Ports Of San Diego & Barcelona Come Under Attack

Cyber-attacks have now been reported at three ports in the last two months.
Two major international ports fell victim to cyber-attacks within the span of a week, putting the shipping industry on alert for a possible threat actor targeting the entire sector.

The first to fall was the Port of Barcelona, Spain, on September 20, last week. The second attack was reported yesterday, September 25, by the Port of San Diego, in the United States.

None of the two port authorities revealed any details about the nature of the cyber-attacks, leaving security experts to speculate about possible causes.

The cyber-attack on the Port of Barcelona did not affect ship movements in and out of the harbor, and a local newspaper reported that it impacted only land operations, such as loading or unloading of boats, although the Port denied there was a serious disruption to customers.

In a tweet two days after the initial attack, the Port of Barcelona said that only internal IT systems were affected, but did not offer other details, even after a week's worth of requests for comments and questions from ZDNet.

The Barcelona cyber-attack was followed by another one recently, this time against the Port of San Diego, a medium-sized cargo port on the US west coast.

‘Port employees are currently at work but have limited functionality, which may have temporary impacts on service to the public, especially in the areas of park permits, public records requests, and business services," said Randa Coniglio, Chief Executive Officer for the Port of San Diego in a statement released a day after the attack.

Port officials did not respond to a request for further comment from ZDNet, but they said they are still investigating the hack.

Just like the Barcelona port, San Diego officials stayed mum regarding the nature of the attack. It is unclear if the two incidents are related or alike, and the whole maritime industry may benefit from a little bit of openness about the two incidents. Port authorities around the world should be on alert, regardless.

One of the security researchers who tipped ZDNet about the last incident noted that both port authorities described the cyber-attacks as disruptive, a term commonly used with ransomware attacks, which are destructive in nature, but not with other forms of cyber-attacks, such as data breaches, where intruders' main goal is to stay undetected by leaving systems intact and working.

This is speculation, at this point, as both ports declined to provide technical details, but the speculation has its merits, based on a previous incident.

Back in July, there was a ransomware attack that was initially reported as an infection affecting the Long Beach Port, which was later tracked down and isolated to the port terminal of the China Ocean Shipping Company (COSCO), and later the company's internal network, one of the world's largest shipping firms.

With three "disruptive" cyber-attacks reported by three ports in two months, some might wonder if a threat group isn't targeting ports intentionally. This isn't a surprise, as ports handle a huge amount of business, and any disturbance can lead to serious financial losses.

When the NotPetya ransomware outbreak started to spread last year, one of the first companies to report issues was Maersk, the world's largest cargo shipping company. Maersk's poor security practice cost the company over $300 million in damages, and the company's IT staff had to reinstall 4,000 servers, 45,000 PCs, and 2,500 applications in ten days, in what the chairman called a "heroic effort."

Last year, UK shipping provider Clarksons PLS was also hacked and blackmailed by a hacker who breached the company's systems and claimed to have stolen its database. Clarksons refused to pay, but the event made headlines anyway.

Port authorities and ships have long been considered easy to hack. One cyber-security firm, in particular, published a long string of blog posts detailing the various ways in which someone could hack IT systems in ports and on ships. 

But these blog posts describe high-tech hacks and are probably not the main entry of these attacks. Usually failure in IT maintenance of regular systems is the point of entry for most hackers, such as outdated software, open RDP endpoints, or employees running malicious files received via email, etc.

Ironically, five months before it got hacked, the Port of Barcelona published a blog post titled "Are ports prepared to deal with threats from hackers?"

Apparently not.

Updated on September 27, 14:00 ET: A Port of San Diego spokesperson confirmed via email that the cyber-attack was a ransomware infection.

"We can confirm it is ransomware, but cannot provide additional details at this time," the spokesperson said.

ZDNet:

You Might Also Read:

The Maritime Industry's Slow Boat To Cybersecurity

« A Self-Flying AI-Powered Drone That Can Track You
Liberating Personal Data »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

CyTech Services

CyTech Services

CyTech provides Forensics Incident Response, Cyber Security and Training services.

Infrascale

Infrascale

Infrascale specialise in providing cloud backup and disaster recovery services.

Information Security Research Group - University of South Wales

Information Security Research Group - University of South Wales

The Information Security Research Group has an international reputation in the areas of network security, computer forensics and threat analysis.

SonicWall

SonicWall

SonicWall provide products for network security, access security, email security & encryption.

6cure

6cure

The 6cure Threat Protection solution eliminates malicious traffic to critical services in real time and protects against DDoS attacks.

Potomac Institute for Policy Studies

Potomac Institute for Policy Studies

Potomac Institute undertakes research on key science, technology, and national security issues facing society, Study areas include cybersecurity.

Military Cyber Professionals Association (MCPA)

Military Cyber Professionals Association (MCPA)

MCPA are a team of Soldiers, Sailors, Airmen, Marines, Veterans and others interested in the development of the American military cyber profession.

ODVA

ODVA

ODVA is a global trade and standards development organization whose members comprise the world’s leading industrial automation companies.

Avatier

Avatier

Avatier identity management software products automate identity access management, user provisioning and IT governance to ensure information security and compliance.

StrongKey

StrongKey

StrongKey (formerly StrongAuth) is a leader in Enterprise Key Management Infrastructure, bringing new levels of capability and data security at a price point significantly lower than other solutions.

Trusted Cyber Solutions

Trusted Cyber Solutions

Trusted Cyber Solutions is an independent Cyber Security and Risk Management consultancy.

Purple Knight

Purple Knight

Purple Knight is a free Active Directory security assessment tool built and managed by an elite group of Microsoft identity experts.

SideChannel

SideChannel

At SideChannel, we match companies with an expert virtual CISO (vCISO), so your organization can assess cyber risk and ensure cybersecurity compliance.

MiC Talent Solutions

MiC Talent Solutions

MiC Talent Solutions provides recruiting, direct hire, augmented staff, and professional service contracting solutions for organizations searching for minority cybersecurity talent.

Intel Ignite

Intel Ignite

Intel Ignite is an internationally renowned acceleration program for early-stage deep tech startups.

Box

Box

Box is the Cloud Content Management company that empowers enterprises to revolutionize how they work by securely connecting their people, information and applications.