Read on Twitter
I'm researching a piece on #unmanned #maritime systems (UMS), #cyber, #portsecurity. Of interest: UMS as a vector for #cyberattacks. So I've been reading about aerial drones, DJI, geofencing ...
@CovertShores @David_Hambling @HostileSpectrum @CyberStatecraft @HeikoBorchert
@CovertShores @David_Hambling @HostileSpectrum @CyberStatecraft @HeikoBorchert
@RANDCorporation published an interesting study last year - "How to Analyze the Cyber Threat From Drones" - exploring how quadcopters, in addition to being vulnerable to #cyberattacks themselves, could also be used to perpetrate them. https://www.rand.org/pubs/research_reports/RR2972.html
By augmenting a COTS quadcopter with technologies like a WiFi card and Raspberry Pi, it could:
- Act as a rogue WiFi access point
- Penetrate poorly or unsecured WiFi networks to execute "man in the middle" attacks
- Gain access to sensitive data
- Insert malware.
- Act as a rogue WiFi access point
- Penetrate poorly or unsecured WiFi networks to execute "man in the middle" attacks
- Gain access to sensitive data
- Insert malware.
One safeguard against drone cyberattacks is geofencing, a virtual GPS barrier that prevents drones from crossing into airspace surrounding sensitive facilities such as military bases, nuclear power plants, prisons. https://www.dji.com/flysafe/geo-map
I decided to use leading drone maker DJI's Geo Zone Map to explore the geofencing around some prominent ports and facilities around the world.
What I found was interesting.
What I found was interesting.
First, for reference, here is the formidable geofencing in place around Washington, D.C. Areas marked in red are "Restricted Zones," while areas marked in blue are "Authorization Zones" which can be "unlocked by authorized users using a DJI verified account."
Here we have two major U.S. naval facilities - Naval Station Norfolk, home to the Atlantic Fleet, and Naval Station San Diego, home to the Pacific Fleet. As you can see, they are fully geofenced as Restricted Zones.
U.S. submarine bases are also fully geofenced. Here we have New London and King's Bay (note the extended coverage area).
Compare this to three U.S. adversaries: Russia, Iran and China. Here we have the greater Kola Bay region, home to Russia's Northern Fleet, including Olenya Guba, home to the Main Directorate of Deep Sea Research (GUGI). The only geofencing in sight is Murmansk Airport.
And here we have Bandar Abbas. As you can see, the port is somewhat geofenced by an Authorization Zone in place to protect Havadarya Air Base, but it is not a Restricted Zone.
Not surprisingly, China's Yulin/Longpo Naval Base is fully (and widely) geofenced. However, Shanghai, China's busiest port, is not. (Though nearby Shanghai Museum is.)
Here we have a commercial-military hybrid facility, the Port of Haifa, home to the Israeli Navy and frequent port of call for the U.S. Sixth Fleet. Commercial ops are largely covered by an Authorization Zone from Haifa Airport, though the naval berthing area is wide open.
U.S. commercial facilities appear to be wide open. Here we have the Port of Los Angeles, the Port of Savannah, and the Port of Baltimore, all with no geofencing. (Note the tiny industrial park in Savannah that IS geofenced.)
In the absence of geofencing, local laws may act as a deterrent to operating drones near sensitive installations. Moreover, WiFi range limitations (50 meters) may also pose a barrier to attacks, however an AFIT study suggests that this could be overcome:
https://scholar.afit.edu/cgi/viewcontent.cgi?article=4225&context=etd
https://scholar.afit.edu/cgi/viewcontent.cgi?article=4225&context=etd
Perhaps there is more than what meets the eye here. But I find it interesting that given the increased scrutiny of drones and drone makers, and the concerns surrounding port cybersecurity, there is little if any geofencing provided to critical commercial maritime facilities.
