7 ms·

Sinking container ships by hacking load plan software

193 points by QAPereo 9y ago

NicoJuicy 9y ago
Similar to this, since i'm in ecommerce. Does anyone know of "load plan software" for packages. Given the height, width and depth of every product and the package dimensions available?
- provost 9y ago
  It's interesting that the lack of this data was one of the failure points for Target's $4.4 billion USD Canadian expansion that ended in failure. It's a really interesting story [0] > A team assigned to investigate the problem discovered an astounding number of errors. Product dimensions would be in inches, not centimetres or entered in the wrong order: width by height by length, instead of, say, length by width by height. Sometimes the wrong currency was used. Item descriptions were vague. Important information was missing. There were myriad typos. “You name it, it was wrong,” says a former employee. “It was a disaster.” > Getting the details from suppliers largely fell on the young merchandising assistants. In the industry, information from vendors is notoriously unreliable, but merchandising assistants were often not experienced enough to challenge vendors on the accuracy of the product information they provided. > The investigative team estimated information in the system was accurate about 30% of the time. [0] Source: http://www.macleans.ca/economy/business/what-really-happened-at-target-canada-the-retailers-last-days/ http://www.macleans.ca/economy/business/what-really-happened...
  - PakG1 9y ago
    Quality of data is probably one of the saddest reasons why systems can be unreliable and bad decisions can be easily made in many organizations that aren't technically oriented. It's the biggest reason why I think data analysis logic and/or data modeling should somehow be incorporated into public high school curriculum plans. Systems will work better when the people who use them have a better appreciation for caring about the quality of their data and also the nature of data relationships in databases. This is completely separate from the concepts taught in programming classes, but of course related. Better understanding of the nature of data -> better data -> more useful systems -> better business decisions -> better business performance. I see too many people get frustrated and make poor decisions because they are unable to comprehend the nature of data. Productivity would soar if people understood how to model and take care of data. It's only one aspect of a complex issue, of course. Good UI, system uptime reliability, and so many other things also matter for whether an organization gets everything it really needs from a system.
  - froindt 9y ago
    Thank you for posting the story. I hadn't heard about it previously. Having spent a couple years at various businesses, getting accurate data and understanding exactly what you're looking at is more of a pain than I would have ever imagined.
- PeachPlum 9y ago
  It's called The Knapsack Problem - and optimizing it is NP hard https://en.wikipedia.org/wiki/Knapsack_problem https://en.wikipedia.org/wiki/Knapsack_problem
  - eru 9y ago
    Solving the knapsack problem for practical instances is actually really easy. (That's a general pattern with NP hard problem: most of them are easy in practice.) But the problem described is closer to two- or three-dimensional bin packing (or scheduling in general) than to the knapsack problem. See eg http://www.research.ibm.com/people/n/nikhil/papers/Bansal-packing.pdf http://www.research.ibm.com/people/n/nikhil/papers/Bansal-pa... Another thing to look at is the "Cutting stock" problem (https://en.wikipedia.org/wiki/Cutting_stock_problem https://en.wikipedia.org/wiki/Cutting_stock_problem).
  - laksjd 9y ago
    Knapsack is only about weight, while this is about (most likely) packing 3D cuboids. But that problem is NP-hard, too ;)
    - gaius 9y ago
      All shipping containers are an identical size - it is a weight problem.
      - tesseract 9y ago
        The original discussion about ships was, but this comment thread was about packing (retail packaged) products into a shipping carton.
- bschne 9y ago
  There was a blogpost [1] a while back from a guy who runs a candy subscription business. He goes into some approaches and issues with this and also mentions a python package called pyShipping [2] which has an existing implementation using some heuristics to speed up the calculations. 1. https://www.candyjapan.com/behind-the-scenes/algorithmic-fitting-of-japanese-candy https://www.candyjapan.com/behind-the-scenes/algorithmic-fit... 2. https://github.com/hudora/pyShipping/blob/master/pyshipping/binpack_simple.py https://github.com/hudora/pyShipping/blob/master/pyshipping/...
