Project ongoing · Cybersecurity
Cyber
We look for the weak points in the on-board networks of ships and we build the defences.
- the speed of an NMEA 0183 line
- 4800 bit/s
- at most in one sentence
- 82 characters
- authentication in the protocol
- No
- the attack and defence test on the bridge simulator
- April 2026
For people who come from computer science, engineering, telecommunications
The bridge network
On a ship the gyrocompass, the GPS, the electronic chart and the autopilot talk to each other with the NMEA 0183 standard, which in the international norm is called IEC 61162-1. One device talks, all the others listen: text sentences, one line at a time, at 4800 bits per second.
On newer ships the same sentences travel over Ethernet, in UDP packets sent to the whole network. The protocol, however, has no authentication: whoever receives a sentence cannot know who wrote it. A study by the University of Genoa, from 2023, showed that a program on the bridge network can inject false compass or AIS sentences, and the devices accept them.
- 01
Gyrocompass
It sends the true heading, that is where the bow points relative to north: HDT sentence.
- 02
GPS
It sends position, time and signal quality: GGA sentence.
- 03
Chart
It puts together position, heading and the other ships seen by AIS.
- 04
Autopilot
It holds the course by moving the rudder, trusting the heading it receives.
What a sentence looks like
Every sentence starts with $, then two letters for who is talking and three for the type of sentence, then the fields separated by commas. At the end an asterisk and the checksum: two hexadecimal digits, the XOR of all the characters between $ and *. It is there to find transmission errors, not deceptions: whoever writes a false sentence also computes the right checksum.
$GPGGA,100008.83,4419.699,N,00858.415,E,1,01,0.9,18.000,M,0.000,M,,0000*64
$GP GGA GPS, position sentence
100008.83 UTC time, 10:00:08.83
4419.699,N latitude 44° 19.699′ north
00858.415,E longitude 8° 58.415′ east
1 quality: GPS fix
01 satellites used
0.9 horizontal precision, HDOP
18.000,M antenna height in metres
*64 checksumdef checksum(sentence):
body = sentence[1:sentence.index('*')]
x = 0
for character in body:
x ^= ord(character)
return f'{x:02X}'
checksum('$IIXDR,A,0.0,D,PTCH,A,0.1,D,ROLL,C,0.0,C,AirTemp*05') # '05'The attack
In the test a computer connected to the bridge network sends false heading sentences, as if it were the gyrocompass, and much more often than it does. Whoever listens keeps the last sentence that arrived, so the false one almost always wins. The autopilot corrects the course on a wrong heading, and the chart shows nothing strange.
This is not theory. In 2013 a group from the University of Texas, with the owner's permission, took a 65-metre yacht off course off the Italian coast, with false GPS signals: the chart showed a straight line. In 2017, in the Black Sea, the GPS of a ship placed it on land, near an airport; according to the captain, more than 20 ships in the area had the same problem. In 2019 the C4ADS report counted 9,883 suspected cases of GPS spoofing, which had affected 1,311 civilian ships.
| HDT | true heading | from the gyrocompass: the target of the attack |
|---|---|---|
| GGA | GPS position | time, latitude, longitude, height |
| ZDA | date and time | with the time zone |
| XDR | sensors | pitch, roll, air temperature |
| VDM | AIS | the other ships: position, speed, course |
The defence
The defence is a bridge program between two parts of the network. It forwards the true sentences and stops the ones that arrive from the wrong side: the heading and the GPS can only come from the right instruments. The traffic goes through in UDP packets, and the rules are changed while the system is running.
> set block heading block incoming heading sentences
> set block gps in block incoming GPS data
> set allow all let everything throughThe rules
Since 2021 the International Maritime Organization has required cyber risks to be part of the safety systems of shipping companies. Its guidelines, in the 2025 revision, organise the work in six functions.
For many new ships, contracted from 1 July 2024, the IACS E26 and E27 rules are mandatory: the first for the whole ship, from design to its entire service life; the second for each on-board system, on the suppliers.
- 01
Govern
Roles, responsibilities and rules of the company.
- 02
Identify
Which systems are on board and which risks they bring.
- 03
Protect
Unique credentials, changed passwords, separate networks.
- 04
Detect
Noticing quickly that something is wrong.
- 05
Respond
What to do during an attack.
- 06
Recover
Getting back to sailing and understanding the causes.
Where we are
- 2025We defined how an attack with false GPS signals would work and we found the first vulnerabilities.
- 17 April 2026We tried the attack and the defence on the bridge simulator of the University of Genoa.
- TodayWe are working on the defences.
Photos
Videos
People on the project
Who we do it with
Sources
- IEC 61162-1 and IEC 61162-450; gpsd, NMEA Revealed.
- Longo, Russo, Armando and Merlo, Attacking (and Defending) the Maritime Radar System, IEEE Transactions on Information Forensics and Security, 2023.
- Bhatti and Humphreys, Hostile Control of Ships via False GPS Signals, NAVIGATION, 2017.
- C4ADS, Above Us Only Stars, 2019.
- IMO, MSC-FAL.1/Circ.3, revision 3, 2025; resolution MSC.428(98).
- IACS, Unified Requirements E26 and E27.
- Presentation at the Deep-Tech Showcase, Palazzo della Borsa, 21 April 2026.
Do you want to work on it?
You do not need experience and you do not need a CV. Write to us: we invite you to the next meeting, where you meet the team.