Cyber Security Article

07-08. JulAug 2023 issue.qxp_Pages-12-40-JanFeb WPD 07/09/2023 13:24 Page 7

container

cyber security

Cyber Security The COVID-19 pandemic accelerated the digitisation of the world, which was already taking place, making it mandatory for people to work from home via the internet.

But are we safe from cyber attacks and what about the maritime industry?

Thomas Francis reports…

T

he world economy is heavily dependent on maritime transport, as most of the international trade is carried by sea.

As we have seen two years ago with the blockage of the Suez Canal, delays in shipping can result in severe financial loss, especially further down the logictical chain and distribution channels. Therefore, you may not think of ships and fleets closely related to technology, but ships are constantly connected to the internet.

This heavy dependency on the internet makes the shipping industry an attractive target for cyber criminals. And here lies the real problem - some of these systems and computers on these ships often use incredibly complicated and old systems. This makes it much more difficult to protect them from cyberattacks.

The systems these ships use are so intertwined that there are many blind spots that are virtually undetectable.

22 World Port Development July/August 2023

Since ships are increasingly dependent on digitisation, integration and automation systems, cyber risk management onboard ships has top priority. As technology advances, the convergence of information technology (IT) and operational technology (OT) onboard ships and their connection to the internet creates a larger target that needs to be addressed.

But it is not only ships that use the internet, ports and terminals alike can be compromised by cyber-attacks. Therefore, cybersecurity should be in place to address the security issues and risks posed by new technologies.

At the end of July 2023, the executive director of the Port of Los Angeles provided a remarkable detail about the threat posed to American infrastructure by cyber-criminals and other enemies.

“In the month of June alone, we stopped more than 60 million cyber intrusion attempts here,” said Gene Seroka at a news briefing. “It’s one of the biggest issues that we work on every day. We now average 54 million cyber-intrusion attempts per month and we’ve stopped all of them.”

This is in stark contrast compared to the port of Nagoya, Japan, which was victimised by a reported Russian ransomware attack in early July 2023. Infiltrators blocked access to files and operations and then demanded a payoff. It’s not clear what happened in Nagoya exactly, but several terminals at the port were shut down for two days.

In June 2023, Pro-Russian hackers targeted the websites of several Dutch ports, including Groningen, Amsterdam, Rotterdam, and Den Helder, with cyber attacks. The DDoS attacks knocked the ports’ websites offline for several hours and in some cases even days. In a DDoS cyberattack, a website or server is flooded with requests until it crashes.

NoName057(16) claimed the attacks were in response to the Netherlands’ intention to buy tanks for Ukraine. Although NoName057(16) often targets the banking sector, private companies that supply the Defence industry, and logistics companies in NATO member states, the attacks on Dutch ports’ websites was unusual. In a telegram, NoName057(16) wrote: “The Netherlands want to buy Leopard 1s to deliver to the Ukraine.

07-08. JulAug 2023 issue.qxp_Pages-12-40-JanFeb WPD 07/09/2023 13:25 Page 8

cyber security

By the way, according to the Ministry of Defence of the Russian Federation, eight Leopard 1 tanks have already been destroyed.

Bring the next one!”

In April 2023, the same Pro-Russian hackers NoName057(16) also attacked three of Canada’s primary eastern seaports websites.

On Wednesday, 12 April, the ports of Halifax, Montreal, and Quebec all announced that their websites had been targeted and crashed after they became overloaded in the “denial of service” attack. The attacks were limited to a “denial of service” aimed at their websites and none of their operations or internal systems were impacted by the ongoing incident.

On 25 December 2022, the Port of Lisbon, Portugal, was attacked with ransomware, which took down the port’s website and internal computer systems. Lots of confidential information was stolen, including budgets, contracts, cargo information, ship logs and port documentation. Some of the information was published. Luckily, the port’s operations were not compromised. Cyber analysts reported that the attack was staged using a widespread malicious software programme called LockBit.

The perpetrators posted statements to the “dark web” demanding a ransom of USD1.5 million and setting a deadline of 18 January 2023 for payment. LockBit is one of the most widespread and problematic ransomware gangs of 2022. By some estimates, they have been behind a third of all the claims of cyberattacks posted in 2022 hitting over 1,200 organisations worldwide.

It is therefore clear that ports are key targets for cyberattacks. There are many different companies and actors who could be targeted with attacks. Ports’ complex networks of public and private actors also make securing the ports a challenge. Actors include storage providers for oil and goods, terminal operators and logistics firms. It is a big challenge to ensure all of these actors maintain good security, in order to prevent attacks and limit successful breaches.

In order to solve this challenge and improve the cyber security of critical industries, the European Union approved new cybersecurity regulations which obligate critical infrastructure companies to become more secure. Regulations include technical measures such as encryption, cyber risk assessments and due diligence too.

container

Hundreds of firms which operate out of Europe’s largest ports will need to use these basic security measures and report attacks to authorities from 2024. Non-adherence will result in fines of up to 10 million euros or two percent of revenue, whichever is higher.

