Manipulating the Automatic Identification System with Extremely Low-Cost Hardware

Open standards of machine-to-machine communications offer the promise of increased safety and efficiency, allowing common messages to relay data between vehicles with no prior coordination. The International Maritime Organization's mandated Automatic Identification System is one specific example that greatly enhances safety of navigation, helping overcome limitations of radar and visual observation for ships at sea. However, any computer system has potential cyber vulnerabilities. Systems designed to accept and process radio frequency packets broadcast from unknown sources are vulnerable to manipulation. Previous work has investigated these vulnerabilities in the Automatic Identification System. This paper extends these studies, highlighting the extremely low barrier to entry for injecting data into safety systems relied on at sea. Leveraging openly available standards and software with a Raspberry Pi, we demonstrate a full proof of concept, successfully injecting track data into various Automatic Identification System receivers ranging up to equipment commercially deployed on large vessels.