- j47 9y ago
  we're doing this, and call it case pack optimization: https://www.logivations.com/en/solutions/3d/behaelterportfolio.php https://www.logivations.com/en/solutions/3d/behaelterportfol... (disclosure: I work for that company)
- EvanAnderson 9y ago
  One of my manufacturing Customers uses software from this company: http://www.topseng.com/ http://www.topseng.com/
- sbuttgereit 9y ago
  I've built something like this for a client that manages shipping containers (like those in the article). There are a number of applications on the market which deal with this problem, but the pisk/packing bits tend to be part of much larger systems (ERP, WMS, and other fulfillment solutions) rather than standalone and those solutions can be a bit pricey. This is why we decided to build a solution into an existing enterprise package rather than buy something. I think the problem you're asking about is so narrow, the motivation for developing something that stands on its own is not really there... certainly on a commercial basis.
- bri3d 9y ago
  It's often integrated into application specific software - for example, I worked on metal center management software which performed load and route planning for steel warehouse delivery trailers. To another poster's point, it's a twist on 3D bin packing with lots of custom heuristic possibilities as well as an obvious application for a genetic solver.
- Theodores 9y ago
  I struggled with this for many years, trying to get accurate shipping quotes for furniture and other items that get charged by 'volumetric weight'. I got stuck at the combinatorial explosion of currencies, location 'zones', taxes, product setup data inconsistencies and what happens if not all items can be shipped together. I spoke to a specialist developer that had been in the game longer than myself and she said 'nope, it can't be done that easily in real world situations' and proceeded to go all computer-science on me. If you are in ecommerce you might know of Karen from WebShopApps. If anyone can get you a best solution it is her team.
derwiki 9y ago
Vaguely reminds me of the virus in the movie Hackers.
- rubyfan 9y ago
  I immediately thought that from the title. “The little boat flipped over.” https://getyarn.io/yarn-clip/552a53c2-894a-4b79-bcf1-e9eadfb9d2e5 https://getyarn.io/yarn-clip/552a53c2-894a-4b79-bcf1-e9eadfb...
  - Terr_ 9y ago
    "Well, the front fell off." https://www.youtube.com/watch?v=3m5qxZm_JqM https://www.youtube.com/watch?v=3m5qxZm_JqM
- solidr53 9y ago
  da vinci virus great scott
  - himom 9y ago
    Fiction was inspired by fact for a change. ;) IRL 30 years ago, I remember getting loaned a warez copy of something from another kid at school containing the Michelangelo DOS bootsector virus. No more trading with that fool. That was back in the day when McAfee and Norton were the only usable DOS CLI/TUI virus scanners.
Nokinside 9y ago
It's possible to cut the ship in half in port if the ship is loaded or unloaded in the wrong order. Each cargo hold must be filled evenly. Filling one hold first and leaving others empty bends the ship and breaks it. I have seen a picture of broken bulk carrier in the Rotterdam harbor when loadmaster made an error.
- nradov 9y ago
  Yes that can definitely happen. I went scuba diving on the Eurobulker X shipwreck in Greece. It was a bulk freighter that broke amidship and sank because the three holds weren't loaded evenly. (Some of the locals suspect it was done intentionally as insurance fraud.) http://www.iefimerida.gr/news/229327/nayagio-toy-eurobulker-x-fortigo-ploio-poy-kopike-sta-dyo-exo-apo-ti-halkida-eikones http://www.iefimerida.gr/news/229327/nayagio-toy-eurobulker-...
- deleted 9y ago
  [deleted]
supahfly_remix 9y ago
I don't have enough domain knowledge to provide a reality check, but wouldn't the ship or loading staff notice something isn't correct and stop the load? It's not like these systems have never had bugs and should be trusted wholeheartedly. Pentest companies like to put up bogeymen to scare people into using their services.
- Cthulhu_ 9y ago
  They might, but at the same time, loading / unloading is a high pressure, high speed and stressful job; when you've got 5000 containers aboard, you can't expect most people to keep track of the weight distribution themselves. Of course I'm sure the ship would start to list and the ballast / balance system give alerts at some point, but maybe it would be too late by then. The article also talks about more subtle things like changing the position of containers; wouldn't cause safety issues, would be hard to detect (gotta trust the software), but would cause delays and (by extension) costs.
  - supahfly_remix 9y ago
