660 --> 00:32.920 There were 500 Wi-Fi access points distributed across the ship, 500 CCTV cameras, 1,200 crew and over 2,000 passengers. 00:32.920 --> 00:35.940 So this is really really quite a big place. 00:36.200 --> 00:40.540 And there were of course a pile of vulnerabilities, some of which I'm going to tell you about now. 00:40.660 --> 00:43.540 So what is on a brand new cruise ship? 00:43.540 --> 00:47.240 Well it's not only a ship obviously, but it's also a hotel. 00:47.240 --> 00:49.700 It's got to perform all those hotel functions. 00:49.740 --> 00:55.760 You've got shopping malls, so you've got shops, you've got restaurants, you've got all of these different things going on, taking payments and so on. 00:55.760 --> 00:58.360 And lots lots more when you think about it. 00:58.360 --> 01:01.700 When we break it down a bit further, we've got the off-board communication. 01:01.700 --> 01:04.760 So we've got VSAT, Iridium and fleet broadband, things like that. 01:04.760 --> 01:06.000 The ship's radio. 01:06.200 --> 01:12.520 We've got physical security, so how do we stop people getting onto the bridge, into the machine rooms, into the engine room. 01:12.520 --> 01:17.920 We've got to keep the navigation systems up to date and secure so the ship can navigate safely. 01:18.040 --> 01:24.080 You've got all the networking equipment spread across the vessel, both passenger and industrial control side of things. 01:24.100 --> 01:29.300 You've got the load computer and the load monitoring systems to make sure the stability of the vessel is good. 01:29.300 --> 01:31.240 You've got all the ICS equipment. 01:31.240 --> 01:32.520 You're going to have a crew network. 01:32.520 --> 01:37.560 People can browse the internet on their laptops and phones when they're away from home for long periods of time. 01:37.820 --> 01:40.620 And it just gets complex really really fast. 01:40.620 --> 01:42.820 The attack surface is huge. 01:43.300 --> 01:50.440 So a modern cruise ship, and this isn't the one we tested, it's just an image, is divided up into vertical fire zones. 01:50.680 --> 01:53.540 Now these are both fire and water tight barriers. 01:53.540 --> 02:02.570 The idea is if there's a fire or a hole in the vessel it still stays safe, so that fire can't spread quickly and water can't get from one compartment to another. 02:03.000 --> 02:05.040 Now why is this relevant to us? 02:05.040 --> 02:09.060 Well it drives how the network is designed. 02:09.620 --> 02:12.860 So the network is divided up into fire zones. 02:12.860 --> 02:16.360 So we've got something called an RDP, a remote distribution point. 02:16.360 --> 02:19.820 It's essentially a very very large rack of Cisco gear. 02:20.040 --> 02:23.200 There'll be multiple ones of these per fire zone. 02:23.320 --> 02:28.420 Now for each fire zone we need to split that network out into other ones. 02:28.420 --> 02:31.100 So what we have are things called cabin switches. 02:31.100 --> 02:35.460 So we've got multiple loops of cabin switches on each RDP. 02:35.720 --> 02:40.080 So those cabin switches are connected via wired ethernet, the RDPs are connected via fiber. 02:40.080 --> 02:44.420 So we'll have big big loops of cabin switches, maybe 10 or 20 cabins. 02:44.520 --> 02:47.440 So each RDP will have multiple loops on it. 02:47.760 --> 02:53.900 Now to provide a degree of redundancy they actually have port and starboard side RDPs as well. 02:53.900 --> 02:56.360 So they're all connected via a fiber network. 02:56.480 --> 02:58.860 Now of course as well you're going to have servers. 02:59.020 --> 03:06.620 So you've got things like the TV, you've got the Wi-Fi access, you've got the VSAT so you can gain access to the internet when you're on the vessel. 03:06.700 --> 03:08.360 So this is kind of what it looks like. 03:08.360 --> 03:17.080 It's divided up into these fire zones and you've got this massive loop of RDPs connected via fiber with lots of cabin switches connected in loops. 03:17.320 --> 03:19.700 Now this is what one of those RDPs looks like. 03:19.700 --> 03:22.300 This is half of one of them. 03:22.300 --> 03:23.780 So you can see the sheer scale here. 03:23.780 --> 03:28.280 Bear in mind each pair of ethernet cables coming out there, it's actually going through a loop of cabins. 03:28.420 --> 03:32.400 So when you think about the sheer scale of this, it really is quite huge. 03:33.760 --> 03:38.780 Now to look into one of those loops in more detail, I've broken one of those cabin switches out. 03:39.160 --> 03:41.920 Now there'll be a cabin and we've got IPTV. 03:42.000 --> 03:51.600 So you can watch the TV in your cabin and some of it's streamed from servers, there's live broadcasts of the shows on the ship, that will be done over IP. 03:51.600 --> 03:54.720 And it's on a VLAN and it's connected into the cabin. 