From Connected Car to Connected Ship — Mapping Automotive Cyber Concepts to Maritime Security
From Connected Car to Connected Ship: How HU, TCU, and ECU Map to Shipboard Cybersecurity
Automotive security concepts don't map 1:1 to maritime — but the attack flow logic translates directly. Here's how to read a ship through a connected-car lens.
- LinkedIn : https://www.linkedin.com/in/shipjobs/
Collaborator : Lew, Julius, Jin, Morgan, Yeon
Security professionals coming from an automotive background often ask: "How does what I know about HU, TCU, and ECU apply to a ship?" The terminology doesn't map 1:1, but the attack flow logic translates almost directly. This article bridges the two worlds — mapping connected-car security concepts to their maritime equivalents, and explaining how tools like Attack Hosts, Jump Kits, Ping Sweep, ARP analysis, and SDR apply in a shipboard OT security context.
Ⅰ. HU · TCU · ECU — What Are the Ship Equivalents?
Automotive terms don't map directly to maritime, but from a role perspective, the parallels are close enough to be useful. The attack flow in a connected car — HU → TCU → ECU — has a direct shipboard analogue.
Ⅱ. Attack Host & Jump Kit — Redefined for Ships
The Kali/Parrot OS attack host from automotive security is needed in maritime — but repurposed:
- OS: Kali Linux, Parrot OS, or Hardened Linux
- Tools: Nmap, Wireshark, OpenVAS, tcpdump
- Checks: VLAN structure, exposed ports, default passwords, SATCOM router config
Not an attack machine — an official security diagnostic tool used strictly within defined ROE.
Redefined for ships as: "A verified, controlled test kit containing the equipment and software needed for shipboard cyber security diagnostics."
- 1–2 laptops (analysis + backup)
- Managed switch / small router (lab network reproduction)
- SDR (BladeRF, HackRF) — lab use only, not on operating vessels
- USB serial adapters, CAN/RS-485 interfaces (console monitoring)
⚠️ Jump Kit errors = unreproducible tests, collapsed result credibility, rejected certifications.
Ⅲ. Ping Sweep & ARP Analysis — Applied to Ships
In automotive security, Ping Sweep and ARP Cache Analysis find live devices on a test network. On a ship, the same techniques serve a different, defensive purpose.
- 10.x.x.x range → engine room OT devices
- 192.168.x.x range → office/bridge PCs
- Response patterns reveal network segmentation status
⚠️ Indiscriminate scanning on an underway vessel can overload OT devices. Must be executed within planned scope, with ROE + Class/owner approval.
Reading ARP caches from switches, routers, or local OS reveals which IP maps to which MAC — and which manufacturer (OUI) the device belongs to.
✓ Highly effective for finding "shadow devices" not in documentation — maintenance laptops left plugged in, crew-installed NAS units. In automotive, it finds attack paths. On ships, it validates the asset inventory.
Ⅳ. Wireless Interfaces: WiFi/BLE/GSM → SATCOM/AIS/GMDSS
Connected car hacking centered on wireless interfaces — WiFi, Bluetooth, cellular. Ships have a parallel structure, but with different types and roles.
Ship-shore data communication
Crew/passenger, maintenance, equipment management
Data comms during coastal navigation
Navigation and safety comms — strict regulatory constraints apply
What automotive security skills apply here:
⚠️ Attack scenarios like Evil Twin are legally and operationally sensitive on real vessels. Automotive attack concepts should be converted into defensive design requirements and inspection checklists for shipboard use.
Ⅴ. SDR & GNU Radio — What They Can Do on Ships (Lab Context Only)
SDR tools (HackRF, BladeRF) and GNU Radio are tools for receiving and understanding wireless signal structure. On ships, their realistic use is in lab environments only.
- Understand AIS signal structure in a simulator/testbed
- Learn GMDSS concepts and satellite/VHF communication flow
- Goal: understand protocol structure to inform encryption/auth design decisions
- Via lawful TAP/mirror port: observe which servers the vessel communicates with
- Monitor normal traffic volume and pattern baselines
- Meaningful for security monitoring, not signal manipulation
Creating a fake BTS to trick a vehicle TCU — like in the automotive book — is legally and operationally near-impossible on real vessels. Instead, the SDR/GNU Radio stack is best applied on ships for defensive research: protocol understanding, anomaly detection modeling, and intrusion detection algorithm development.
Key Takeaways
HU→TCU→ECU = HMI/Bridge→SATCOM/Gateway→Engine/Steering. The terminology differs, but the attack path logic is identical.
Attack hosts and jump kits become official diagnostic equipment on ships — same tools, defensive intent, strictly bounded by ROE.
On ships, ARP analysis is used to find undocumented shadow devices — not to map attack paths. Same technique, entirely different application.
Offensive techniques (Evil Twin, fake BTS, etc.) are legally/operationally restricted on real vessels — convert attack knowledge into defensive design checklists.
Maritime professional focused on the intersection of vessel operations, classification society regulations, and OT/IT cybersecurity. Writing for engineers, consultants, and operators navigating Maritime 4.0 together.
🌐 More Articles ↗
Comments
Post a Comment