Hackers behind Navy collisions?

[Boats]

Hackers behind Navy collisions?
Elizabeth Weise, USA TODAY Published 4:04 p.m. CT Aug. 25, 2017
RE: http://www.jacksonsun.com/story/news...ons/104956122/

SAN FRANCISCO - Was a hack attack behind two separate instances of Navy ships colliding with commercial vessels in the past two months? Experts say it’s highly unlikely, but not impossible — and the Navy is investigating.

Rumors on Twitter and in computer security circles have been swirling about the possibility that cyber attacks or jamming was involved in the collisions. Speculation has been fueled by four accidents involving a U.S. warship this year, two of which were fatal, the highly computerized nature of modern maritime navigation and heightened concern about global cyberattacks — especially attacks against U.S. government entities.

Chief of naval operations Adm. John Richardson said in a tweet Monday that there was no indication of the possibility of cyber intrusion or sabotage, but the “review will consider all possibilities.” It had been retweeted more than 830 times by Wednesday.

Experts say there are certainly scenarios they can imagine in which GPS hacks could have been used to foil ships’ navigations systems but emphasize that there’s no evidence such attacks took place in the case of the Navy collisions.

“The balance of the evidence still leads me to believe that it was crew negligence as the most likely explanation — and I hate to say that because I hate to think that the Navy fleet was negligent,” said University of Texas aerospace professor Todd Humphreys, who studies GPS security issues.

On Monday, the USS John S. McCain collided with an oil tanker off Malaysia, which left 10 sailors missing and five injured. On June 17, seven sailors died when the USS Fitzgerald was hit by a cargo ship 60 miles off the coast of Japan.

The incidents have clearly rattled the Navy. On Wednesday, Vice Adm. Joseph Aucoin was dismissed as commander of the 7th Fleet. And on Monday, the Navy ordered a global pause in operations to allow commanders to take immediate action to keep sailors and ships safe, as well as a Navy-wide review to get at the root causes of the problems.

The technology to jam or misdirect navigational software is readily available, though the Navy uses a much more robust encrypted version of GPS that would be very difficult to disrupt, Humphreys said.

The only way to spoof such a system would be to use what’s known as a “record and replay attack,” he said. That’s where a recording is made of the encrypted location data being sent down from satellites to the Naval ship, and then the recording is replayed at a slightly later time and directed toward the ship.

“That way you could fool a ship into thinking it is someplace it’s not,” Humphreys said.

That would be a very sophisticated and difficult hack, requiring recording the navigation data stream from multiple angles to mimic the multiple antennas on the Navy ship and then sending the recorded signal from two or more locations. To ensure nearby ships didn’t also get the false data, it would have to be transmitted from close to the Navy ship being targeted, perhaps using multiple drones.

None of this seems likely, but it’s not impossible, Humphreys said. In 2013, he and a group of graduate students were able to spoof an $80 million yacht’s GPS system, sending it hundreds of yards off course without the ship’s navigation system showing the change to the crew.

The Navy has blamed the Fitzgerald collision on a loss of situational awareness by sailors on the bridge.

Dana Goward, former head of Marine Transportation Systems for the U.S. Coast Guard, the navigation authority for all U.S. waters and vessels, also doesn’t believe hacking was involved in the Navy collisions.

“It’s a difficult environment to be in, and human error is always present,” he said.