03:54.760 --> 03:58.560 You've got a VoIP phone as well, so that's another network connection into the cabin. 03:58.620 --> 04:02.160 But then the really interesting one to me was the cabin control system. 04:02.160 --> 04:10.280 And that controls the lighting, it controls the HVAC or the air conditioning, it controls the door, the access control, and it controls the hot water as well. 04:10.320 --> 04:17.620 It's really important that you heat the water up beyond a certain point periodically to prevent Legionnaire's disease on ships. 04:17.820 --> 04:19.520 Now that's quite a lot of control. 04:19.520 --> 04:27.020 The reason they have it is when a cabin's unoccupied, they can turn the lights off, they can turn the HVAC down so that they're not using as much energy. 04:27.280 --> 04:29.640 And yeah, it's an important system. 04:29.920 --> 04:33.280 Now each cabin switch actually worked on a pair of cabins A and B. 04:33.280 --> 04:36.220 They were almost identical in almost all situations. 04:36.500 --> 04:40.620 But some cabin switches also had other networks hanging off them. 04:40.620 --> 04:45.740 So they had Wi-Fi access points, 500 Wi-Fi access points that were distributed across the vessel. 04:45.740 --> 04:50.760 Ships are made of metal, which means you have to have a lot of access points to have good coverage. 04:50.760 --> 04:53.420 But we also had all of the CCTV cameras. 04:53.460 --> 05:01.680 What that means is that that trunk that flows through the cabin switches contains the TV, the cabin control, the Wi-Fi, and the CCTV. 05:01.820 --> 05:04.320 So it's quite an important trunk network. 05:05.100 --> 05:07.320 So what is the threat model here? 05:07.340 --> 05:09.480 Well, I called this talk Speed 2. 05:09.480 --> 05:10.940 Why did I call it Speed 2? 05:10.940 --> 05:19.740 Well, I don't know if you've seen Speed 2, but in Speed 2, an engineer of the shipping company on the vessel, sailing on it, takes control. 05:19.740 --> 05:22.500 He also kills the captain, but we're going to ignore that bit. 05:22.500 --> 05:26.960 He takes control of the ship and he programs it to crash into another ship. 05:26.960 --> 05:30.240 So the important thing here is the attacker was already on board. 05:30.240 --> 05:32.780 It's not always remote attack we're worried about here. 05:32.780 --> 05:38.500 When you regularly invite 2000 people onto your ship, there's a chance that some of them might be malicious. 05:38.500 --> 05:44.280 Now, they might not be malicious enough to crash the ship into another ship, but they still might want to do bad things. 05:44.360 --> 05:45.940 So what are the risks? 05:45.940 --> 05:48.200 Well, Speed 2 highlighted control of the vessel. 05:48.200 --> 05:53.900 Now, if you've got physical access to the controls on the ship, you can nearly always take control of it. 05:53.900 --> 05:58.460 But the thing is, the crew should nearly always be able to stop that. 05:58.460 --> 06:05.720 Despite the fact that all of this fancy control systems connect everything together, you can nearly always take manual control of things. 06:05.720 --> 06:06.980 You can at least stop them. 06:06.980 --> 06:09.820 You can always take control of certain things. 06:10.300 --> 06:14.760 So control of the vessel also needs a fairly strong motivation. 06:14.760 --> 06:20.660 For an attacker to want to steer a ship into another ship, particularly one with 2000 people on it, they've got to have a screw loose. 06:20.920 --> 06:26.840 So although the impact of this is huge, the likelihood is probably quite low. 06:27.440 --> 06:31.560 But the other thing that cruise companies are worried about is loss of passenger services. 06:31.800 --> 06:39.200 So if everybody's suddenly locked out of their cabin and has to visit guest services, that's 2000 people queuing up to get new access cards. 06:39.320 --> 06:45.300 If the ship can't sail from a port or the ship can't dock at a port, they're going to have to pay money. 06:45.300 --> 06:50.960 If people can't pay for things in the shop, if they can't order in the restaurant, it costs the cruise company money. 06:50.960 --> 06:54.020 And this is what we were trying to investigate, mainly on this test. 06:54.020 --> 06:57.820 What impact could we cause by impacting the passengers? 06:58.840 --> 07:00.580 I'm going to talk about a few issues here. 07:00.580 --> 07:03.400 The first one, the satisfying Wi-Fi. 07:03.660 --> 07:09.180 Now there was guest Wi-Fi on this ship, so these access points were spread about the vessel. 