Exposing Vulnerabilities in NMEA Gateways: Insights from Shodan and Honeypot Experiments

Abstract

Abstract—As connectivity increases through the Internet of Things (IoT) and Industry 4.0. Previously isolated systems gained remote access capabilities and became more exposed to cyberattacks. For example, in the maritime domain, the Global Maritime Transportation System (GMTS) is considered a high-potential target. Attacking a GMTS system with malware has been shown to influence ships or disrupt onboard operations. Another significant component of the ship network is an NMEA gateway. Prior research has shown evidence of NMEA gateways being exposed to the Internet, and our previous work experimentally demonstrated four practical attack vectors against such gateways: GPS spoofing, AIS injection, autopilot manipulation, and resource exhaustion. However, it remains unclear whether they have been targeted by adversaries or how an attacker could exploit them.

In this work, an NMEA gateway honeypot is designed, implemented, and deployed. The design of the honeypot is inspired by using Shodan, which is used to identify real and exposed NMEA gateways. Our Shodan results show that Internet-exposed NMEA gateways are widely spread. For instance, the refined $GPRMC-based Shodan query identified 4,305 unique endpoints that transmitted NMEA messages during the observation period, of which 1,542 were analyzed in detail to identify their vulnerabilities and other parameters, such as the attack window.  As per the honeypot, although no attacks against the specific NMEA gateway were captured, the honeypot logs captured other types of attacks, such as automated scanning and reconnaissance efforts. These findings indicate that NMEA gateways could become real targets in the near future if not configured or secured properly.