Port of San Diego suffers cyber-attack, second port in a week after Barcelona

Two major international ports fell victim to cyber-attacks within the span of a week, putting the shipping industry on alert for a possible threat actor targeting the entire sector.

The first to fall was the Port of Barcelona, Spain, on September 20, last week. The second attack was reported yesterday, September 25, by the Port of San Diego, in the United States.

None of the two port authorities revealed any details about the nature of the cyber-attacks, leaving security experts to speculate about possible causes.

The cyber-attack on the Port of Barcelona did not affect ship movements in and out of the harbor, and a local newspaper reported that it impacted only land operations, such as loading or unloading of boats, although the Port denied there was a serious disruption to customers.

In a tweet two days after the initial attack, the Port of Barcelona said that only internal IT systems were affected, but did not offer other details, even after a week’s worth of requests for comments and questions from ZDNet.

Also: How automakers are tackling connected vehicle vulnerability management

The Barcelona cyber-attack was followed by another one this week, this time against the Port of San Diego, a medium-sized cargo port on the US west coast.

“Port employees are currently at work but have limited functionality, which may have temporary impacts on service to the public, especially in the areas of park permits, public records requests, and business services,” said Randa Coniglio, Chief Executive Officer for the Port of San Diego in a statement released a day after the attack.

Port officials did not respond to a request for further comment from ZDNet, but they said they are still investigating the hack.

Just like the Barcelona port, San Diego officials stayed mum regarding the nature of the attack. It is unclear if the two incidents are related or alike, and the whole maritime industry may benefit from a little bit of openness about the two incidents. Port authorities around the world should be on alert, regardless.

TechRepublic: PCI compliance slipping for first time in 6 years, but IT remains on top

Of of the security researchers who tipped ZDNet about the last incident noted that both port authorities described the cyber-attacks as disruptive, a term commonly used with ransomware attacks, which are destructive in nature, but not with other forms of cyber-attacks, such as data breaches, where intruders’ main goal is to stay undetected by leaving systems intact and working.

This is speculation, at this point, as both ports declined to provide technical details, but the speculation has its merits, based on a previous incident.

Back in July, there was a ransomware attack that was initially reported as an infection affecting the Long Beach Port, which was later tracked down and isolated to the port terminal of the China Ocean Shipping Company (COSCO), and later the company’s internal network, one of the world’s largest shipping firms.

With three “disruptive” cyber-attacks reported by three ports in two months, some might wonder if a threat group isn’t targeting ports intentionally. This isn’t a surprise, as ports handle a huge amount of business, and any disturbance can lead to serious financial losses.

CNET: Hackers should be pumped about gas station security flaws

When the NotPetya ransomware outbreak started to spread last year, one of the first companies to report issues was Maersk, the world’s largest cargo shipping company. Maersk’s poor security practice cost the company over $300 million in damages, and the company’s IT staff had to reinstall 4,000 servers, 45,000 PCs, and 2,500 applications in ten days, in what the chairman called a “heroic effort.”

Last year, UK shipping provider Clarksons PLS was also hacked and blackmailed by a hacker who breached the company’s systems and claimed to have stolen its database. Clarksons refused to pay, but the event made headlines anyway.

Port authorities and ships have long been considered easy to hack. One cyber-security firm, in particular, published a long string of blog posts detailing the various ways in which someone could hack IT systems in ports and on ships [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]. But these blog posts describe high-tech hacks and are probably not the main entry of these attacks. Usually failure in IT maintenance of regular systems is the point of entry for most hackers, such as outdated software, open RDP endpoints, or employees running malicious files received via email, etc..

Ironically, five months before it got hacked, the Port of Barcelona published a blog post titled “Are ports prepared to deal with threats from hackers?“

Apparently not.

Updated on September 27, 14:00 ET: A Port of San Diego spokesperson confirmed via email that the cyber-attack was a ransomware infection.

“We can confirm it is ransomware, but cannot provide additional details at this time,” the spokesperson said.

Previous and related coverage:

READ MORE HERE