07:09.180 --> 07:16.480 Now they gave access to the corporate network, they gave access to the passenger management system that we'll talk about later, but they also had the guest Wi-Fi. 07:16.720 --> 07:20.960 Now we could connect to that obviously, and then we could start exploring the network. 07:21.000 --> 07:25.600 Now one of the first things that we do when we connect to a guest network like this is we do a trace route. 07:25.600 --> 07:34.460 And we did a trace route out to Google DNS, and what we could see was the first few ping times were 25 milliseconds, give or take, which means we're on the vessel. 07:34.460 --> 07:37.900 The ones after that jump up to 700 plus milliseconds. 07:37.900 --> 07:40.840 That means we've gone over that VSAT link. 07:40.840 --> 07:50.040 VSAT satellite connections are latent, we know those first three steps in the routes are on the vessel, so we decided to explore them in more detail. 07:50.160 --> 07:56.980 And what we found was, in fact, that second to last hop allowed us access to equipment in the VSAT rack. 07:57.140 --> 08:00.960 So from the guest Wi-Fi, we can connect through to the VSAT rack. 08:01.040 --> 08:08.960 Now we've worked a lot on VSAT equipment in the past, so we know the default passwords for most of the bits of equipment. 08:08.960 --> 08:14.420 So we found that we could log into the modem, we found that we could log into the router, so we could log into the modem. 08:14.520 --> 08:18.540 Now the modem tunnels all traffic on and off the vessel. 08:18.540 --> 08:28.220 What my colleague did was spend a period of time looking at the firmware, examining how that device operated, and what he found was that he could gain route access to that device. 08:28.420 --> 08:34.340 So now we've got route access on a device that all of the off-board traffic's going in and out of. 08:34.340 --> 08:38.520 We could therefore intercept it, so we could intercept everything going on and off the vessel. 08:38.520 --> 08:42.920 So any credentials in plain text, anything unencrypted, was ours to see. 08:42.920 --> 08:47.460 So this is quite a serious problem, especially as we could do it from anywhere on the guest Wi-Fi. 08:48.040 --> 08:51.740 So the problem here was the passenger Wi-Fi had access to the VSAT equipment. 08:51.920 --> 08:54.480 There were default passwords on the VSAT equipment. 08:54.540 --> 08:59.920 There was a vulnerability that allowed route access, which allowed us to intercept all off-board traffic. 09:00.040 --> 09:02.440 Now the thing was this could be solved at multiple stages. 09:02.620 --> 09:09.600 The network could be altered so the passenger Wi-Fi couldn't access all of these management interfaces on those devices. 09:09.880 --> 09:16.640 The VSAT installer, a third party, could have changed the passwords on those so that we couldn't just trivially guess them. 09:16.640 --> 09:21.600 The vendor could have not had a vulnerability in their device, which could have prevented us doing this. 09:21.600 --> 09:24.020 But you'll notice I mentioned the third party there. 09:24.020 --> 09:28.760 All of the VSAT equipment is installed by a third party, not the cruise company. 09:28.900 --> 09:33.340 So that will come in back in a few vulnerabilities. 09:34.580 --> 09:37.120 Issue two, just another hole in the wall. 09:38.320 --> 09:42.720 Now one of the most important things for safety of a ship is stability. 09:42.840 --> 09:49.060 So you've got to make sure that the fluid levels in all of your tanks keep the vessel stable. 09:49.140 --> 09:52.720 So if you ride too high in the water, you could be unstable. 09:52.720 --> 09:55.880 If you ride too low in the water, the ship's inefficient. 09:55.880 --> 10:00.260 If you put too much stress on the hull, the ship could become unsafe. 10:00.660 --> 10:05.420 Now ships are hugely complex now, and you can't do these calculations on paper. 10:05.420 --> 10:07.420 So you use something called a load computer. 10:07.440 --> 10:09.940 And this will take readings from all the tanks around the vessels. 10:09.940 --> 10:12.020 It will take things like the passenger manifest. 10:12.020 --> 10:16.660 It will take things like the stores telling you how much food, beer, wine is on board. 10:16.660 --> 10:21.400 And it will calculate if the vessel's stable or not and tell you what to do to make it stable. 10:22.160 --> 10:25.820 Now it's vital for a modern ship that this is there. 10:25.860 --> 10:28.260 And we managed to compromise it in this instance. 10:28.260 --> 10:37.900 But not only compromised the load computer, we also managed to cause a denial of service to bridge systems that were important for day-to-day operations. 10:38.520 --> 10:42.600 Now most of these ships have something called an integrated control and monitoring system. 