    Sounds like the "easy" answer is to use software from a different vendor to check the output of the CSV file. Calculating center of mass is straightforward, and much easier than solving the problem of container placement.
    - bkor 9y ago
      Normally at least two different companies already look at it. One, the container shipping company creates a plan where the containers should go (stowage plan). They then send it to the terminal who will look at it again. The article talks about USB/floppy disks and suggests they are 1) used 2) insecure 3) easily can be attacked. This without ever explaining how. They also suggest that the someone on the vessel themselves creates this stowage plan. This is utterly strange. Stowage plans aren't normally made by people on the vessel for the companies I know. Loads of details in this article make no sense at all. That said, container shipping should be hugely improved is true :-P The main bit is true as well: if you mess up the stowage plan you'd easily cause a lot of damage: yeah. Plus there's probably enough ways to do this. PS: It's not a CSV file.
wyldfire 9y ago
<Chuckle> -- with all of the containerization metaphors these days I assumed "container ships" was just some logical collection of containers. Heck, the docker logo uses these same shipping containers.
mbell 9y ago
So the real life Da Vinci virus?
acrooks 9y ago
I work at a company (https://www.stage3systems.com https://www.stage3systems.com) that builds software for the marine shipping industry. Currently we are expanding one of our products for a large container ship owner so we can import these loading condition files into the product for both long-term analysis and also short-term alerting. Once this project is complete, a fleet superintendent will be able to set up alerts so that they get a push notification when we calculate that a load is risky or unbalanced. Hopefully this sort of thing will add an extra layer of validation before a ship sails from port. Fortunately, for our customer, they build quite robust ships and do not skimp on cost. But due to the economics of shipping right now, a number of owners in the world cut costs wherever they can. This includes reducing the amount of steel used in critical support beams which could increase the risk of a vessel breaking in half [1]. Sadly this makes a hack like this even more risky, because the combination of marginal errors, bad weather and a frail ship could be more than enough to cause a big problem. [1] https://en.wikipedia.org/wiki/MOL_Comfort https://en.wikipedia.org/wiki/MOL_Comfort
- deleted 9y ago
  [deleted]
siculars 9y ago
Isn't there verifying load software built in on the dock? The crane lifts the box so it knows how much it weighs and it also knows where it put it. How is there not a 3D map of load distribution at the time the ship is loaded and before it sails?
- nraynaud 9y ago
  there are sensors for the attitude of the boat
mizchief2 9y ago
Wasn't this the plot of the movie "Hackers" ?
oasisbob 9y ago
First thought is that this would be a fun situation for the Underhanded C Contest, but it seems rather similar to the 2009 scenario: http://www.underhanded-c.org/_page_id_22.html http://www.underhanded-c.org/_page_id_22.html
kwillets 9y ago
This is essentially what capsized the Saewol and killed hundreds of people. It can be detected with empirical tests however. Almost every ship should right itself from a roll within ten seconds or so, so anyone with a stopwatch can detect misloading. There are monitors that measure this continuously as well. At one point I was thinking of making a phone app for this, so that ferry passengers could check stability themselves.
- mordechai9000 9y ago
  Just to make sure I understand - are you saying that on a properly loaded ship, no more than ten seconds should pass between the deck going out of level and then returning to level? Does it matter if it's rolling side to side, or front to back?
  - kwillets 9y ago
    Side-to-side. There's a certain design range where it's not too fast and not too slow, and some inspectors check for it. https://en.wikipedia.org/wiki/Metacentric_height#GM_and_rolling_period https://en.wikipedia.org/wiki/Metacentric_height#GM_and_roll... Also, there's random motion that may look like roll when it's the sea surface that's showing the motion, so there are methods to filter that out and extract the actual rolling period.
senectus1 9y ago
I work for a company that loads dirt (yeah ok "Iron Ore") on cape size ships... Filling the ships up is done with heavy consultation from the ships captain and often isn't as obvious and simple as one (layman) might expect. Hacking the process is definitely a concern. something we care about quite seriously.

