Cyber attacks on container ships and port infrastructure will get more sophisticated as time goes on and companies should be doing more to protect their supply chain security.
Maritime and IT security companies have raised their concerns after hackers attacked the container terminal software in Antwerp in an effort to pinpoint the location of containers concealing smuggled drugs so they could deliver them to bogus drivers.
Nick Davis, CEO of maritime security company GoAGT (Gulf of Aden Group Transits) , said: “Supply chain security in the future will be critical especially in the USA and mainland Europe, the sheer volume of mega ships that can carry 14,000+ twenty-foot equivalent unit (TEU) boxes presents the biggest security challenge for any port authority and customs network.”
He added: “The moving parts of the supply chain coupled with just in time delivery mean security is a necessary evil and one that is hugely misunderstood. Fusing data and more importantly sharing that data with agencies that can stem, illegal contraband, drugs, weapons and the like is a distant goal far from being achieved.”
Alex Fidgen, Director at IT security company MWR InfoSecurity , said: “After the port successfully detected the attack against their computer systems, they failed to map out other attack paths which allowed the attackers to achieve their objectives in this case. This demonstrates how important it is to not only focus on single systems but get a full overview of your organisation and the potential weaknesses in penetration testing exercises.”
He added: “This attack played out somewhat like an Advanced Persistent Threat (APT). They were apparently active for around two years, and were able to make use of advanced techniques with seemingly professional execution. However, this is what anyone can now buy on the black market as a service, so far from just being available to a nation state, anyone with money can purchase these services.”
Both organisations said that the attack showed the continued development in “professionalism” in the upper end of the black market and that organisations that facilitate large transactions will experience greater numbers of sophisticated attacks.
The kind of hardwaresoftware attack witnessed against Antwerp used to be the sole domain against attacks on banks, so there is a gradual transference to the ‘norm’.
The organisations said that the criminals might have overplayed their hand by providing such overt signs of compromise (I.e. stealing containers). But this only demonstrated how easy it is to remain non detected if criminals so wish.
Alex Fidgen said: “It shows that the types of attacks like this aren’t hypothetical and businesses should be doing penetration testing exercises to make sure that they have not been compromised.”
Nick Davis said: “This recent example in Antwerp will only get more sophisticated and better, and the chances of x-raying every container in every port is unfeasible and unworkable.”
MWR InfoSecurity, October 21, 2013