10:42.600 --> 10:44.020 So that's all the screens on the bridge. 10:44.020 --> 10:48.220 That's all the screens and HMIs, all the PLCs down in the engine room. 10:48.220 --> 10:52.020 So it glues all of the industrial equipment on that ship together. 10:52.020 --> 10:56.280 So that'll be the power, the generators, the propulsion, the rudder. 10:56.280 --> 10:59.480 Everything is glued together by this massive system. 10:59.660 --> 11:04.620 Now it's a blend of IP and serial networks like you'd see in most industrial control systems. 11:05.480 --> 11:07.720 Now ideally it should be segregated. 11:07.720 --> 11:10.240 There should be an air gap between those two of them. 11:10.240 --> 11:14.700 So we've got the passenger network on one side and we've got the bridge network on the other. 11:14.780 --> 11:20.800 But quite often we find that this gets eroded by changes that are made by third parties. 11:20.800 --> 11:25.440 Now when we look into the bridge system in a bit more detail, we've got the IP devices. 11:25.440 --> 11:27.580 So the PCs driving the screens and so on. 11:27.580 --> 11:31.920 But they also need to interact with serial connected devices. 11:31.980 --> 11:37.720 So that would be things like GPS, anemometers, speed loggers, all of these different bits of equipment. 11:37.720 --> 11:44.160 But it also has to interact with the ballast tank monitoring system, the fuel tank monitoring system, and the hull stress monitoring system. 11:44.260 --> 11:47.640 So you've got these things called IP to serial converters. 11:47.660 --> 11:50.400 They go from an IP network through to a serial network. 11:50.400 --> 11:54.260 RS-232, RS-485, Modbus, something like that. 11:54.260 --> 11:57.360 So you can interact with these serial devices. 11:58.520 --> 11:59.940 They look like this. 11:59.940 --> 12:03.480 So on one side you've got Ethernet coming in, on the other side you've got serial. 12:03.480 --> 12:05.200 There's lots and lots of different brands. 12:05.200 --> 12:07.180 Moxa are probably one of the most popular ones. 12:07.180 --> 12:10.680 If you've done any industrial control system work you'll recognize these. 12:11.520 --> 12:14.900 Now you remember I mentioned the load computer? 12:14.920 --> 12:18.140 Now that has to get those readings from the ballast tanks and the fuel tanks. 12:18.500 --> 12:19.500 So how does it do that? 12:19.500 --> 12:32.800 Well they've got a load computer server that's buried in a machine room and it's got its own IP to serial converter that connects into one of the serial networks that's on the bridge that interacts with all of these different monitoring systems. 12:33.920 --> 12:40.220 Now to actually use the load computer there's got to be a UI, which is another computer set up on the bridge. 12:40.260 --> 12:41.560 So you've got a problem. 12:41.560 --> 12:43.560 How do you connect the two of them together? 12:43.560 --> 12:49.920 Now if you've ever worked on a ship you can't just go drilling holes through the floor, you can't just make holes in walls. 12:50.180 --> 12:57.640 You've got to go through specific cable penetrations and then put fire sealant around it, change requests, it's really really awkward. 12:57.640 --> 13:03.180 So if you've got to go down three decks you probably don't want to have to run a cable. 13:03.340 --> 13:13.820 Now this load computer was installed by a third party and what they found was that they could plug into any wall port and connect together. 13:14.220 --> 13:24.160 So that load computer server down in a machine room, there's a wall port near it, they plugged into it, they plugged the load computer into another wall port on the bridge and they found they could connect to each other. 13:24.980 --> 13:26.220 So they used it. 13:26.220 --> 13:29.300 That's a lot easier than making a hole through multiple decks. 13:30.640 --> 13:41.560 Now on this vessel what happened was if you plugged into a wall port, if you had an 8021X certificate for the corporate network or an 8021X certificate for the PMS, you'd gain access to that network. 13:41.560 --> 13:55.540 But if you didn't, you ended up in a tar pit, a specific VLAN and a specific network that didn't have internet access, didn't have access to other networks on the ship, but it was its own network and devices could communicate with each other. 13:55.580 --> 13:59.560 So this was what the load computer company exploited. 13:59.560 --> 14:03.580 They found they could just plug in, get tar pitted and communicate. 14:03.600 --> 14:17.820 But that becomes a bit of a problem because me as an attacker, I can come along and I can plug into a wall port in the bar, I can plug into a wall port next to the swimming pool and I gain access to that same tar pit. 14:17.900 --> 14:22.000 So now I had access to the load computer, UI and server. 