4 ms·

This story is pretty sensationalized. 1. A container shipping company does not store the bar code of crates/packages. I've easily read 100s of booking details

by bkor 11y ago

This story is pretty sensationalized. 1. A container shipping company does not store the bar code of crates/packages. I've easily read 100s of booking details and never seen this. At most you maybe find one booking where the customer gave too much info and the customer service person copy/pasted too much. Anyway, either the article is talking about the container number or the hacked company is a logistics company. 2. If it is a logistics company, they wouldn't know exactly where the container is on the vessel. You can ask "above/below deck", but exact details aren't normally shared. You'd need to hack two companies if the pirates behaved like the article suggests. 3. Boarding a container ship isn't that easy as a lot of them are huge. 4. A container might just be reachable. Hint: For some commodities special care is taken to ensure that the vessel crew can still reach it. It's much easier to target a container after it has left a terminal and is e.g. on a truck. Note that even with full access it is better to somehow takeover a truck than to pick it up yourself; they check and your identification (passport/drivers license) when you pick up. At most this might be about some logistics company that uses small vessels. E.g. intra Asia trade. Any big company I would be surprised if the hackers would make sense of all the systems :-P That said, every so often you do see news articles whereby someone within either customs or a shipping company sells the details to others. Those others then steal the goods. But not by boarding vessels though, they takeover the truck.

woah 11y ago
You're saying that the entire story is fabricated?
chockablock 11y ago
So, you're claiming the story is fabricated? Quoting: "They’d board a vessel, locate by bar code specific sought-after crates containing valuables, steal the contents of that crate—and that crate only—and then depart the vessel without further incident." You can download the Verizon report (that is the source for this article) here: http://www.verizonenterprise.com/resources/reports/rp_data-breach-digest_xg_en.pdf http://www.verizonenterprise.com/resources/reports/rp_data-b...
- bkor 11y ago
  No, I'm saying the details aren't correct. I never implied fabricated, so unsure why you're suggesting this. From reading the report it seems they confused container numbers with crate bar codes. This bit: "They’d board a vessel, locate by bar code specific sought-after crates containing valuables, steal the contents of that crate—and that crate only—and then depart the vessel without further incident." When you board a vessel with container numbers, you don't see crates. However, you can find the container then search through the container and determine the crate. But the crate bar code? That's incorrect. A bill of lading will show the crate contents as well as its container number. It does NOT contain a bar code. The PDF is obviously a marketing piece; it is not surprising some details are incorrect. If you ignore the bar code part, then yeah, if the target was a shipping company then you could determine the contents of containers within reach and what is in them. Still need to go through the container though.
- DrScump 11y ago
  They may have just confused "crate" shipping (some small-scale local deal) with container shipping. It's hard to tell; the link to the claimed source goes nowhere, and a look at the current version of the named report (rp_data-breach-investigation-report-2015_en_xg.pdf, free download) says nothing about shipping piracy.
nxzero 11y ago
Love how you're giving "hint" on how capture goods in service; either you have: (1) done this, which brings into question why in the world you publicly mention this; (2) done or read about it, which if so, why not provide your sources; (3) done logistics related security, which should be stated; (4) a theorists. What exactly is your experience in the real world on the topic?
- medecau 11y ago
  What's easiest? - stop a truck on a highway; take the driver out of the truck; drive off. - board a container ship; track the targeted container; steal the contents; leave with cargo in high sea. Sources? Here you go: https://www.google.com/search?q=highway+truck+heist https://www.google.com/search?q=highway+truck+heist
  - trelltron 11y ago
    Sure, if you mis-frame it like this then the truck option looks better. But then, most crimes are actually really easy to pull off. It's what comes after the crime that actually matters, and I feel like the whole 'escape with the booty' part could be much easier at sea.
8ig8 11y ago
Those containers seem to be packed pretty tight. Even if you know which one had high value contents, is it even possible to access it within the stacks?
- kijin 11y ago
  It might not be too difficult if the entire container is filled with iPhones. Doesn't matter which iPhone you steal. Or just get a few men to throw overboard anything you're not interested in. A pirate has no obligation to leave his crime scene well-organized.
  - orbitingpluto 11y ago
    This sort of stuff does happen. I knew of one company whose insurance limits them to something like 20 containers per vessel. During the Han lunar new year they the would place as many as 35 onto a single ship. One of these would be bound to be on top, especially if you can somehow determine when they entered the loading dock relative to other containers on the vessel. They'd probably get zero coverage once the insurer found out they'd overloaded too. "Hacking" might not be an appropriate term here though. Most shipping website security is beyond awful. I've used Selenium to pull stuff off of shipping sites before as APIs are almost non-existent. When they do exist, they return fixed length text that you have to decode or you're using something archaic like automated email replies when you email a container number to them. (I have sent thousands of emails in a five minute period to a single VOCC to figure out if they were actually the ones shipping something and where the cargo is.) Lastly I've actually sent emails to website support on tracking sites telling them they weren't sanitizing inputs at all. Zero interest or chest pounding brush off reply. As for barcodes, they probably mean shipping container number (ISO 6346 - https://en.wikipedia.org/wiki/ISO_6346 https://en.wikipedia.org/wiki/ISO_6346). Now all you need are pirates with a Russian Mil Mi-26 to dig for the buried treasure on the vessel while at sea (like in William Gibson's Spook Country)
  - SixSigma 11y ago
    I'm under the impression that stuff small and valuable like iPhones are transported by plane but that still leaves plenty of targets.
deleted 11y ago
[deleted]

