{"id":372,"date":"2024-07-10T07:45:11","date_gmt":"2024-07-10T05:45:11","guid":{"rendered":"https:\/\/cyber-cerber.com\/blog\/?p=372"},"modified":"2024-11-27T18:53:05","modified_gmt":"2024-11-27T16:53:05","slug":"ais-spoofing-in-the-black-sea-a-quick-osint-demo","status":"publish","type":"post","link":"https:\/\/cyber-cerber.com\/blog\/2024\/07\/10\/ais-spoofing-in-the-black-sea-a-quick-osint-demo\/","title":{"rendered":"AIS spoofing in the Black Sea: a quick OSINT demo"},"content":{"rendered":"\n

<\/p>\n\n\n\n

As we all are already aware, the Russian invasion of Ukraine started (officially) on February 24th, 2022, and it came along the so-called, classic war, with many other new, developed, and extensive types of warfare: cyber, radio, psychological, financial, etc.<\/p>\n\n\n\n

This time, I will show you a quick and very simple OSINT<\/strong><\/a> demo, of the AIS spoofing<\/strong><\/a> and GPS jamming in West side of the Black Sea region.<\/p>\n\n\n\n

AIS<\/strong><\/a> stands for Automatic Identification System and is digitally broadcasted information data, over VHF<\/strong><\/a>, consisting of ship name, course and speed, classification, call sign, registration number, MMSI<\/strong><\/a>, and other information. The Bridge Officers onboard the vessels are then using such information, as an additional tool, for enhancing the ship’s safety navigation and operations.<\/p>\n\n\n\n

Since navigation (maritime, aero, auto, etc) is mainly based on the GPS constellation<\/strong><\/a>, the obvious target and scope was to interfere with its functionality in certain areas of interest. GPSJam<\/strong><\/a> is a live source of such activities.<\/p>\n\n\n\n

Other alternative navigation satellite constellations: Galileo<\/strong><\/a> (owned by the European Space Agency), BeiDou<\/strong><\/a> (owned by the Chinese state), etc.<\/p>\n\n\n

\n
\"GPS<\/figure><\/div>\n\n\n

Now, returning to our AIS topic, today, 10.07.2024, at 03:20 UTC<\/a><\/strong>, I did a quick research on some publicly available sources, and here is what I’ve got:<\/p>\n\n\n\n

On Marinetraffic<\/strong><\/a>, on an overall view over the western side of the Black Sea, you may notice some unusual reported positions inside of the Crimea Peninsula, just NE of Sevastopol.<\/p>\n\n\n

\n
\"Marinetraffic<\/figure><\/div>\n\n\n

Zooming in a bit, you’ll observe that there is no “water” in the area, sea, lake or river).<\/p>\n\n\n

\n
\"Marinetraffic\"<\/figure><\/div>\n\n\n

Going to Google Maps<\/strong><\/a>, and finding the same location, you might wonder (or not), what few ships will do in the area of an airport… Simferopol Airport<\/strong><\/a> (between Rodykove and Ukromnoye area).<\/p>\n\n\n

\n
\"Google<\/figure><\/div>\n\n\n

Then, I picked up randomly, an AIS of the bulk carrier, named “Magic L”.<\/p>\n\n\n

\n
\"Marine<\/figure><\/div>\n\n\n

To verify the data is accurate, I cheked the same AIS on Vesselfinder<\/strong><\/a>, and surprise, here the position on the map was correct.<\/p>\n\n\n

\n
\"Vesselfinder<\/figure><\/div>\n\n\n

As the minimum rule of 3rd, I check on another AIS marine traffic source, Shiplocation<\/strong><\/a>, and the confusion increased as pinpointing the ship’s name and AIS is resulted in double locations…<\/p>\n\n\n

\n
\"Shiplocation<\/figure><\/div>\n\n\n

The air traffic<\/strong><\/a> is affected too due to the shorter response time needed for taking the proper actions, the maritime AIS traffic spoofing is meant to create confusion, traffic jams, chaos or even accidents.<\/p>\n\n\n\n

An extensive OSINT & Radio survey will follow, so stay tuned and safe!<\/p>\n\n\n\n

Later update: on October 24th, the national TV post, ProTV, confirmed my above statements: Sistemele de naviga\u021bie GPS dup\u0103 care se ghideaz\u0103 avioanele \u00een zbor au fost lovite intens de bruiaj. De unde vin interferen\u021be.<\/a><\/p>\n\n\n\n

<\/p>\n\n\n

\n
\"SC<\/a><\/figure><\/div>\n\n\n

InfoSec & ICT Maritime & SMB\/SOHO:<\/p>\n\n\n\n

OmnisMares.com<\/a> <\/strong> Cyber-Cerber.com<\/strong><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

As we all are already aware, the Russian invasion of Ukraine started (officially) on February 24th, 2022, and it came along the so-called, classic war, with many other new, developed, and extensive types of warfare: cyber, radio, psychological, financial, etc. This time, I will show you a quick and very simple OSINT demo, of the […]<\/p>\n","protected":false},"author":1,"featured_media":374,"comment_status":"closed","ping_status":"open","sticky":false,"template":"templates\/template-full-width.php","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[89,88,90,29,82,91,92,93],"class_list":["post-372","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber","tag-ais-maritime-traffic","tag-ais-spoofing","tag-black-sea-warfare","tag-cybersecurity","tag-cyrcomms","tag-gps-jamming","tag-ict-maritime","tag-infosec-maritime"],"_links":{"self":[{"href":"https:\/\/cyber-cerber.com\/blog\/wp-json\/wp\/v2\/posts\/372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber-cerber.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber-cerber.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber-cerber.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber-cerber.com\/blog\/wp-json\/wp\/v2\/comments?post=372"}],"version-history":[{"count":19,"href":"https:\/\/cyber-cerber.com\/blog\/wp-json\/wp\/v2\/posts\/372\/revisions"}],"predecessor-version":[{"id":401,"href":"https:\/\/cyber-cerber.com\/blog\/wp-json\/wp\/v2\/posts\/372\/revisions\/401"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber-cerber.com\/blog\/wp-json\/wp\/v2\/media\/374"}],"wp:attachment":[{"href":"https:\/\/cyber-cerber.com\/blog\/wp-json\/wp\/v2\/media?parent=372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber-cerber.com\/blog\/wp-json\/wp\/v2\/categories?post=372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber-cerber.com\/blog\/wp-json\/wp\/v2\/tags?post=372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}