From Shanghai to the Shore: Threats in Global Shipping

From Shanghai to the Shore: Threats in Global Shipping

Speakers: Kenneth Miltenberger, Nicholas Fredericksen

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=ohre4ObUzoo

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Kenneth%20Miltenberger%20Nicholas%20Fredericksen%20-%20From%20Shanghai%20to%20the%20Shore%20The%20Silent%20Threat%20in%20Global%20Shipping.pdf

Overview

Lieutenant Commanders Kenneth Miltenberger and Nicholas Fredericksen of the United States Coast Guard present a maritime cybersecurity briefing focused on a specific, underappreciated threat: Chinese-manufactured Ship-to-Shore (STS) cranes deployed at US ports. The talk covers the Coast Guard's role in maritime cybersecurity, the strategic and supply chain risks posed by ZPMC (Zhenhua Port Machinery Company) cranes—which dominate the global port crane market—and the Coast Guard's hands-on vulnerability assessment work conducted on these systems.

The presentation is notable not only for its technical findings but for the institutional perspective: this is the US Coast Guard openly discussing an ongoing national security concern at a hacker conference, specifically to build awareness among the security research community and to demonstrate that the Coast Guard takes cyber threats to critical maritime infrastructure seriously.

Background

▶ Watch: Maybe you've seen some of these headlines. (9:57)

The Coast Guard's Cyber Mission

The Coast Guard is one of the United States' six armed services and operates under the Department of Homeland Security in peacetime. Its maritime cybersecurity mission covers three areas: defending its own networks, defending the Marine Transportation System (MTS), and operating as the lead federal agency for maritime port security. The speakers lead dedicated Cyber Protection Teams (CPTs): Miltenberger commands the 2003 CPT in Alameda, California; Fredericksen commands the 1790 CPT and co-founded the Coast Guard's Cyber Maritime Readiness Branch.

Global Shipping and Port Infrastructure

The Marine Transportation System handles approximately $5.4 trillion in annual economic activity in the United States. Major container ports (Los Angeles/Long Beach, New York/New Jersey, Savannah, Houston) are critical chokepoints for consumer goods, industrial materials, and military logistics. A disruption to a major port—whether from a cyberattack, a physical incident, or equipment failure—has immediate cascading effects on supply chains.

ZPMC Crane Market Dominance

ZPMC (a subsidiary of Chinese state-owned enterprise CCCC) manufactures approximately 70-80% of the world's Ship-to-Shore cranes, including the majority of cranes at US ports. These are enormous structures—taller than the Statue of Liberty—with sophisticated electronic control systems, PLCs (Programmable Logic Controllers), and increasingly, remote monitoring and maintenance capabilities. The cranes were built in China and shipped to US ports pre-assembled, raising both supply chain security concerns and questions about whether they contain unauthorized remote access capabilities.

The US government designated ZPMC cranes as a national security concern, and President Biden signed an executive order in February 2024 directing DHS to strengthen port cybersecurity specifically with ZPMC cranes in mind.

Key Findings

▶ Watch: This is typically an AB branded device but not always. (23:19)

ZPMC cranes have remote access capabilities by design. The cranes include cellular modems or network interfaces configured to allow ZPMC engineers to remotely monitor and service the equipment. This is a standard practice in industrial equipment maintenance—but in the context of Chinese state-owned equipment at US strategic ports, it represents an uncontrolled remote access pathway into critical infrastructure.

Cellular modems were found active and connected to Chinese networks. During vulnerability assessments, the Coast Guard Cyber Protection Teams found active cellular modems in crane control systems that had not been disclosed to port operators and that were communicating with infrastructure associated with ZPMC's parent company in China. Port operators were often unaware these modems existed.

PLCs and control systems have significant vulnerability exposure. The crane control systems run PLCs (from major industrial vendors including Siemens and others) that are configured with default credentials, exposed management interfaces, and in some cases outdated firmware with known vulnerabilities. The operational technology (OT) networks of the cranes are often poorly segmented from port IT networks.

Crane software has trojan/implant risk from supply chain. The talk discusses the possibility—not confirmed as an active exploit but assessed as a credible risk—that firmware or software installed in cranes during manufacturing could include backdoors or logic bombs designed to activate under specific conditions (e.g., during a geopolitical crisis). The supply chain provenance of software components in the cranes is largely unaudited.

Port operators lack visibility into their crane OT networks. A common finding across assessments was that port operators did not have asset inventories, network diagrams, or monitoring tools that covered the crane OT environment. Many operators treated the cranes as mechanical equipment rather than networked computing infrastructure.

Gaps in maritime cybersecurity regulation. The Maritime Transportation Security Act (MTSA) and related regulations require Facility Security Plans, but cybersecurity requirements have historically been voluntary or guidance-based. The Coast Guard has been working to update regulations and has issued specific guidance on port cybersecurity, but enforcement capability and port compliance vary widely.

Technical Deep Dive

▶ Watch: large scale cyber incidents. (30:01)

Crane Control System Architecture

A modern STS crane is a complex industrial control system. The high-level architecture includes:

• Operator cabin: Human-machine interface (HMI), joystick controls, displays.
• Main control panel (MCP): Central PLC that coordinates all crane movements, limits, and safety systems.
• Drive cabinets: Variable-frequency drives (VFDs) controlling the main hoist, trolley, gantry, and boom motors.
• Communication network: Industrial Ethernet (often Profinet or EtherNet/IP) connecting PLCs, drives, and HMIs.
• Remote monitoring system: A separate network-connected subsystem that transmits operational data to ZPMC for performance monitoring and predictive maintenance.

The remote monitoring system is the critical attack surface. It typically includes a cellular modem or wired internet connection, a data historian or gateway device, and credentials configured by ZPMC. Port operators sign maintenance agreements that grant ZPMC access to this system—but the boundary between "read-only performance data" and "write access to control systems" is not always clearly defined or technically enforced.

Vulnerability Assessment Methodology

The Coast Guard CPTs conduct assessments using a combination of:

• Physical inspection: Identifying network interfaces, modems, and communications hardware not shown on as-built documentation.
• Passive network monitoring: Deploying sensors on the crane OT network to capture all traffic and identify unexpected external connections.
• Active scanning (with operator permission): Scanning PLC and HMI interfaces for exposed services, default credentials, and vulnerable software versions.
• Credential review: Testing default and weak credentials on HMIs, PLCs, and network equipment.

The assessments follow the NIST Cybersecurity Framework and ICS-specific guidance from CISA and ISA/IEC 62443.

Active Cellular Modem Finding

One of the most operationally significant findings was the discovery of active cellular modems in crane control systems during port assessments. The modems were:

• Not listed in any documentation provided to the port operator.
• Configured with SIM cards associated with Chinese mobile networks or MVNO infrastructure linked to Chinese carriers.
• Actively transmitting data at regular intervals.

The existence of these modems was not illegal—ZPMC's maintenance contracts include provisions for remote monitoring—but port operators had not been informed that the capability was active and connected. The Coast Guard's finding prompted renewed scrutiny of what data was being transmitted and to whom.

PLC and HMI Exposure

The PLCs found in crane systems often retained factory default credentials (e.g., admin/admin or vendor-specific defaults documented in public manuals). Web-based HMI interfaces were exposed on the crane OT network, accessible to anyone with layer-3 connectivity. In several cases, the crane OT network had uncontrolled paths to the port's corporate IT network, meaning that compromise of a port employee's workstation could provide a pivot point to crane control systems.

Demo / Proof of Concept

▶ Watch: found them on the elevators and the spreaders. (34:35)

The talk does not include an offensive demonstration in the traditional sense—the speakers are active duty military conducting authorized government work. However, they shared:

• Network traffic captures showing unexpected outbound connections from crane systems to external IP addresses.
• Modem discovery photos showing cellular hardware not in port operator documentation.
• HMI screenshots showing exposed control interfaces accessible without authentication on the OT network.
• Assessment statistics across multiple ports, including rates of default credential usage and prevalence of unknown modems.

Defensive Implications

▶ Watch: escalation and then setting up persistence before you deliver effects. (37:13)

For port operators:

• Conduct an immediate inventory of all network-connected hardware in STS crane systems, comparing against as-built documentation. Any device not in documentation should be treated as potentially unauthorized.
• Engage ZPMC (or the crane OEM) to document all remote access capabilities and require that any remote access be controlled through operator-managed VPN gateways rather than independent cellular connections.
• Segment crane OT networks from corporate IT networks using unidirectional security gateways (data diodes) or properly configured firewalls with default-deny rules.
• Deploy OT network monitoring (e.g., Claroty, Dragos, or open-source alternatives) to establish baseline behavior and detect anomalies.
• Change all default credentials on PLCs, HMIs, and network equipment. Implement a credential management program for OT assets.

For the maritime industry:

• MTSA security plans should be extended to explicitly require OT network security controls as a condition of facility operation.
• The Coast Guard's proposed maritime cybersecurity regulations (NPRM published in 2024) should be supported and implemented.

For the US government:

• The executive order on port cybersecurity should be accompanied by funded programs to assist port operators—particularly smaller ports—in implementing required controls. The Coast Guard CPTs have limited capacity to assess every US port.
• Supply chain security reviews for future crane procurement should include code review of PLC and HMI software, not just physical inspection.

Key Takeaways

1. ZPMC cranes at US ports contain active remote access capabilities (cellular modems) that port operators were often unaware of—representing an uncontrolled pathway into critical infrastructure.
2. PLC and HMI systems in port cranes commonly have default credentials and poor network segmentation, making lateral movement from a compromised port IT network to crane control feasible.
3. The maritime OT security posture lags significantly behind enterprise IT security—asset inventories, network monitoring, and access control practices that are standard in IT environments are absent in many port crane environments.
4. The Coast Guard's active cyber protection mission demonstrates that critical infrastructure cybersecurity is a real, active military/government responsibility, not just a compliance checkbox.
5. The concentration of global crane supply in a single Chinese state-owned manufacturer creates a systemic supply chain risk that individual port operators cannot address—it requires government-level policy response.

About the Speaker(s)

▶ Watch: Uh there's a couple reasons for this. (40:26)

Lieutenant Commander Kenneth Miltenberger is the commanding officer of the USCG 2003 Cyber Protection Team based in Alameda, California. He founded the Coast Guard's Red Team and previously supported vulnerability development work for Naval Sea Systems Command (NAVSEA). Lieutenant Commander Nicholas Fredericksen commands the 1790 Cyber Protection Team and co-founded the Coast Guard Cyber Maritime Readiness Branch, which serves as the Coast Guard's primary liaison with maritime industry on cybersecurity matters. Both officers have extensive experience in maritime OT security assessments and represent the Coast Guard's efforts to bring modern offensive security expertise to critical infrastructure defense.