Dead Reckoning: Hijacking Marine Autopilots

Vulnerabilities in Marine Navigation Computers

Autopilot systems aboard commercial and recreational vessels translate navigation course data into physical rudder actuations over NMEA 2000 CAN networks, operating as critical cyber-physical bridges.

Unauthenticated Firmware Update Flaws

Carson Green and Rik Chatterjee demonstrate how a popular marine autopilot computer accepts unsigned firmware update files (.swup) via SD card slots or networked chart plotters without cryptographic validation or hardware authentication.

Persistent Code Execution and CAN Injection

Crafting a malicious update package allows attackers to gain persistent firmware-level execution on the autopilot hardware, enabling arbitrary CAN packet injection, course spoofing, and remote rudder disruption across the vessel's NMEA 2000 bus.

Remediation for Marine Control Systems

Mitigating marine firmware hijacking requires enforcing cryptographic signature verification in bootloaders, disabling unauthenticated network update mechanisms, and implementing CAN bus intrusion detection.