3 ms·

If you have foreign combatants on your ship you have a problem, generally, whether they're armed with a USB stick or a plastic explosive.

by qubex 9y ago

PeterisP 9y ago
You don't need foreign combatants on your ship. Something similar to the stuxnet approach (sprinkle infected USB drives around employees hoping they'll bring it into the facility) or spearphishing will easily work on sailors whenever they bring "reading material" from shore to the ship; and from there it's just a matter of some sloppiness (which is likely to happen) and the malware will spread from the personal devices to the ship's systems.
- rwmj 9y ago
  The really devious approach would be to embed malware in the billions of USB keys manufactured in China every year. Not too hard if you make USB flash controllers. In fact I'd be surprised if $large_nation_states aren't doing this already.
  - PeterisP 9y ago
    That would burn the vulnerabilities/exploits you use in this malware (e.g. stuxnet used 4 zero-days that weren't discovered for years after it had been first deployed), causing them to be detected, the particular holes fixed, and the signature of that particular malware added to detection lists. No, you most likely want a targeted attack - manufacture such USB keys, distribute them only where you want them to be, and implement various triggers for the malware to delete itself (expiry date, IP ranges, regional settings) so that it doesn't spread worldwide beyond where you want it. Infecting millions of non-target systems is undesirable, that's how Stuxnet got discovered.
  - andai 9y ago
    Wasn't there some news of NSA etc intercepting shipments and doing exactly that?
- qubex 9y ago
  Seriously, I doubt that sailors and officers could be so clueless as to plug random USB drives into their embedded computers. Indeed I'd be really surprised if these machine's ports were exposed and their USB mass storage device drivers not disabled.
  - RobAley 9y ago
    You'd be surprised what sex-starved crew are capable of to get their fix of "reading material"...

If you have foreign combatants on your ship you have a problem, generally, whether they're armed with a USB stick or a plastic explosive.

by qubex 9y ago

If you have foreign combatants on your ship you have a problem, generally, whether they're armed with a USB stick or a plastic explosive.

PeterisP 9y ago

You don't need foreign combatants on your ship. Something similar to the stuxnet approach (sprinkle infected USB drives around employees hoping they'll bring it into the facility) or spearphishing will easily work on sailors whenever they bring "reading material" from shore to the ship; and from there it's just a matter of some sloppiness (which is likely to happen) and the malware will spread from the personal devices to the ship's systems.

rwmj 9y ago
The really devious approach would be to embed malware in the billions of USB keys manufactured in China every year. Not too hard if you make USB flash controllers. In fact I'd be surprised if $large_nation_states aren't doing this already.
- PeterisP 9y ago
  That would burn the vulnerabilities/exploits you use in this malware (e.g. stuxnet used 4 zero-days that weren't discovered for years after it had been first deployed), causing them to be detected, the particular holes fixed, and the signature of that particular malware added to detection lists. No, you most likely want a targeted attack - manufacture such USB keys, distribute them only where you want them to be, and implement various triggers for the malware to delete itself (expiry date, IP ranges, regional settings) so that it doesn't spread worldwide beyond where you want it. Infecting millions of non-target systems is undesirable, that's how Stuxnet got discovered.
- andai 9y ago
  Wasn't there some news of NSA etc intercepting shipments and doing exactly that?
qubex 9y ago
Seriously, I doubt that sailors and officers could be so clueless as to plug random USB drives into their embedded computers. Indeed I'd be really surprised if these machine's ports were exposed and their USB mass storage device drivers not disabled.
- RobAley 9y ago
  You'd be surprised what sex-starved crew are capable of to get their fix of "reading material"...