Researchers Highlight Security Vulnerabilities In Ship-Tracking System

When it works normally, the Automatic Identification System (AIS) used by ships can be a captain's best friend, helping him or her avoid collisions on the high seas. Under the control of a hacker however, AIS could become a captain's worst enemy.

At the upcoming Hack in the Box Security Conference in Malaysia, a team of security researchers are preparing to demonstrate how an attacker could hijack AIS traffic and perform man-in-the middle attacks that enable them to turn the tracking system into a liability.

AIS is an automatic tracking system intended to help identify and locate vessels electronically to help avoid collisions on the water. AIS transponders on the ships include a GPS receiver and VHF transmitter, which transmits information to other vessels or base stations. AIS is required on many vessels, including international voyage ships weighing 300 tons or more and all passenger ships regardless of size.

According to Trend Micro's Kyle Wilhoit, one of the researchers who worked on the project, says the attacks can be broken up into two categories: those that target the AIS Internet providers that collect and distribute AIS information, and those that target flaws in the actual specification of the AIS protocol used by hardware receivers in all of the vessels. Without getting too deep into the vulnerabilities ahead of the presentation, which is slated for Oct. 16, Wilhoit explains that the upstream providers fail to authenticate AIS sentences coming from ships.

"I could go out, and I could pretend to be a boat, and they don't even fact-check it," he says. "They don't look at, OK ... is this AIS sentence actually a boat? They don't check any of that. So it's all accepted as is. It's accepted as true."

According to Wilhoit, these conditions could allow an attacker to tamper with valid AIS data and do everything from modify a ship's position to creating a fake vessel with the same details to fool anyone monitoring ships at sea.

The researchers are also prepared to demonstrate how the other set of attacks could be used to perform a variety of malicious actions, including fake "man-in-the-water" distress beacons -- which would trigger alarms on any vessels using AIS within approximately 50 KM -- as well as fake a CPA (closest point of approach) alert and trigger a collision warning alert.

"The complexity of the attack is what I would consider 'somewhat complex,'" Wilhoit says. "This is because the AIS protocols are typically not ... researched by security researchers. Therefore, there's a learning curve with the protocols, uses, [and] implementations of AIS. However, once you gain access to the AIVDM sentences, it's in clear text, which makes it somewhat easy to modify. Also, you have to reverse engineer the AIVDM sentences and be able to put them back together in order to correctly perform attacks -- which proved to be somewhat difficult."

The cost of performing the attack is relatively cheap: The necessary equipment can be purchased for between $100 and $300, depending on the attack.

The researchers are working with upstream providers and others on addressing the vulnerabilities, Wilhoit says.

"From the online Web providers, such as Marinetraffic.com, implementing authentication from every vessel submitting sentences would help mitigate the problem fairly quickly," he notes. "However, the fundamental problems with the AIS protocols would require a complete overhaul -- which is difficult because it's implemented worldwide in thousands of devices."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.