14:22.340 --> 14:31.460 Now we've tested ships with this same load computer system on it before and what we found was there's a default username and password stored in an .ini file. 14:31.880 --> 14:36.260 Now with physical access to the machine, of course, you can read that username and password. 14:36.360 --> 14:43.740 A big problem on ships is that you can't lock computers on the bridge because they've got to be used and got to be used quickly. 14:43.740 --> 14:48.240 You can't be remembering a complex password, typing it in to gain access to something. 14:48.240 --> 14:49.180 So they stay unlocked. 14:49.180 --> 14:52.940 So we found this default username and password on a previous test. 14:53.060 --> 14:56.880 With that, what we could do was connect to that load computer server. 14:56.880 --> 15:01.480 We could then pivot through it to take control of the IP to serial converter. 15:01.820 --> 15:09.900 Now you've got those ballast tank levels, the fuel tanks, the whole stress monitoring system and I've now got the ability to inject messages onto there. 15:09.920 --> 15:12.220 Now serial networks have got a bit of an issue here. 15:12.220 --> 15:14.640 You can just generally spoof messages. 15:14.640 --> 15:21.580 If the ballast tank is sending out a message of a given type, you can send out another message of the same type onto that serial network. 15:21.580 --> 15:24.400 There's no way to tell that you've been spoofing that. 15:24.460 --> 15:29.200 The problem here is, of course, is the bridge systems will trust that data. 15:29.440 --> 15:34.820 So what we found is we could inject our own ballast tank levels, our own fuel tank levels, onto this system. 15:36.380 --> 15:43.040 So the problem here, the load computer system needed a network connection and the third party found that arbitrary wall ports connected together. 15:43.040 --> 15:44.200 So they used them. 15:44.340 --> 15:47.380 That meant the load computer is accessible from any wall port. 15:47.380 --> 15:52.060 A shared password that we learned on a previous test allowed us to gain access to that load computer. 15:52.060 --> 15:54.320 We could pivot to the IP serial converter. 15:54.320 --> 16:00.220 We could inject tank readings onto the control network and then we could spam the bridge ICMS. 16:00.220 --> 16:04.880 We could spam all of the screens on the bridge, giving them wrong ballast tank readings. 16:04.880 --> 16:07.840 Now what's the ICMS going to do when it's receiving two different readings? 16:07.840 --> 16:09.760 It's going to probably toggle between the two. 16:09.760 --> 16:10.900 There might be some filtering. 16:10.900 --> 16:12.820 What happens if we spam twice as fast? 16:12.820 --> 16:15.580 What happens if we change how the messages are sent? 16:15.740 --> 16:20.160 The thing here is when you're on the bridge you want to concentrate on navigating. 16:20.160 --> 16:21.980 You want to concentrate on safety. 16:21.980 --> 16:30.580 If suddenly you're getting loads and loads of alarms showing up saying that a fuel tank's empty, that a ballast tank's full, that something's leaking, that would be really bad. 16:30.580 --> 16:33.460 It distracts the navigators on the bridge. 16:33.460 --> 16:36.660 So it causes a denial of service to certain services. 16:36.680 --> 16:41.520 It might be the case that when this happens someone would have to go around and do something called manual tank dippings. 16:41.520 --> 16:45.800 You actually dip a weight with a string into the tanks to find out how much is in them. 16:45.800 --> 16:49.020 It becomes time consuming, so something you want to avoid. 16:50.180 --> 16:53.520 Now issue three, time and tide wait for no VLAN. 16:53.700 --> 16:55.380 Yeah these puns are bad, sorry. 16:56.360 --> 17:08.720 Now coming back to the idea of the cabin switch, it's got that black trunk network flowing through it that's got all of these TV, VoIP phones, Wi-Fi, all of these different VLANs that are quite interesting to us as an attacker. 17:08.780 --> 17:13.480 Now the problem is this cabin switch was located in the passageway, the corridor between the cabins. 17:13.480 --> 17:22.320 They're quite narrow on a cruise ship, so I had to open a panel, I had to open the box it was in, I had to then physically unscrew the switch and then connect to it to mess about with it. 17:22.320 --> 17:30.180 The problem with this is 500 CCTV cameras, people walking up and down the passageways, you're getting in the way, you're going to get noticed. 17:30.520 --> 17:32.960 So we thought, well what can we do to make this easier? 17:32.960 --> 17:35.140 What can we do to access this from our cabin? 17:35.600 --> 17:42.360 So coming back just down to one individual cabin, what we did first off was we disconnected our TV and VoIP phone. 17:42.420 --> 17:45.420 So we just unplugged the ethernet cables from the back of them. 17:45.500 --> 17:52.700 We then went to the cabinet in the wall in the passageway and we bridged directly onto the trunk with those cables. 17:52.700 --> 17:56.660 So we took our cabin switch out of the network. 17:56.660 --> 18:00.980 So it was feeding into our cabin via this structured cabling that was already installed. 18:01.140 --> 18:04.720 We then put our own switch into that loop. 18:04.760 --> 18:06.960 So now we were part of that VLAN trunk. 18:06.960 --> 18:09.200 We were connected in that big loop. 18:09.200 --> 18:17.380 What that meant was we could intercept all of the traffic flowing about that VLAN and we could connect to all of the devices on those VLANs as well. 18:17.440 --> 18:19.160 So this gave us a lot of power. 18:19.160 --> 18:21.500 We found out the TVs had default passwords. 18:21.500 --> 18:24.260 We couldn't really do much apart from stop them working though. 18:24.260 --> 18:28.380 The VoIP phones, again default passwords, we could change their settings so they didn't work. 18:28.540 --> 18:30.580 The Wi-Fi was actually really quite secure. 18:30.580 --> 18:32.280 There wasn't much we could do to that. 18:32.440 --> 18:43.000 The CCTV however, the CCTV VMS, the video management system, connected out to all of the cameras using RTSP, which is a plain text protocol. 18:43.500 --> 18:48.860 Now there was authentication, the cameras did require login, but we could intercept as well as connect to the cameras. 18:48.880 --> 18:58.840 So we could see the password flying about on the network, which meant we could connect to all of the cameras on the ship and view all of them just from the comfort of our own cabins. 18:59.040 --> 19:00.440 So this was a bit of an issue. 19:01.220 --> 19:05.880 Now coming back to that cabin control system that does the lighting, the HVAC, door and water. 19:06.300 --> 19:11.320 Now most systems like this that have got hundreds of nodes will connect back to a server. 19:11.320 --> 19:13.920 So they make a connection from the device through to the server. 19:13.920 --> 19:15.540 This one's a bit weird though. 19:15.580 --> 19:17.080 It worked the other way around. 19:17.080 --> 19:22.520 The cabin control server established connections out to the cabin controls in the cabins. 19:22.580 --> 19:29.500 This was a bit weird, but what that meant was we didn't have to compromise the cabin control server to interact with the cabin controls. 19:29.500 --> 19:31.980 We were on the VLAN that they were all on. 19:31.980 --> 19:37.800 So we could come along with our switch and we could actually compromise all of the cabin controls. 19:37.960 --> 19:39.680 So we could turn the lights on and off. 19:39.680 --> 19:41.500 We could mess about with the aircon. 19:41.500 --> 19:43.380 We could lock people out of their cabins. 19:43.380 --> 19:48.480 We could even open doors on the accessibility cabins, the ones with automated doors. 19:48.480 --> 19:49.720 Quite a lot of power. 19:50.700 --> 19:52.720 Again, you're impacting the passengers. 19:52.720 --> 19:53.900 You're costing them. 19:54.020 --> 19:56.800 You're making them uncomfortable, which means they're going to complain. 19:56.800 --> 19:58.200 It's going to cost you money. 19:58.640 --> 20:02.440 The other thing we thought would be amusing would be writing something on the side of the ship. 20:02.440 --> 20:09.120 Now, some ships have this functionality where through the cabin control system, you can actually write things on the side of the vessel. 20:09.120 --> 20:13.860 This isn't the one we tested, but it'd be great to write something on the side of a ship that big. 20:14.560 --> 20:20.560 The other problem with this cabin control system was that the switches were physically accessible to us. 20:20.560 --> 20:26.100 Now, of course, we had to be in the passageway, but there's an attack that we carry out against switches quite a lot of the time. 20:26.100 --> 20:28.380 Now, it does require physical access. 20:28.500 --> 20:32.060 Most Cisco switches have something called password recovery mode. 20:32.060 --> 20:39.200 What that means is you can reboot it, and through the serial console on it, you can dump the existing config file off it. 20:39.200 --> 20:43.900 The idea of this mode is that you can change the password if you've forgotten it with physical access. 20:43.980 --> 20:49.040 But we're relying on dumping the config off a device and it containing interesting information. 