193 points by QAPereo 9y ago

Similar to this, since i'm in ecommerce. Does anyone know of "load plan software" for packages. Given the height, width and depth of every product and the package dimensions available?

provost 9y ago
It's interesting that the lack of this data was one of the failure points for Target's $4.4 billion USD Canadian expansion that ended in failure. It's a really interesting story [0] > A team assigned to investigate the problem discovered an astounding number of errors. Product dimensions would be in inches, not centimetres or entered in the wrong order: width by height by length, instead of, say, length by width by height. Sometimes the wrong currency was used. Item descriptions were vague. Important information was missing. There were myriad typos. “You name it, it was wrong,” says a former employee. “It was a disaster.” > Getting the details from suppliers largely fell on the young merchandising assistants. In the industry, information from vendors is notoriously unreliable, but merchandising assistants were often not experienced enough to challenge vendors on the accuracy of the product information they provided. > The investigative team estimated information in the system was accurate about 30% of the time. [0] Source: http://www.macleans.ca/economy/business/what-really-happened-at-target-canada-the-retailers-last-days/ http://www.macleans.ca/economy/business/what-really-happened...
- PakG1 9y ago
  Quality of data is probably one of the saddest reasons why systems can be unreliable and bad decisions can be easily made in many organizations that aren't technically oriented. It's the biggest reason why I think data analysis logic and/or data modeling should somehow be incorporated into public high school curriculum plans. Systems will work better when the people who use them have a better appreciation for caring about the quality of their data and also the nature of data relationships in databases. This is completely separate from the concepts taught in programming classes, but of course related. Better understanding of the nature of data -> better data -> more useful systems -> better business decisions -> better business performance. I see too many people get frustrated and make poor decisions because they are unable to comprehend the nature of data. Productivity would soar if people understood how to model and take care of data. It's only one aspect of a complex issue, of course. Good UI, system uptime reliability, and so many other things also matter for whether an organization gets everything it really needs from a system.
- froindt 9y ago
  Thank you for posting the story. I hadn't heard about it previously. Having spent a couple years at various businesses, getting accurate data and understanding exactly what you're looking at is more of a pain than I would have ever imagined.
PeachPlum 9y ago
It's called The Knapsack Problem - and optimizing it is NP hard https://en.wikipedia.org/wiki/Knapsack_problem https://en.wikipedia.org/wiki/Knapsack_problem
- eru 9y ago
  Solving the knapsack problem for practical instances is actually really easy. (That's a general pattern with NP hard problem: most of them are easy in practice.) But the problem described is closer to two- or three-dimensional bin packing (or scheduling in general) than to the knapsack problem. See eg http://www.research.ibm.com/people/n/nikhil/papers/Bansal-packing.pdf http://www.research.ibm.com/people/n/nikhil/papers/Bansal-pa... Another thing to look at is the "Cutting stock" problem (https://en.wikipedia.org/wiki/Cutting_stock_problem https://en.wikipedia.org/wiki/Cutting_stock_problem).
- laksjd 9y ago
  Knapsack is only about weight, while this is about (most likely) packing 3D cuboids. But that problem is NP-hard, too ;)
  - gaius 9y ago
    All shipping containers are an identical size - it is a weight problem.
    - tesseract 9y ago
      The original discussion about ships was, but this comment thread was about packing (retail packaged) products into a shipping carton.
bschne 9y ago
There was a blogpost [1] a while back from a guy who runs a candy subscription business. He goes into some approaches and issues with this and also mentions a python package called pyShipping [2] which has an existing implementation using some heuristics to speed up the calculations. 1. https://www.candyjapan.com/behind-the-scenes/algorithmic-fitting-of-japanese-candy https://www.candyjapan.com/behind-the-scenes/algorithmic-fit... 2. https://github.com/hudora/pyShipping/blob/master/pyshipping/binpack_simple.py https://github.com/hudora/pyShipping/blob/master/pyshipping/...
j47 9y ago
we're doing this, and call it case pack optimization: https://www.logivations.com/en/solutions/3d/behaelterportfolio.php https://www.logivations.com/en/solutions/3d/behaelterportfol... (disclosure: I work for that company)
EvanAnderson 9y ago
One of my manufacturing Customers uses software from this company: http://www.topseng.com/ http://www.topseng.com/
sbuttgereit 9y ago
I've built something like this for a client that manages shipping containers (like those in the article). There are a number of applications on the market which deal with this problem, but the pisk/packing bits tend to be part of much larger systems (ERP, WMS, and other fulfillment solutions) rather than standalone and those solutions can be a bit pricey. This is why we decided to build a solution into an existing enterprise package rather than buy something. I think the problem you're asking about is so narrow, the motivation for developing something that stands on its own is not really there... certainly on a commercial basis.
bri3d 9y ago
It's often integrated into application specific software - for example, I worked on metal center management software which performed load and route planning for steel warehouse delivery trailers. To another poster's point, it's a twist on 3D bin packing with lots of custom heuristic possibilities as well as an obvious application for a genetic solver.
Theodores 9y ago
I struggled with this for many years, trying to get accurate shipping quotes for furniture and other items that get charged by 'volumetric weight'. I got stuck at the combinatorial explosion of currencies, location 'zones', taxes, product setup data inconsistencies and what happens if not all items can be shipped together. I spoke to a specialist developer that had been in the game longer than myself and she said 'nope, it can't be done that easily in real world situations' and proceeded to go all computer-science on me. If you are in ecommerce you might know of Karen from WebShopApps. If anyone can get you a best solution it is her team.

