A Tale of Sea and Sky: On the Security of Maritime VSAT Communications

A Tale of Sea and Sky: On the Security of Maritime VSAT Communications—James Pavur, Daniel Moser, Martin Stohmeier, Vincent Lenders, Ivan Martinovic

Very Small Aperture Terminals (VSAT) have revolutionized maritime operations. However, the security dimensions
of maritime VSAT services are not well understood. Historically,
high equipment costs have acted as a barrier to entry for both
researchers and attackers. In this paper we demonstrate a substantial change in threat model, proving practical attacks against
maritime VSAT networks with less than $400 of widely-available
television equipment. This is achieved through GSExtract, a
purpose-built forensic tool which enables the extraction of IP
traffic from highly corrupted VSAT data streams.
The implications of this threat are assessed experimentally
through the analysis of more than 1.3 TB of real-world maritime
VSAT recordings encompassing 26 million square kilometers of
coverage area. The underlying network platform employed in
these systems is representative of more than 60% of the global
maritime VSAT services market. We find that sensitive data
belonging to some of the world’s largest maritime companies
is regularly leaked over VSAT ship-to-shore communications.
This threat is contextualized through illustrative case studies
ranging from the interception and alteration of navigational
charts to theft of passport and credit card details. Beyond this,
we demonstrate the ability to arbitrarily intercept and modify
TCP sessions under certain network configurations, enabling
man-in-the-middle and denial of service attacks against ships
at sea. The paper concludes with a brief discussion of the
unique requirements and challenges for encryption in VSAT
environments.