Security Analysis of Ship Management Applications for Android
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
The modern maritime industry is characterized by networked smart ships that incorporate 9 information and communications technology (ICT) for steering, navigation, control, sensor, and 10 operational systems. Smart ships are potential targets for cyber attacks for their network 11 connectivity and ICT application. In this study, we systematically deduced and analyzed the 12 security vulnerabilities of 30 Android-based applications used in the ocean and ships. We extracted 13 the Android application package file and used mobile security framework static analysis to analyze 14 the application’s permission information, privacy, certificates, manifest package files, code 15 vulnerabilities in the file, and password disclosures. The analysis revealed that security 16 vulnerabilities in Android-based applications applied in shipboard equipment could allow remote 17 hackers to gain control of ship engines and communication systems. Additionally, it evaluates the 18 security level of Android applications following the International Maritime Organization and 19 International Association of Classification Societies UR E27 regulations for ship cybersecurity and 20 emphasizes the need for cyber threat mitigation measures for Android ship applications, which 21 have not been studied so far. This study aims to identify potential cybersecurity threats when using the Android operating system on merchant ships, warships, unmanned vessels, and autonomous ships. The findings will inform efforts to implement enhanced cybersecurity systems for ships.
Abstract
The modern maritime industry is characterized by networked smart ships that incorporate 9 information and communications technology (ICT) for steering, navigation, control, sensor, and 10 operational systems. Smart ships are potential targets for cyber attacks for their network 11 connectivity and ICT application. In this study, we systematically deduced and analyzed the 12 security vulnerabilities of 30 Android-based applications used in the ocean and ships. We extracted 13 the Android application package file and used mobile security framework static analysis to analyze 14 the application’s permission information, privacy, certificates, manifest package files, code 15 vulnerabilities in the file, and password disclosures. The analysis revealed that security 16 vulnerabilities in Android-based applications applied in shipboard equipment could allow remote 17 hackers to gain control of ship engines and communication systems. Additionally, it evaluates the 18 security level of Android applications following the International Maritime Organization and 19 International Association of Classification Societies UR E27 regulations for ship cybersecurity and 20 emphasizes the need for cyber threat mitigation measures for Android ship applications, which 21 have not been studied so far. This study aims to identify potential cybersecurity threats when using the Android operating system on merchant ships, warships, unmanned vessels, and autonomous ships. The findings will inform efforts to implement enhanced cybersecurity systems for ships.
참고문헌 (27)
- "Waterborne ICT Maritime Opportunities 2030", Maritime Connected and Automated Transport, ~ (2016)
- "GetNews Marine Management Software Market Growing at a CAGR 11.2% | Key Player Oracle", ABB, DockMaster, Marina Master, Marinacloud. Digital Journal 2022, ~ (2022)
- Gunarti, M.R., "Development of Fuel Calculation Applications Android Based for Ship Operations", Proceedings of the Journal of Physics: Conference Series, 2117 (2021), IOP Publishing Ltd[DOI]
- Subiyanto, L., "Mobile Application for Unmanned Ship Monitorin g Based on LoRA Communication", Proceedings of the International Conference on Electrical Engineering, Computer Science and Informatics (EECSI), 2021, pp.288~293 (2021), Institute of Electrical and Electronic s Engineers Inc
- Zhu, X, "4G-Based Remote Manual Control for Unmanned Surface Vehicles", Proceedings of the ACM International Conference Proceeding Series (2019), Association for Computing Machinery
- Ikhsan, M., "Design and Implement of the Control System Based on Android Accelerometer Smartphone for Unmanned Surface Vehicle", Proceedings of the Seminar Nasional Industri dan Teknologi, pp.487~492 (2018)
- Sousa, D, "A Platform of Unmanned Surface Vehicle Swarms for Real Time Monitoring in Aquaculture Environments", Sensors (Switzerland), 19 (2019)[DOI]
- "International Association of Classification Societies UR E26 Cyber Resilience of Ships", ~ (2022)
- Chatzoglou, E., "A Multi-Tier Security Analysis of Official Car Management Apps for Android", Future Internet, 13, pp.1~35 (2021)[DOI]
- Falade, P.V., "Vulnerability Analysis of Digital Banks’ Mobile Applications", arXiv preprint arXiv:2302.07586, ~ (2023)
- Darvish, H, "Security Analysis of Mobile Money Applications on Android", Proceedings of the 2018 IEEE International Conference on Big Data (Big Data), pp.3072~3078 (2018), IEEE
- Morera, E.P., "Security Recommendations for MHealth Apps: Elaboration of a Developer’s Guide", J Med Syst, 40, pp.1~13 (2016)
- Priambodo, D.F, "Mobile Health Application Security Assesment Based on OWASP Top 10 Mobile Vulnerab ilities", Proceedings of the 2022 International Conference on Information Technology Systems and Innovation (ICITSI), pp.25~29 (2022), IEEE
- "Mobile-Security-Framework-MobSF Available online"[URL]
- Tuncay, G.S, "Resolving the Predicament of Android Custom Permissions", ~ (2018)
- Benitez-Mejia, D.G.N, "Android Applications and Security Breach", Proceedings of the 2016 Third International Conference on Digital Information Processing, Data Mining, and Wireless Communications (DIPDMWC), pp.164~169 (2016), IEEE
- Li, R, "Android Custom Permissions Demystified: From Privilege Escalation to Design Shortcomings", Proceedings of the 2021 IEEE Symposium on Security and Privacy (SP), pp.70~86 (2021), IEEE
- Dini, G, "Risk Analysis of Android Applications: A User-Centric Solution", Future Generation Computer Systems, 80, pp.505~518 (2018)
- "CVE-2017-13156"[URL]
- "CWE-919: Weaknesses in Mobile Applications (4.12)"[URL]
- "App Manifest Overview"[URL]
- Shezan, F.H, "Vulnerability Detection in Recent Android Apps:An Empirical Study", Proceedings of the 2017 International Conference on Networking, Systems and Security (NSysS), pp.55~63 (2017), IEEE
- Ozbay, A, "Should Users Trust Their Android Devices? A Scoring System for Assessing Security and Privacy Risks of Pre-Installed Applications", arXiv preprint arXiv:2203.10583, ~ (2022)
- "Mobile Top 10 2023"[URL]
- Palma, F, "Automated Security Testing of Android Applications for Secure Mobile Development", Proceedings of the 2020 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW), pp.222~231 (2020), IEEE
- Allodi, L, "Comparing Vulnerability Severity and Exploits Using Case-Control Studies", ACM Transactions on Information and System Security (TISSEC), 17, pp.1~20 (2014)
- Li, H, "Study on the Distribution of CVSS Environmental Score", Proceedings of the 2015 IEEE 5th International Conference on Electronics Information and Emergency Communication, pp.122~125 (2015), IEEE