Ports Of San Diego & Barcelona Come Under Attack

Cyber-attacks have now been reported at three ports in the last two months.
Two major international ports fell victim to cyber-attacks within the span of a week, putting the shipping industry on alert for a possible threat actor targeting the entire sector.

The first to fall was the Port of Barcelona, Spain, on September 20, last week. The second attack was reported yesterday, September 25, by the Port of San Diego, in the United States.

None of the two port authorities revealed any details about the nature of the cyber-attacks, leaving security experts to speculate about possible causes.

The cyber-attack on the Port of Barcelona did not affect ship movements in and out of the harbor, and a local newspaper reported that it impacted only land operations, such as loading or unloading of boats, although the Port denied there was a serious disruption to customers.

In a tweet two days after the initial attack, the Port of Barcelona said that only internal IT systems were affected, but did not offer other details, even after a week's worth of requests for comments and questions from ZDNet.

The Barcelona cyber-attack was followed by another one recently, this time against the Port of San Diego, a medium-sized cargo port on the US west coast.

‘Port employees are currently at work but have limited functionality, which may have temporary impacts on service to the public, especially in the areas of park permits, public records requests, and business services," said Randa Coniglio, Chief Executive Officer for the Port of San Diego in a statement released a day after the attack.

Port officials did not respond to a request for further comment from ZDNet, but they said they are still investigating the hack.

Just like the Barcelona port, San Diego officials stayed mum regarding the nature of the attack. It is unclear if the two incidents are related or alike, and the whole maritime industry may benefit from a little bit of openness about the two incidents. Port authorities around the world should be on alert, regardless.

One of the security researchers who tipped ZDNet about the last incident noted that both port authorities described the cyber-attacks as disruptive, a term commonly used with ransomware attacks, which are destructive in nature, but not with other forms of cyber-attacks, such as data breaches, where intruders' main goal is to stay undetected by leaving systems intact and working.

This is speculation, at this point, as both ports declined to provide technical details, but the speculation has its merits, based on a previous incident.

Back in July, there was a ransomware attack that was initially reported as an infection affecting the Long Beach Port, which was later tracked down and isolated to the port terminal of the China Ocean Shipping Company (COSCO), and later the company's internal network, one of the world's largest shipping firms.

With three "disruptive" cyber-attacks reported by three ports in two months, some might wonder if a threat group isn't targeting ports intentionally. This isn't a surprise, as ports handle a huge amount of business, and any disturbance can lead to serious financial losses.

When the NotPetya ransomware outbreak started to spread last year, one of the first companies to report issues was Maersk, the world's largest cargo shipping company. Maersk's poor security practice cost the company over $300 million in damages, and the company's IT staff had to reinstall 4,000 servers, 45,000 PCs, and 2,500 applications in ten days, in what the chairman called a "heroic effort."

Last year, UK shipping provider Clarksons PLS was also hacked and blackmailed by a hacker who breached the company's systems and claimed to have stolen its database. Clarksons refused to pay, but the event made headlines anyway.

Port authorities and ships have long been considered easy to hack. One cyber-security firm, in particular, published a long string of blog posts detailing the various ways in which someone could hack IT systems in ports and on ships. 

But these blog posts describe high-tech hacks and are probably not the main entry of these attacks. Usually failure in IT maintenance of regular systems is the point of entry for most hackers, such as outdated software, open RDP endpoints, or employees running malicious files received via email, etc.

Ironically, five months before it got hacked, the Port of Barcelona published a blog post titled "Are ports prepared to deal with threats from hackers?"

Apparently not.

Updated on September 27, 14:00 ET: A Port of San Diego spokesperson confirmed via email that the cyber-attack was a ransomware infection.

"We can confirm it is ransomware, but cannot provide additional details at this time," the spokesperson said.

ZDNet:

You Might Also Read:

The Maritime Industry's Slow Boat To Cybersecurity

« A Self-Flying AI-Powered Drone That Can Track You
Liberating Personal Data »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Chubb

Chubb

Chubb is the world’s largest publicly traded property and casualty insurer. Commercial services include Cyber Risk insurance.

Avatier

Avatier

Avatier identity management software products automate identity access management, user provisioning and IT governance to ensure information security and compliance.

EdgeWave

EdgeWave

EdgeWave provides simple but highly effective data security and advanced threat protection in solutions that are affordable, scalable and easy to use.

Tessian

Tessian

Tessian (formerly CheckRecipient) is a next-generation email security platform that helps enterprises counteract human error and significantly reduce the risk of data loss.

Qufaro

Qufaro

Qufaro is a new initiative designed to make it simpler for those with career ambitions in cyber security to access the UK’s cyber-specific education and innovation opportunities.

totemo

totemo

Totemo offers solutions for the secure exchange of business information.

ISMS Accreditation Center (ISMS-AC)

ISMS Accreditation Center (ISMS-AC)

ISMS-AC is the national accreditation body for Japan. The directory of members provides details of organisations offering certification services for ISO 27001.

ICS Cyber Security Conference

ICS Cyber Security Conference

SecurityWeek’s Industrial Control Systems (ICS) Cyber Security Conference is the largest and longest-running event series focused on industrial cybersecurity.

Passbase

Passbase

Passbase is building a full-stack identity verification engine backed by verified government documents.

ISARR

ISARR

The ISARR software platform - your bespoke Risk, Resilience & Security Management solution. Simple, cost effective and adaptable, now and into the future.

Action1

Action1

Action1 is a Cloud-based lightweight endpoint security platform that discovers all of your endpoints in seconds and allows you to retrieve live security information from the entire network.

Inflection Point Ventures (IPV)

Inflection Point Ventures (IPV)

Inflection Point Ventures (IPV) is a 6000+ members angel investing firm which supports new-age entrepreneurs by connecting them with a diverse group of investors.

Lodestone

Lodestone

Lodestone partners with clients to help them mitigate business and reputational risk, through our human-based, approach to cyber security, digital forensics and incident response.

Cybercentry

Cybercentry

Cybercentry is a specialist information security, data protection and cyber security consultancy.

Arsen Cybersecurity

Arsen Cybersecurity

Arsen is a French cybersecurity startup, dedicated to enhancing human behaviors in cybersecurity.

Triskele Labs

Triskele Labs

Triskele Labs deliver services including Penetration Testing, Compliance and Risk Management through to 24*7*365 Security Operations and outsourced Cybersecurity Managers.