derwiki 9y ago

Vaguely reminds me of the virus in the movie Hackers.

rubyfan 9y ago
I immediately thought that from the title. “The little boat flipped over.” https://getyarn.io/yarn-clip/552a53c2-894a-4b79-bcf1-e9eadfb9d2e5 https://getyarn.io/yarn-clip/552a53c2-894a-4b79-bcf1-e9eadfb...
- Terr_ 9y ago
  "Well, the front fell off." https://www.youtube.com/watch?v=3m5qxZm_JqM https://www.youtube.com/watch?v=3m5qxZm_JqM
solidr53 9y ago
da vinci virus great scott
- himom 9y ago
  Fiction was inspired by fact for a change. ;) IRL 30 years ago, I remember getting loaned a warez copy of something from another kid at school containing the Michelangelo DOS bootsector virus. No more trading with that fool. That was back in the day when McAfee and Norton were the only usable DOS CLI/TUI virus scanners.

Nokinside 9y ago

It's possible to cut the ship in half in port if the ship is loaded or unloaded in the wrong order. Each cargo hold must be filled evenly. Filling one hold first and leaving others empty bends the ship and breaks it. I have seen a picture of broken bulk carrier in the Rotterdam harbor when loadmaster made an error.

nradov 9y ago
Yes that can definitely happen. I went scuba diving on the Eurobulker X shipwreck in Greece. It was a bulk freighter that broke amidship and sank because the three holds weren't loaded evenly. (Some of the locals suspect it was done intentionally as insurance fraud.) http://www.iefimerida.gr/news/229327/nayagio-toy-eurobulker-x-fortigo-ploio-poy-kopike-sta-dyo-exo-apo-ti-halkida-eikones http://www.iefimerida.gr/news/229327/nayagio-toy-eurobulker-...
deleted 9y ago
[deleted]

supahfly_remix 9y ago

I don't have enough domain knowledge to provide a reality check, but wouldn't the ship or loading staff notice something isn't correct and stop the load? It's not like these systems have never had bugs and should be trusted wholeheartedly. Pentest companies like to put up bogeymen to scare people into using their services.

