In the field of maritime cyber, we often cite the movie Speed 2: Cruise Control from 1997 as an interesting prediction of the future. It illustrates the reality of today quite well, despite being nearly 30 years old!
Despite being a terrible movie, the hacking concepts shown in it are actually fairly plausible and just about stand up to scrutiny today.
The loose plot (spoilers ahead1)
A recently-fired ships autopilot software engineer modifies the software on a cruise ship, intending to crash it in to an oil tanker.
So, is this plausible?
By and large, yes. It’s an on-site hacking scenario, where the attacker has high privilege physical access to the vessel
Some of the execution is beyond far-fetched, but the broad principles do stack up
What can we learn, other than bad acting and script writing?
Hack 1: connecting to the ship’s control network
The John Geiger character, played by Willem Dafoe, pulls a fibre network cable out of his cabin ceiling void, with the objective of joining the network and taking control of the ship
The movie is set in the 1990s. Cabling for critical systems simply wasn’t routed through cabin ceilings. