HITB Throwback Thursday: Look At Me - I’m The Captain Now
By: Weixien Toh
Just like planes are tracked via ADS-B (Automatic Dependent Surveillance–Broadcast), ships and ocean going vessels are monitored using the Automatic Identification System or AIS - a tracking system that uses on-board transceivers supplemented where needed by satellite tracking. AIS information coupled with marine radar continues to be one of the primary methods of collision avoidance in open water.
It was through the hijacking of AIS that Dr. Marco Balduzzi put Vincenzo Gambi to shame when he and his fellow “pirates”, Kyle Wilhoit and Alessandro Pasta, created a “ghost ship” to appear on a lake in Dallas while it was physically located hundreds of miles away in the Mississippi River.
Using a 100 euro very high frequency (VHF) radio, Marco and his compatriots discovered flaws in AIS that could allow attackers to hijack and perform man-in-the-middle attacks on existing vessels, create fake vessels at will, trigger false SOS notifications or collision alerts. They could even permanently disable AIS tracking on any vessel - remotely.
They revealed how they were able to sit within a few miles of a port and manipulate VHF radio frequencies to make their own fake AIS’ signal and have them appear as if they were coming from the port or other ships. To make things even scarier, they could also potentially convince other ships’ AIS trackers that they were on a collision course with a fictional vessel or make lighthouses pop out of nowhere!
The trio invariably made waves in maritime circles during 2013’s HITB Security Conference where they presented the inner workings of AIS and demonstrated real exploits and attack vectors against both the underlying software as well as RF based attacks.
Since then, Marco and gang have been actively working on uncovering other wireless and radio focused attacks and have also developed their own radio frequency contest called Capture the Signal - a challenge-based CTF that focuses exclusively on the reverse engineering of radio signals.
Come say ahoy to Dr. Marco and try your hand at blind signal analysis at this year’s HITB⁺CyberWeek where Marco alongside Sébastien Dudek, Federico Maggi, @miaoski, JonA & Josiah will be running a Catch the Signal (CTS) competition supported by Trend Micro. Further contest details and registration is here.
