Taking on the Dark Fleet in Cyberspace

The talk looks at the United States-led crackdown on dark fleet tankers, vessels that carry sanctioned oil under false flags, shell-company ownership, and rotating registrations. Coast Guard Cyber Command's cyber protection teams join the physical boardings of these ships. Their job is to establish a secure cyber posture on vessels they have never seen, across both IT and OT systems, while protecting the boarding team and the crew. The speakers note that equipment, power and connectivity had to be planned for austere conditions at sea.

The middle of the talk covers what the teams found. Flat networks put crew Wi-Fi, admin workstations and bridge systems in one broadcast domain. Satellite links fed unauthenticated wireless access points, and USB drives and hand-made Ethernet cables bridged supposed air gaps to engineering systems. Many machines ran unsupported Windows versions with pirated software and old worms still active. Remote access tools were used to wipe disks. Navigation data was also manipulated: AIS antennas were wrapped to attenuate their signal, NMEA sentences were injected, and LRIT satellite terminal firmware had been altered. The team also recovered forged port stamp software.

The takeaway is that the line between physical and digital risk has largely disappeared. Legacy marine electronics that trust unauthenticated serial data need monitoring and segmentation, and the speakers urge security researchers to help secure them before a maritime accident is traced to something as simple as an unsegmented cable.