Cruising Sailors Forum Archive

Security "experts" worry about AIS

http://news.yahoo.com/loose-blips-sink-ships-leaky-communications-threaten-marine-132219194.html

Most seafaring vessels use an onboard device called an automatic identification system (AIS) receiver that store a wealth of information about the ship. And according to research from the security experts at Boston's Rapid7 Labs, AIS receivers are ridiculously insecure.

To suggest that most seafaring ships — including tankers, fishing boats and military vessels — could be hacked would be an insult to industrious hackers everywhere.

Instead, reading a ship's private or sensitive communications requires no hacking knowledge whatsoever. The amount of publicly broadcast, potentially sensitive material on the ocean is staggering.

All you need to monitor AIS transmissions is an AIS receiver of your own. Whenever a ship broadcasts its position on AIS (which it does every one to three minutes, by default), it includes a Maritime Mobile Service Identity (MMSI) number.

Every ship has a unique MMSI number, which means that an interested party could identify any ship that broadcasts its position over AIS. Put the MMSI and the latitude/longitude coordinates together, and you can not only pick out a vessel, but track its course as well.

This information is particularly troubling for military and law-enforcement ships, whose AIS receivers broadcast location and MMSI information in exactly the same way as private ones.

OK so some "security folks" think that AIS is putting out too much info and they see this as a vulnerability. Sailors at sea see AIS as an aid to navigation and a safety item... catch-22.

Messages In This Thread