Cthulhu_ 9y ago
They might, but at the same time, loading / unloading is a high pressure, high speed and stressful job; when you've got 5000 containers aboard, you can't expect most people to keep track of the weight distribution themselves. Of course I'm sure the ship would start to list and the ballast / balance system give alerts at some point, but maybe it would be too late by then. The article also talks about more subtle things like changing the position of containers; wouldn't cause safety issues, would be hard to detect (gotta trust the software), but would cause delays and (by extension) costs.
- supahfly_remix 9y ago
  Sounds like the "easy" answer is to use software from a different vendor to check the output of the CSV file. Calculating center of mass is straightforward, and much easier than solving the problem of container placement.
  - bkor 9y ago
    Normally at least two different companies already look at it. One, the container shipping company creates a plan where the containers should go (stowage plan). They then send it to the terminal who will look at it again. The article talks about USB/floppy disks and suggests they are 1) used 2) insecure 3) easily can be attacked. This without ever explaining how. They also suggest that the someone on the vessel themselves creates this stowage plan. This is utterly strange. Stowage plans aren't normally made by people on the vessel for the companies I know. Loads of details in this article make no sense at all. That said, container shipping should be hugely improved is true :-P The main bit is true as well: if you mess up the stowage plan you'd easily cause a lot of damage: yeah. Plus there's probably enough ways to do this. PS: It's not a CSV file.

wyldfire 9y ago

<Chuckle> -- with all of the containerization metaphors these days I assumed "container ships" was just some logical collection of containers. Heck, the docker logo uses these same shipping containers.

mbell 9y ago

So the real life Da Vinci virus?

acrooks 9y ago

I work at a company (https://www.stage3systems.com https://www.stage3systems.com) that builds software for the marine shipping industry. Currently we are expanding one of our products for a large container ship owner so we can import these loading condition files into the product for both long-term analysis and also short-term alerting. Once this project is complete, a fleet superintendent will be able to set up alerts so that they get a push notification when we calculate that a load is risky or unbalanced. Hopefully this sort of thing will add an extra layer of validation before a ship sails from port. Fortunately, for our customer, they build quite robust ships and do not skimp on cost. But due to the economics of shipping right now, a number of owners in the world cut costs wherever they can. This includes reducing the amount of steel used in critical support beams which could increase the risk of a vessel breaking in half [1]. Sadly this makes a hack like this even more risky, because the combination of marginal errors, bad weather and a frail ship could be more than enough to cause a big problem. [1] https://en.wikipedia.org/wiki/MOL_Comfort https://en.wikipedia.org/wiki/MOL_Comfort

deleted 9y ago
[deleted]

siculars 9y ago

Isn't there verifying load software built in on the dock? The crane lifts the box so it knows how much it weighs and it also knows where it put it. How is there not a 3D map of load distribution at the time the ship is loaded and before it sails?

nraynaud 9y ago
there are sensors for the attitude of the boat

mizchief2 9y ago

Wasn't this the plot of the movie "Hackers" ?

oasisbob 9y ago

First thought is that this would be a fun situation for the Underhanded C Contest, but it seems rather similar to the 2009 scenario: http://www.underhanded-c.org/_page_id_22.html http://www.underhanded-c.org/_page_id_22.html

kwillets 9y ago

This is essentially what capsized the Saewol and killed hundreds of people. It can be detected with empirical tests however. Almost every ship should right itself from a roll within ten seconds or so, so anyone with a stopwatch can detect misloading. There are monitors that measure this continuously as well. At one point I was thinking of making a phone app for this, so that ferry passengers could check stability themselves.

mordechai9000 9y ago
Just to make sure I understand - are you saying that on a properly loaded ship, no more than ten seconds should pass between the deck going out of level and then returning to level? Does it matter if it's rolling side to side, or front to back?
- kwillets 9y ago
  Side-to-side. There's a certain design range where it's not too fast and not too slow, and some inspectors check for it. https://en.wikipedia.org/wiki/Metacentric_height#GM_and_rolling_period https://en.wikipedia.org/wiki/Metacentric_height#GM_and_roll... Also, there's random motion that may look like roll when it's the sea surface that's showing the motion, so there are methods to filter that out and extract the actual rolling period.

senectus1 9y ago

I work for a company that loads dirt (yeah ok "Iron Ore") on cape size ships... Filling the ships up is done with heavy consultation from the ships captain and often isn't as obvious and simple as one (layman) might expect. Hacking the process is definitely a concern. something we care about quite seriously.