Owners of ships carrying sanctioned oil from Iran and Russia are using risky digital tools to control crews and cover their tracks. However, this technology could be exploited by a malicious actor to cause a serious incident.
Ships illegally transporting oil intercepted by the U.S. Coast Guard were found to be using vulnerable computer systems that could be remotely manipulated to cause explosions or massive spills, writes Wall Street Journal (WSJ).
As the U.S. and Iran are on the verge of signing an agreement to end the war and reopen the Strait of Hormuz, analysts warn that dozens of tankers from the "phantom fleet" stranded in the Persian Gulf and nearby areas could resume their illicit trade, significantly increasing the number of ships the United States needs to monitor and posing more risks on the oceans, the cited newspaper reports.
Ship control can be taken remotely
After elite American forces rapidly descend from helicopters onto a tanker's deck, a U.S. Coast Guard cyber control team boards. The experts have computers and technical equipment to analyze and secure the ship's digital infrastructure.
The findings of the inspections carried out so far, detailed in a new report obtained by the American daily, have alarmed U.S. officials. They say the ships intentionally circumvent physical inspections and the digital standards imposed on vessels legally carrying hazardous goods.
Coast Guard discovered that unsupervised access was allowed to these applications, "meaning that remote connections could be established without a person being present at the workstation," the cited report shows.
Thus, an old tanker with vulnerable digital infrastructure can fall under the computer control of a malicious actor, becoming a massive floating bomb, experts warn.
Pirated software and malware programs
In at least one case, administrators of such a ship tried to remotely erase data from the ship's board after it was boarded by the U.S., the report states.
"We've known for years that the phantom fleet presents significant physical risks because we knew they were operating old ships and not maintaining them. But what we didn't know was what kind of cyber risks existed on board these ships," said Rear Admiral Jason Tama, head of the Coast Guard's Cyber Command.
"I don't think any of us slept at night when we realized how dangerous some of these ships were and realized our people were on board," Tama added. "We had to make sure those networks weren't compromised or turned into weapons in a way that could make them dangerous to our personnel."
Cyber teams found that some ships were running pirated software loaded with malware programs for business management and navigation operations. According to U.S. officials, computers infected with malware programs are risky when connected to operational and navigation systems.
"For a ship carrying tens of millions of gallons of oil, which is highly volatile, there is always a risk of explosion. The atmosphere in the tanks must be managed very carefully to ensure that an explosion cannot occur. And then there is always the risk of an oil spill," explained the rear admiral.
Digital deception tactics
On board the ships, cyber teams also found evidence of methods used to avoid detection.
Some tankers had multiple Automatic Identification System devices through which crews transmitted false identities. In one case, a switch was found that sailors used to electronically switch between ship names - the digital equivalent of repainting the ship's real name on the hull.
"Unlike a situation where someone looks in obituaries and takes a name from there, owners of ships in the phantom fleet look for ships that have been dismantled and use the same names so that there is at least a digital trace of the existence of this ship," said Rear Admiral David Barata, Coast Guard's Deputy Commander for Operational Policy and Capabilities.
Illegally operating ships were also found to have facilities that allowed crews to transmit false location data and mask their position. Instructions for falsifying GPS data were also found on board, the report states.
"These ships try to hide. One of the ships we looked at signaled it was in Curaçao, but it was actually off the coast of Venezuela and transporting oil there," Barata said.
The report confirms that tankers are intentionally involved in illicit activities, according to Michelle Wiese Bockmann, senior maritime intelligence analyst at Windward AI.
Global crackdown against the "dark fleet"
By publishing details about vulnerabilities and evasion methods found on board oil tankers from the phantom fleet, U.S. Coast Guard officials hope that other countries will be encouraged to step up their efforts to capture them.
After the United States launched a global action in December against ships from the "phantom fleet," countries such as France, the United Kingdom, and Germany have blocked and seized tankers carrying Russian oil, WSJ notes.
Over the past weekend, the British Royal Navy forces boarded a suspicious tanker sailing in the English Channel.
T.D.