20:49.260 --> 20:51.180 Now, it can take things like what VLANs are. 20:51.180 --> 20:56.440 It will also contain hashes or possibly even encrypted versions of the passwords. 20:56.560 --> 21:00.220 So we managed to dump a config off one of the cabin control switches. 21:00.220 --> 21:05.160 It took about two or three minutes to get this, which isn't too bad, and they were hashed passwords. 21:05.260 --> 21:07.040 We put them on our cracking rig. 21:07.040 --> 21:10.880 It took, I think, about two days of effort to recover the password. 21:10.880 --> 21:12.460 Now, the password wasn't bad. 21:12.460 --> 21:13.880 It was a reasonably good password. 21:13.880 --> 21:16.340 I mean, I know two days isn't too long, but it wasn't Cisco. 21:16.340 --> 21:17.600 It wasn't ship. 21:18.140 --> 21:25.620 And we tried that against the cabin switches, but none of them had a network logon. 21:25.620 --> 21:29.080 So you could plug into them via serial and connect, but that's not particularly bad. 21:29.260 --> 21:34.640 However, remember, we've got access to this trunk, which means we've got access to those RDPs. 21:34.640 --> 21:41.200 And what we found was one of the RDPs had left its management interface exposed to the trunks that we could access. 21:41.320 --> 21:44.340 And that RDP had left the web interface enabled. 21:44.400 --> 21:49.760 That username and password recovered from one cabin switch worked on that single RDP. 21:49.980 --> 21:54.900 Now, it turns out that during commissioning, that single RDP hadn't fully been commissioned. 21:54.900 --> 21:57.200 So they hadn't changed the password on it. 21:57.200 --> 22:03.340 We gained access to that RDP, and that allowed us to intercept all of the traffic on that fiber trunk. 22:03.340 --> 22:06.200 So it wasn't just the things on the cabin switch loops anymore. 22:06.200 --> 22:11.500 It was pretty much everything on the vessel outside of the ICMS, the industrial control systems. 22:12.440 --> 22:18.480 So these VLAN trunks run all over the ship, and you can connect from inside the cabin using the phone cables. 22:18.480 --> 22:21.260 And it allows access to many, many systems. 22:21.340 --> 22:24.480 But it also allows sniffing to get any plain text auth. 22:24.480 --> 22:27.920 So not using HTTPS actually had impact here. 22:28.300 --> 22:33.880 The cabin switches had that brute forcible password, and that password worked on just one part of the core network. 22:33.880 --> 22:37.340 That allowed us to intercept all of the VLAN trunks. 22:37.340 --> 22:39.460 So we've got a pretty significant compromise here. 22:39.460 --> 22:42.900 Now, this was just an omission, and it did take quite a lot of effort to get to this point. 22:42.900 --> 22:45.380 But it was a problem, a vulnerability. 22:46.600 --> 22:48.880 Issue four, I'm the captain now. 22:49.520 --> 22:56.400 Now, if you've been on a cruise recently, you'll probably notice that a lot of the crew will carry tablets. 22:56.620 --> 23:02.060 So when you muster, if there's a safety drill, they'll be taking muster on a tablet. 23:02.060 --> 23:04.780 If you order in one of the restaurants, it will be on a tablet. 23:04.780 --> 23:08.320 If they come to your room with room service, they will have a tablet. 23:08.700 --> 23:13.680 And this is quite broadly called a passenger management system, a PMS. 23:13.680 --> 23:14.800 And it deals with lots of things. 23:14.800 --> 23:16.060 It does cabin assignment. 23:16.060 --> 23:17.120 It does access control. 23:17.120 --> 23:21.340 So quite often, it will be linked into the access control system so that your card works on your cabin. 23:21.340 --> 23:24.140 It does restaurant booking and the billing in the restaurant. 23:24.140 --> 23:25.280 It does mustering. 23:25.280 --> 23:28.260 And it also can hold your passport details for immigration. 23:28.260 --> 23:31.040 It's kind of core to how the vessel operates. 23:31.620 --> 23:36.540 Now, what we found was all of the tablets on this vessel used 8021X certificates for the Wi-Fi. 23:36.720 --> 23:38.920 And the tablets were actually quite well hardened. 23:38.920 --> 23:41.460 We couldn't get anything off them easily. 23:41.460 --> 23:44.520 So we couldn't get those certificates to gain access to the Wi-Fi. 23:44.800 --> 23:51.880 And we could have spent time doing something to possibly root one of the tablets or gain the creds from somewhere else. 23:51.900 --> 23:59.500 But remember, we've got access to every VLAN on the vessel, including the VLAN that carries the Wi-Fi traffic from all of the tablets. 23:59.500 --> 24:03.020 And we can intercept that traffic, which is what we did. 24:03.500 --> 24:10.680 So we found that the tablets, although they're using 8021X, that was actually implemented by the cruise company. 