Pirates hack into shipping company’s servers to identify booty
arstechnica.com
arstechnica.com
1. A container shipping company does not store the bar code of crates/packages. I've easily read 100s of booking details and never seen this. At most you maybe find one booking where the customer gave too much info and the customer service person copy/pasted too much. Anyway, either the article is talking about the container number or the hacked company is a logistics company.
2. If it is a logistics company, they wouldn't know exactly where the container is on the vessel. You can ask "above/below deck", but exact details aren't normally shared. You'd need to hack two companies if the pirates behaved like the article suggests.
3. Boarding a container ship isn't that easy as a lot of them are huge.
4. A container might just be reachable. Hint: For some commodities special care is taken to ensure that the vessel crew can still reach it. It's much easier to target a container after it has left a terminal and is e.g. on a truck. Note that even with full access it is better to somehow takeover a truck than to pick it up yourself; they check and your identification (passport/drivers license) when you pick up.
At most this might be about some logistics company that uses small vessels. E.g. intra Asia trade. Any big company I would be surprised if the hackers would make sense of all the systems :-P
That said, every so often you do see news articles whereby someone within either customs or a shipping company sells the details to others. Those others then steal the goods. But not by boarding vessels though, they takeover the truck.
Quoting: "They’d board a vessel, locate by bar code specific sought-after crates containing valuables, steal the contents of that crate—and that crate only—and then depart the vessel without further incident."
You can download the Verizon report (that is the source for this article) here: http://www.verizonenterprise.com/resources/reports/rp_data-b...
From reading the report it seems they confused container numbers with crate bar codes.
This bit: "They’d board a vessel, locate by bar code specific sought-after crates containing valuables, steal the contents of that crate—and that crate only—and then depart the vessel without further incident."
When you board a vessel with container numbers, you don't see crates. However, you can find the container then search through the container and determine the crate. But the crate bar code? That's incorrect. A bill of lading will show the crate contents as well as its container number. It does NOT contain a bar code.
The PDF is obviously a marketing piece; it is not surprising some details are incorrect.
If you ignore the bar code part, then yeah, if the target was a shipping company then you could determine the contents of containers within reach and what is in them. Still need to go through the container though.
- stop a truck on a highway; take the driver out of the truck; drive off.
- board a container ship; track the targeted container; steal the contents; leave with cargo in high sea.
Sources?
Here you go: https://www.google.com/search?q=highway+truck+heist
It's what comes after the crime that actually matters, and I feel like the whole 'escape with the booty' part could be much easier at sea.
Or just get a few men to throw overboard anything you're not interested in. A pirate has no obligation to leave his crime scene well-organized.
"Hacking" might not be an appropriate term here though. Most shipping website security is beyond awful. I've used Selenium to pull stuff off of shipping sites before as APIs are almost non-existent. When they do exist, they return fixed length text that you have to decode or you're using something archaic like automated email replies when you email a container number to them. (I have sent thousands of emails in a five minute period to a single VOCC to figure out if they were actually the ones shipping something and where the cargo is.) Lastly I've actually sent emails to website support on tracking sites telling them they weren't sanitizing inputs at all. Zero interest or chest pounding brush off reply.
As for barcodes, they probably mean shipping container number (ISO 6346 - https://en.wikipedia.org/wiki/ISO_6346).
Now all you need are pirates with a Russian Mil Mi-26 to dig for the buried treasure on the vessel while at sea (like in William Gibson's Spook Country)
That's not how freight works.
When we ordered an iPad from Apple in 2011, it got handed to one of the big delivery companies (FedEx?) in China, then got put on a plane to the US.
Jan 2015 saw 17 billion Air Freight Kilometers available but with utilisation running at about 46% - most routes only have freight used one way [2]
[1] http://www.macrumors.com/2013/09/11/how-apple-ships-millions...
[2] http://www.iata.org/whatwedo/Documents/economics/freight-ana...
Aside from that though, I wonder if we'll be seeing increasing criminal activity like this or if it'll stay as an occasional source of funny headlines.
On the one hand the resources and knowledge of how to compromise a server are more accessible all the time.
On the other, exploited vulnerabilities are patched and the walls stay a bit higher than the cheap ladders. This will pretty much ensure that there is almost always at least a non-trivial amount of learning that needs to be done in order to profitably compromise equipment for practical purposes.
I'm thinking that the prevalence of basic technical savvy (roughly "has strong google-fu in the service of troubleshooting" or better) is going to be the largest influence on whether hacking-augmented crime increases or not.
My logic here is that it would happen more if more criminals knew how to go about learning how to hack since that gap between pre-built tools and practical application is always going to be there, but it's certainly bridgeable with some curiosity.
More technically savvy population, more cybercrime. It makes sense, but it can also be used as a kind of fluency metric. I thereby propose the frequency of computer-aided criminal activity as a fraction of all criminal activity to be a target metric for US technology education, higher is better.
We already live in a world where you don't need to own a botnet to DDoS somebody. You just rent someone else's botnet by the minute. The pirates in the story are amateurs now, but soon somebody might rise among their ranks as the go-to guy for computer stuff. Just pay him a few ringgits and you don't even need to know about Google. The only thing you need to know is who to call.
BTW, the pirates out there, keep downvoting :-) I don't speak your pirate language.
Or: start a shipping services company and "lose" the odd lot.
it did say
> connecting directly from their home system
> [blocking] ending the targeted attacks
But then again, maybe it was a proxy through a compromised system.
All said, though, this could just be a nonsense fluff piece promoting Verizon, ars just links to their PR page when it implies you will get a detailed report.
If you ever do ever visit Medan, check out the taxidermy museum, it's not the sort of thing I'd normally support but it's the most awesome such museum on the planet by a long shot (even better than Walter Rothschild's legacy at Tring in the UK).
Incidentally in the last few days they just had a major earthquake a hundred clicks offshore to the south of Sumatra, and reports of tsunami waves. The northern tip, Banda Aceh, was one of the worst affected locations in the huge tsunami a few years back. It's enough to make you head to the northern coast and try your luck as a pirate.
http://www.goodreads.com/book/show/18849590-black-flag
Entertaining if you like reading modern special forces fiction.
Wait so a few script kiddies were able to pwn a sophisticated company's "in house CMS" (as if that was ever a good idea), and these guys are smug about the fact that the Pirates made a few typos?!
And then realized that simply closing the security hole gains them the same amount of profit.