Cybersecurity Attacks on Software Logic and Error Handling Within AIS Implementations: A Systematic Testing of Resilience
To increase situational awareness of maritime vessels and other entities and to enable their exchange of various information, the International Maritime Organization mandated the use of the Automatic Identification System (AIS) in 2004. The AIS is a self-reporting system that uses the VHF radio link...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2022-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9733358/ |
| _version_ | 1818646638732771328 |
|---|---|
| author | Syed Khandker Hannu Turtiainen Andrei Costin Timo Hamalainen |
| author_facet | Syed Khandker Hannu Turtiainen Andrei Costin Timo Hamalainen |
| author_sort | Syed Khandker |
| collection | DOAJ |
| description | To increase situational awareness of maritime vessels and other entities and to enable their exchange of various information, the International Maritime Organization mandated the use of the Automatic Identification System (AIS) in 2004. The AIS is a self-reporting system that uses the VHF radio link. However, any radio-based self-reporting system is prone to forgery, especially in situations where authentication of the message is not designed into the architecture. As AIS was designed in the 1990s when cyberattacks were in their infancy, it does not implement authentication or encryption; thus, it can be seen as fundamentally vulnerable against cyberattacks. This paper demonstrates and evaluates the impact of multiple cyberattacks on AIS via remote radio frequency (RF) links using transmission-enabled software-defined radio (SDR). Overall, we implemented and tested a total of 11 different tests/attacks on 19 AIS setups, using a controlled environment. The tested configurations were derived from heterogeneous platforms such as Windows, Android, generic receivers, and commercial transponders. Our aim is to enhance the early discovery of new vulnerabilities in AIS to effectively address AIS attacks in the nearest future. The results showed that approximately 89% of the setups were affected by Denial-of-Service (DoS) attacks at the AIS protocol level. Besides implementing some existing attack ideas (e.g., spoofing, DoS, and flooding), we showed some novel attack concepts in the AIS context such as a coordinated attack, overwhelming alerts, and logical vulnerabilities, all of which have the potential to cause software/system crashes in the worst-case scenarios. Moreover, an implementation/specification flaw related to the AIS preamble was identified during the experiments, which may affect the interoperability of different AIS devices. The error-handling system in AIS was also investigated. Unlike the aviation sector’s Automatic Dependent Surveillance-Broadcast (ADS-B), the maritime sector’s AIS does not effectively support any error correction method, which may contribute to RF pollution and less effective use of the overall system. The consistency of our results for a comprehensive range of hardware-software configurations indicated the reliability of our approach, test system, and evaluation results. |
| first_indexed | 2024-12-17T00:49:49Z |
| format | Article |
| id | doaj.art-12b073098ccc475eb5403ecd8c9fba42 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-17T00:49:49Z |
| publishDate | 2022-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-12b073098ccc475eb5403ecd8c9fba422022-12-21T22:09:47ZengIEEEIEEE Access2169-35362022-01-0110294932950510.1109/ACCESS.2022.31589439733358Cybersecurity Attacks on Software Logic and Error Handling Within AIS Implementations: A Systematic Testing of ResilienceSyed Khandker0https://orcid.org/0000-0001-7899-7339Hannu Turtiainen1https://orcid.org/0000-0002-7631-620XAndrei Costin2https://orcid.org/0000-0002-2704-9715Timo Hamalainen3https://orcid.org/0000-0002-4168-9102Faculty of Information Technology, University of Jyväskylä, Jyväskylä, FinlandFaculty of Information Technology, University of Jyväskylä, Jyväskylä, FinlandFaculty of Information Technology, University of Jyväskylä, Jyväskylä, FinlandFaculty of Information Technology, University of Jyväskylä, Jyväskylä, FinlandTo increase situational awareness of maritime vessels and other entities and to enable their exchange of various information, the International Maritime Organization mandated the use of the Automatic Identification System (AIS) in 2004. The AIS is a self-reporting system that uses the VHF radio link. However, any radio-based self-reporting system is prone to forgery, especially in situations where authentication of the message is not designed into the architecture. As AIS was designed in the 1990s when cyberattacks were in their infancy, it does not implement authentication or encryption; thus, it can be seen as fundamentally vulnerable against cyberattacks. This paper demonstrates and evaluates the impact of multiple cyberattacks on AIS via remote radio frequency (RF) links using transmission-enabled software-defined radio (SDR). Overall, we implemented and tested a total of 11 different tests/attacks on 19 AIS setups, using a controlled environment. The tested configurations were derived from heterogeneous platforms such as Windows, Android, generic receivers, and commercial transponders. Our aim is to enhance the early discovery of new vulnerabilities in AIS to effectively address AIS attacks in the nearest future. The results showed that approximately 89% of the setups were affected by Denial-of-Service (DoS) attacks at the AIS protocol level. Besides implementing some existing attack ideas (e.g., spoofing, DoS, and flooding), we showed some novel attack concepts in the AIS context such as a coordinated attack, overwhelming alerts, and logical vulnerabilities, all of which have the potential to cause software/system crashes in the worst-case scenarios. Moreover, an implementation/specification flaw related to the AIS preamble was identified during the experiments, which may affect the interoperability of different AIS devices. The error-handling system in AIS was also investigated. Unlike the aviation sector’s Automatic Dependent Surveillance-Broadcast (ADS-B), the maritime sector’s AIS does not effectively support any error correction method, which may contribute to RF pollution and less effective use of the overall system. The consistency of our results for a comprehensive range of hardware-software configurations indicated the reliability of our approach, test system, and evaluation results.https://ieeexplore.ieee.org/document/9733358/AISattackscybersecurityDoSmaritimeresiliency |
| spellingShingle | Syed Khandker Hannu Turtiainen Andrei Costin Timo Hamalainen Cybersecurity Attacks on Software Logic and Error Handling Within AIS Implementations: A Systematic Testing of Resilience IEEE Access AIS attacks cybersecurity DoS maritime resiliency |
| title | Cybersecurity Attacks on Software Logic and Error Handling Within AIS Implementations: A Systematic Testing of Resilience |
| title_full | Cybersecurity Attacks on Software Logic and Error Handling Within AIS Implementations: A Systematic Testing of Resilience |
| title_fullStr | Cybersecurity Attacks on Software Logic and Error Handling Within AIS Implementations: A Systematic Testing of Resilience |
| title_full_unstemmed | Cybersecurity Attacks on Software Logic and Error Handling Within AIS Implementations: A Systematic Testing of Resilience |
| title_short | Cybersecurity Attacks on Software Logic and Error Handling Within AIS Implementations: A Systematic Testing of Resilience |
| title_sort | cybersecurity attacks on software logic and error handling within ais implementations a systematic testing of resilience |
| topic | AIS attacks cybersecurity DoS maritime resiliency |
| url | https://ieeexplore.ieee.org/document/9733358/ |
| work_keys_str_mv | AT syedkhandker cybersecurityattacksonsoftwarelogicanderrorhandlingwithinaisimplementationsasystematictestingofresilience AT hannuturtiainen cybersecurityattacksonsoftwarelogicanderrorhandlingwithinaisimplementationsasystematictestingofresilience AT andreicostin cybersecurityattacksonsoftwarelogicanderrorhandlingwithinaisimplementationsasystematictestingofresilience AT timohamalainen cybersecurityattacksonsoftwarelogicanderrorhandlingwithinaisimplementationsasystematictestingofresilience |