These regulations are needed not only to avoid criminal networks making money out of cyberattacks but also the impact it has on companies that are being attacked and to a certain degree the (global) economy. Hence, government officials around the world are working hard to combat cyberattacks.

In recent news, European crime officials together with the FBI and UK National Crime Agency (NCA) removed a network of malicious software from thousands of infected computers.

The Qakbot software - a piece of code that lurked unseen in the majority of the computers it had secretly installed itself on - was used as part of online crimes, including ransomware attacks, for more than 15 years. The criminal network behind it made around USD58 million from victims between October 2021 and April 2023.

July/August 2023 World Port Development

23

07-08. JulAug 2023 issue.qxp_Pages-12-40-JanFeb WPD 07/09/2023 13:25 Page 9

container

cyber security

“Nearly every sector of the US economy has been victimised by Qakbot,” said Martin Estrada, Los Angeles US attorney.

In an operation dubbed “Duck Hunt”, the FBI along with Europol and crime and justice officials in France, Germany, the Netherlands, Romania and Latvia, seized more than 50 Qakbot servers and identified more than 700,000 infected computers worldwide. By doing this, criminals were effectively cut off from their source. The FBI then used the seized Qakbot infrastructure to remotely dispatch updates that deleted the malware from thousands of infected computers.

In the UK, the National Crime Agency ensured the criminal network's UK servers were taken offline at the same time as Qakbot's other infrastructure elsewhere.

24 World Port Development July/August 2023

“This investigation has taken out a prolific malware that caused significant damage to victims in the UK and around the world.

Qakbot was a key enabler within the cyber crime ecosystem, facilitating ransomware attacks and other serious threats,” said Will Lyne, Head of Cyber Intelligence at the NCA. Researchers said they believed the cybercriminals were in Russia or other former Soviet states, but this was not confirmed.

First appearing in 2008, Qakbot gives criminal hackers initial access to violated computers via phishing email infections. Criminals could then install additional ransomware, and once infected, the computers became part of a botnet - a network of computers infected by malware and under the control of a single attacking party.

Qakbot affected one in 10 corporate networks and accounted for about 30% of global attacks.

So what about ports and terminals?

Both play a significant role in maintaining smooth global trade and they will need to act to prevent any cyberattacks. Therefore, expect (future) co-operation between ports, sharing information and learning from other ports how to tackle cyber security will be high on the agenda.

At the beginning of August 2023, Greece’s Thessaloniki Port entered into a new cooperation agreement with Ashdod, the national port of Israel. The co-operation focuses on innovation, with particular emphasis on the areas of cyber security and operational efficiency.

07-08. JulAug 2023 issue.qxp_Pages-12-40-JanFeb WPD 07/09/2023 13:25 Page 10

cyber security At the same time, both port companies will undertake joint initiatives, aiming to respond to issues related to sustainability, which concern the broader port and maritime transport sector. In addition, the agreement provides for the joint implementation of networking activities, the participation in international projects and the exchange of knowledge and best practices enabling Thessaloniki to test innovative technologies and ideas through Ashdod port’s maritime technology hub.

So you will see more of these kind of agreements in the (near) future.

On another note, earlier this year, we highlighted the proposed Port Crane Security and Inspection Act of 2023 by Congressman Carlos A Gimenez from Florida and Republican John Garamendi from California, aiming to address the growing concerns regarding China’s influence on port infrastructure, specifically container cranes.

Image top left: Courtesy of Raytheon.

Image bottom right: Courtesy of GCHQ.

The act proposes several measures to mitigate the risks associated with the use of foreign container cranes from countries considered adversaries of the US, such as China. The bill included restrictions on the use of such cranes, requiring the Cybersecurity and Infrastructure Security Agency (CISA) to conduct inspections of foreign cranes for potential security vulnerabilities before they are put into operation.

container

Furthermore, the act mandated that CISA provides the Congress with reports on critical and high-risk security vulnerabilities posed by foreign cranes in US ports.

In response to the proposed legislation, Chris Connor, out-going President and CEO of the American Association of Port Authorities (AAPA), strongly countered the “sensationalised” claims about the equipment’s security, pointing out the lack of any supporting evidence.

“At best, that’s a misleading statement,” Connor remarked in a released statement addressing the issue.

He clarified that the cranes acquired by ports in the US are chosen based on cost considerations and are equipped with separate software obtained from allied nations. Additionally, these cranes undergo stringent security inspections in collaboration with federal government partners to effectively mitigate cyber threats.

Connor emphasised that the primary concern for ports lies in the inability to manufacture such hardware within the US. He suggested that instead of focusing solely on the equipment’s security, lawmakers in Washington DC, should also inquire why domestic production of this hardware is not feasible.

July/August 2023 World Port Development

25