Scuttling Dashboards

The talk opens by explaining scuttling and arguing that maritime digitization is attaching telemetry and IoT devices to ship control systems faster than regulation can follow. The speaker, who runs a maritime security company, says many vessels carry unmanaged connections, and that console passwords are often written down on the bridge or in control rooms.

The middle section walks through several case studies. A cloud-connected monitoring component at an Indian power plant led to access across roughly 3,000 plants after a web application flaw was exploited. On ships, broken authentication and insecure direct object references in a cloud control plane exposed a vessel gateway with hundreds of main engine and steering tags, many of them writable. A second platform that managed shipboard firewalls and satellite terminals allowed attackers to reach vessel networks, and round-robin SOCKS proxies across a few ships could make traffic appear to come from a botnet of hundreds of vessels. An ECDIS chart display was also reachable over RDP with a default credential. The speaker adds that AI agents wired loosely into these APIs and over-provisioned cloud identities widen the same exposure.

The closing point is that dashboards shorten the path from initial access to physical impact, and that none of these cases needed a zero-day. Operators should treat telemetry and remote-command paths as control paths, audit their authentication and object-level authorization, and remove default credentials. The speaker invites attendees to the Maritime Hacking Village, including a CTF that uses a VLCC simulator.