by bkor 11y ago

woah 11y ago

You're saying that the entire story is fabricated?

chockablock 11y ago

So, you're claiming the story is fabricated? Quoting: "They’d board a vessel, locate by bar code specific sought-after crates containing valuables, steal the contents of that crate—and that crate only—and then depart the vessel without further incident." You can download the Verizon report (that is the source for this article) here: http://www.verizonenterprise.com/resources/reports/rp_data-breach-digest_xg_en.pdf http://www.verizonenterprise.com/resources/reports/rp_data-b...

bkor 11y ago
No, I'm saying the details aren't correct. I never implied fabricated, so unsure why you're suggesting this. From reading the report it seems they confused container numbers with crate bar codes. This bit: "They’d board a vessel, locate by bar code specific sought-after crates containing valuables, steal the contents of that crate—and that crate only—and then depart the vessel without further incident." When you board a vessel with container numbers, you don't see crates. However, you can find the container then search through the container and determine the crate. But the crate bar code? That's incorrect. A bill of lading will show the crate contents as well as its container number. It does NOT contain a bar code. The PDF is obviously a marketing piece; it is not surprising some details are incorrect. If you ignore the bar code part, then yeah, if the target was a shipping company then you could determine the contents of containers within reach and what is in them. Still need to go through the container though.
DrScump 11y ago
They may have just confused "crate" shipping (some small-scale local deal) with container shipping. It's hard to tell; the link to the claimed source goes nowhere, and a look at the current version of the named report (rp_data-breach-investigation-report-2015_en_xg.pdf, free download) says nothing about shipping piracy.

nxzero 11y ago

Love how you're giving "hint" on how capture goods in service; either you have: (1) done this, which brings into question why in the world you publicly mention this; (2) done or read about it, which if so, why not provide your sources; (3) done logistics related security, which should be stated; (4) a theorists. What exactly is your experience in the real world on the topic?

medecau 11y ago
What's easiest? - stop a truck on a highway; take the driver out of the truck; drive off. - board a container ship; track the targeted container; steal the contents; leave with cargo in high sea. Sources? Here you go: https://www.google.com/search?q=highway+truck+heist https://www.google.com/search?q=highway+truck+heist
- trelltron 11y ago
  Sure, if you mis-frame it like this then the truck option looks better. But then, most crimes are actually really easy to pull off. It's what comes after the crime that actually matters, and I feel like the whole 'escape with the booty' part could be much easier at sea.

8ig8 11y ago

Those containers seem to be packed pretty tight. Even if you know which one had high value contents, is it even possible to access it within the stacks?

kijin 11y ago
It might not be too difficult if the entire container is filled with iPhones. Doesn't matter which iPhone you steal. Or just get a few men to throw overboard anything you're not interested in. A pirate has no obligation to leave his crime scene well-organized.
- orbitingpluto 11y ago
  This sort of stuff does happen. I knew of one company whose insurance limits them to something like 20 containers per vessel. During the Han lunar new year they the would place as many as 35 onto a single ship. One of these would be bound to be on top, especially if you can somehow determine when they entered the loading dock relative to other containers on the vessel. They'd probably get zero coverage once the insurer found out they'd overloaded too. "Hacking" might not be an appropriate term here though. Most shipping website security is beyond awful. I've used Selenium to pull stuff off of shipping sites before as APIs are almost non-existent. When they do exist, they return fixed length text that you have to decode or you're using something archaic like automated email replies when you email a container number to them. (I have sent thousands of emails in a five minute period to a single VOCC to figure out if they were actually the ones shipping something and where the cargo is.) Lastly I've actually sent emails to website support on tracking sites telling them they weren't sanitizing inputs at all. Zero interest or chest pounding brush off reply. As for barcodes, they probably mean shipping container number (ISO 6346 - https://en.wikipedia.org/wiki/ISO_6346 https://en.wikipedia.org/wiki/ISO_6346). Now all you need are pirates with a Russian Mil Mi-26 to dig for the buried treasure on the vessel while at sea (like in William Gibson's Spook Country)
- SixSigma 11y ago
  I'm under the impression that stuff small and valuable like iPhones are transported by plane but that still leaves plenty of targets.

deleted 11y ago

[deleted]