IOActive Researcher Discovers Critical Security Flaws in Inmarsat Maritime Vessel Communication Platform

SEATTLE, Oct. 26, 2017 /PRNewswire/ --IOActive, Inc., the worldwide leader in research-driven security services, today released a new advisory documenting critical cybersecurity vulnerabilities affecting Stratos Global's AmosConnect communication shipboard platform. Stratos Global, an Inmarsat company, is the leading provider of maritime communications services in the world and used by thousands of ship vessels globally.

According to the International Chamber of Shipping, about 90% of world trade is carried by the international shipping industry -- which frequently relies upon AmosConnect for its mobile satellite communication capabilities. AmosConnect supports narrowband satellite communications and integrates vessel and shore-based office applications such as email, fax, telex, GSM text, interoffice communication, and access for mobile personnel into a single messaging system.

The flaws IOActive discovered include blind SQL injection in a login form, and a backdoor account that provides full system privileges that could allow remote unauthenticated attackers to execute arbitrary code on the AmosConnect server. If compromised, this flaw can be leveraged to gain unauthorized network access to sensitive information stored in the AmosConnect server and potentially open access to other connected systems or networks.

The research was authored by IOActive's principal security consultant, Mario Ballano. The advisory outlining the research and Ballano's findings is now available at http://blog.ioactive.com/2017/10/amosconnect-maritime-communications.html

Maritime cybersecurity has been under increasing scrutiny this year with a few maritime disasters that occurred this summer, including the June 2017 GPS spoofing attack involving over 20 vessels in the Black Sea that left navigation experts and maritime executives speculating it was due to a cyber attack. In August 2017, questions arose that the collision involving the USS John McCain with a chemical tanker could have possibly been the result of cyber tampering, leading to the Navy to implement cyber investigations on similar situations moving forward.

IOActive's Ruben Santamarta conducted prior security research on satellite communications (SATCOM), which originally peaked Ballano's interest in environments where SATCOM devices are in place, and ultimately led him to investigate the security of the AmosConnect 8.4.0 system. Ballano conducted his research in September of 2016, and found that he could gain full system privileges, essentially becoming the administrator of the box where AmosConnect is installed. If there were to be any other software or data stored in this box, the attacker would have access to those and potentially to other networks connected to the box.

"Essentially anyone interested in sensitive company information or looking to attack a vessel's IT infrastructure could take advantage of these flaws," said Ballano. "This leaves crew member and company data extremely vulnerable, and could present risks to the safety of the entire vessel. Maritime cyber security must be taken seriously as our global logistics supply chain relies on it and as cyber criminals increasingly find new methods of attack."

IOActive informed Inmarsat of the vulnerabilities in October 2016, and completed the disclosure process in July of 2017. Inmarsat has since discontinued the 8.0 version of the platform and has recommended that customers revert back to AmosConnect 7.0 or switch to an email solution from one of their approved partners.

About IOActive
IOActive is the industry's only research-driven, high-end information security services firm with a proven history of better securing our customers through real-world scenarios created by our security experts. Our world-renowned consulting and research teams deliver a portfolio of specialist security services ranging from penetration testing and application code assessment to chip reverse engineering across multiple industries. IOActive is the only security services firm that has a dedicated practice focusing on Smart Cities and the transportation and technology that connects them. Global 500 companies across every industry continue to trust IOActive with their most critical and sensitive security issues. Founded in 1998, IOActive is headquartered in Seattle, US, with global operations through the Americas, EMEA, and Asia Pac regions. Visit www.ioactive.com for more information. Read the IOActive Labs Research Blog: http://blog.ioactive.com. Follow IOActive on Twitter: http://twitter.com/ioactive.

Follow IOActive:
IOActive on Github
IOActive on Twitter
IOActive on Crunchbase
IOActive on Bloomberg

SOURCE IOActive, Inc.

Related Links

http://www.ioactive.com