24:10.680 --> 24:14.220 They decided they wanted to layer that security on top. 24:14.220 --> 24:16.580 However, the PMS used HTTP. 24:16.580 --> 24:20.020 There was no encryption between the tablets and the server. 24:20.020 --> 24:24.640 That let us sniff credentials and other things going backwards and forwards. 24:25.460 --> 24:33.540 What we found, of course, was that there was a SQL server which was passing its username and password in the plane across this network. 24:33.840 --> 24:37.820 So once we gained access to those VLAN trunks, we could get this username and password. 24:37.820 --> 24:43.960 We could then add our own user into the passenger management system, and we could pretty much do what we want. 24:44.340 --> 24:50.700 So I could book myself into the best restaurant on the ship and not have to pay for it, for example. 24:50.960 --> 24:56.780 But perhaps more fun was we worked out how to log in as the captain on this system. 24:56.780 --> 25:02.160 So we could go to the restaurant, we could order the most expensive bottle of wine, and we could bill it to the captain. 25:02.500 --> 25:04.120 So this isn't good, really. 25:04.120 --> 25:06.380 This is a serious impact. 25:08.520 --> 25:16.560 The PMS had good Wi-Fi security that was put in place by the cruise company, but the PMS vendor used HTTP for the communications. 25:16.560 --> 25:18.300 It just wasn't secure enough. 25:18.360 --> 25:20.180 We've covered those common SQL creds. 25:20.180 --> 25:22.500 We've not managed to test them on any other ships. 25:22.500 --> 25:24.940 They could be the same across other ships. 25:25.220 --> 25:27.160 And with that, we could become anyone. 25:27.500 --> 25:28.860 We could wipe details. 25:28.860 --> 25:31.100 We could order things in restaurants. 25:31.100 --> 25:32.360 It's pretty crazy. 25:32.740 --> 25:36.100 So I think we pretty comprehensively owned this ship. 25:36.100 --> 25:38.180 It was a really, really good fun test. 25:38.600 --> 25:40.380 So what is the conclusion here? 25:40.660 --> 25:44.080 Well, these attacks did require detailed knowledge. 25:44.480 --> 25:46.020 We had to be on the vessel. 25:46.260 --> 25:48.360 We had to have a good level of understanding. 25:48.360 --> 25:51.560 We weren't really strictly detected. 25:52.260 --> 25:59.220 One of the problems with a ship is it's hard to perform things like intrusion detection remotely. 25:59.360 --> 26:05.220 So you might be able to sniff traffic and things like that, but you've only got a limited amount of bandwidth to send that back to a SOC. 26:05.460 --> 26:07.580 So no one really noticed us. 26:07.780 --> 26:09.700 We dressed smartly. 26:09.820 --> 26:15.960 And the couple of times that people noticed us opening cabinets and things like that, no one said anything. 26:15.960 --> 26:20.800 Now, interestingly, most of the risks on the ship were actually introduced by third parties. 26:20.800 --> 26:31.160 The cruise company had done a lot to secure those networks, but it was third parties putting systems in and making mistakes and not doing security properly that introduced most risks. 26:31.480 --> 26:34.760 Now for a ship, denial of service is very costly. 26:34.760 --> 26:45.380 If you can stop a cruise ship leaving its berth, especially in one of the smaller ports where there's only one or two berths, and another ship's waiting to come in, the port can charge you huge sums of money. 26:45.380 --> 26:49.460 We're talking tens or even possibly hundreds of thousands of dollars per day. 26:49.460 --> 26:51.420 You've got passengers complaining. 26:51.420 --> 26:56.840 You're going to possibly have to reschedule flights, get hotels for people, your next cruise may be delayed. 26:56.880 --> 27:04.200 So causing any denial of service, whether that's locking people out their cabins or stopping the ship sailing, can cost you huge sums of money. 27:04.200 --> 27:07.240 So don't always think about it as steering another ship into another ship. 27:07.240 --> 27:09.540 Think about how you can impact the passengers. 27:09.620 --> 27:12.500 But lastly, cruise ships are massive amounts of fun. 27:12.500 --> 27:19.160 It's rare that you'd be able to explore such huge complex machines with such level of detail. 27:19.380 --> 27:22.480 Definitely one of the most fun tests I've been on this one. 27:23.280 --> 27:24.680 Thanks for listening. 27:24.860 --> 27:26.620 I'm Cyber Gibbons on Twitter. 27:26.620 --> 27:33.560 If you've got any questions or you want to know anything more, just ping me a DM or send me a message on Twitter. 27:33.560 --> 27:34.420 That'd be great. 27:34.420 --> 27:35.380 Thanks for listening. 27:35.380 --> 27:35.880 Bye.