A Tale of Sea and Sky On the Security of Maritime VSAT Communications

TLDR

VSATs have revolutionized maritime operations, yet their security remains poorly understood, with high equipment costs historically limiting research and attacks, and the platform used in this study represents over 60 % of the global market, highlighting the need for tailored encryption solutions. The study aims to demonstrate that maritime VSAT networks can be practically attacked using less than $400 of readily available television equipment, thereby redefining the threat model. The authors employ GSExtract, a forensic tool that extracts IP traffic from heavily corrupted VSAT data streams, and analyze over 1.3 TB of real‑world recordings spanning 26 million km². The analysis reveals that sensitive data from major maritime companies is routinely leaked, with case studies showing interception of navigational charts, theft of personal documents, and the capacity to arbitrarily intercept and modify TCP sessions, enabling man‑in‑the‑middle and denial‑of‑service attacks.

Abstract

Very Small Aperture Terminals (VSAT) have revolutionized maritime operations. However, the security dimensions of maritime VSAT services are not well understood. Historically, high equipment costs have acted as a barrier to entry for both researchers and attackers. In this paper we demonstrate a substantial change in threat model, proving practical attacks against maritime VSAT networks with less than $400 of widely-available television equipment. This is achieved through GSExtract, a purpose-built forensic tool which enables the extraction of IP traffic from highly corrupted VSAT data streams.The implications of this threat are assessed experimentally through the analysis of more than 1.3 TB of real-world maritime VSAT recordings encompassing 26 million square kilometers of coverage area. The underlying network platform employed in these systems is representative of more than 60% of the global maritime VSAT services market. We find that sensitive data belonging to some of the world's largest maritime companies is regularly leaked over VSAT ship-to-shore communications. This threat is contextualized through illustrative case studies ranging from the interception and alteration of navigational charts to theft of passport and credit card details. Beyond this, we demonstrate the ability to arbitrarily intercept and modify TCP sessions under certain network configurations, enabling man-in-the-middle and denial of service attacks against ships at sea. The paper concludes with a brief discussion of the unique requirements and challenges for encryption in VSAT environments.