Ports Of San Diego & Barcelona Come Under Attack

Cyber-attacks have now been reported at three ports in the last two months.
Two major international ports fell victim to cyber-attacks within the span of a week, putting the shipping industry on alert for a possible threat actor targeting the entire sector.

The first to fall was the Port of Barcelona, Spain, on September 20, last week. The second attack was reported yesterday, September 25, by the Port of San Diego, in the United States.

None of the two port authorities revealed any details about the nature of the cyber-attacks, leaving security experts to speculate about possible causes.

The cyber-attack on the Port of Barcelona did not affect ship movements in and out of the harbor, and a local newspaper reported that it impacted only land operations, such as loading or unloading of boats, although the Port denied there was a serious disruption to customers.

In a tweet two days after the initial attack, the Port of Barcelona said that only internal IT systems were affected, but did not offer other details, even after a week's worth of requests for comments and questions from ZDNet.

The Barcelona cyber-attack was followed by another one recently, this time against the Port of San Diego, a medium-sized cargo port on the US west coast.

‘Port employees are currently at work but have limited functionality, which may have temporary impacts on service to the public, especially in the areas of park permits, public records requests, and business services," said Randa Coniglio, Chief Executive Officer for the Port of San Diego in a statement released a day after the attack.

Port officials did not respond to a request for further comment from ZDNet, but they said they are still investigating the hack.

Just like the Barcelona port, San Diego officials stayed mum regarding the nature of the attack. It is unclear if the two incidents are related or alike, and the whole maritime industry may benefit from a little bit of openness about the two incidents. Port authorities around the world should be on alert, regardless.

One of the security researchers who tipped ZDNet about the last incident noted that both port authorities described the cyber-attacks as disruptive, a term commonly used with ransomware attacks, which are destructive in nature, but not with other forms of cyber-attacks, such as data breaches, where intruders' main goal is to stay undetected by leaving systems intact and working.

This is speculation, at this point, as both ports declined to provide technical details, but the speculation has its merits, based on a previous incident.

Back in July, there was a ransomware attack that was initially reported as an infection affecting the Long Beach Port, which was later tracked down and isolated to the port terminal of the China Ocean Shipping Company (COSCO), and later the company's internal network, one of the world's largest shipping firms.

With three "disruptive" cyber-attacks reported by three ports in two months, some might wonder if a threat group isn't targeting ports intentionally. This isn't a surprise, as ports handle a huge amount of business, and any disturbance can lead to serious financial losses.

When the NotPetya ransomware outbreak started to spread last year, one of the first companies to report issues was Maersk, the world's largest cargo shipping company. Maersk's poor security practice cost the company over $300 million in damages, and the company's IT staff had to reinstall 4,000 servers, 45,000 PCs, and 2,500 applications in ten days, in what the chairman called a "heroic effort."

Last year, UK shipping provider Clarksons PLS was also hacked and blackmailed by a hacker who breached the company's systems and claimed to have stolen its database. Clarksons refused to pay, but the event made headlines anyway.

Port authorities and ships have long been considered easy to hack. One cyber-security firm, in particular, published a long string of blog posts detailing the various ways in which someone could hack IT systems in ports and on ships. 

But these blog posts describe high-tech hacks and are probably not the main entry of these attacks. Usually failure in IT maintenance of regular systems is the point of entry for most hackers, such as outdated software, open RDP endpoints, or employees running malicious files received via email, etc.

Ironically, five months before it got hacked, the Port of Barcelona published a blog post titled "Are ports prepared to deal with threats from hackers?"

Apparently not.

Updated on September 27, 14:00 ET: A Port of San Diego spokesperson confirmed via email that the cyber-attack was a ransomware infection.

"We can confirm it is ransomware, but cannot provide additional details at this time," the spokesperson said.

ZDNet:

You Might Also Read:

The Maritime Industry's Slow Boat To Cybersecurity

« A Self-Flying AI-Powered Drone That Can Track You
Liberating Personal Data »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Reposify

Reposify

Reposify’s cybersecurity solution identifies, manages and defends companies’ global digital footprints.

Intertrust Technologies

Intertrust Technologies

Intertrust Technologies is a software company specializing in trusted computing products and services.

Bangladesh Computer Council (BCC)

Bangladesh Computer Council (BCC)

Bangladesh Computer Council (BCC) is a government body providing support for ICT related activities including formulating national ICT strategy and policy.

Exeon Analytics

Exeon Analytics

Exeon Analytics is a Swiss cyber security company that is specialized in detecting hidden data breaches and advanced cyber attacks.

Absolute IT Asset Disposals

Absolute IT Asset Disposals

Absolute IT Asset Disposals is an IT asset disposal (ITAD) company providing safe and secure recycling of IT assets.

Innovasec

Innovasec

Innovasec provide information security consulting and training services.

MyCyberSecurity Clinic (MyCSC)

MyCyberSecurity Clinic (MyCSC)

MyCyberSecurity Clinic's main goal is toward establishing an international reference centre for excellence in the field of digital forensics and data recovery services.

Cyber Polygon

Cyber Polygon

Cyber Polygon is an annual online exercise which connects various global organisations to train their competencies and exchange best practices.

YouWipe

YouWipe

Scandinavian Data Erasure Leader YouWipe is the number one choice of European Ministries, European Central Banks, Swiss Pharmaceuticals and Major Electronics Retail Chains.

Axxum Technologies

Axxum Technologies

Axxum Technologies is a premier provider of Network Communications and Information Technology Security Solutions.

CRI Group

CRI Group

CRI Group excels at deterring, detecting and investigating crimes against businesses using a global network of professionals specially trained in Anti-Corruption, Risk Management and Compliance.

Binare

Binare

Binare empowers companies all over the world to improve their IIot/IoT /Embedded cybersecurity posture and digital privacy.

Sparrow

Sparrow

Sparrow specializes in application security testing solutions to cope with new technology trends such as cloud, mobile, and DevSecOps.

Total Secure Technology

Total Secure Technology

Total Secure Technology provides trusted Managed IT Security and Managed IT Services for organizations looking to increase their cybersecurity defensive posture.

Hunt & Hackett

Hunt & Hackett

Hunt & Hackett helps European companies prevent, detect and respond to today’s most advanced adversaries, safeguarding them against cyberthreats and espionage.

Cloud Native Computing Foundation (CNCF)

Cloud Native Computing Foundation (CNCF)

CNCF seeks to drive adoption of cloud native technologies by fostering and sustaining an ecosystem of open source, vendor-neutral projects.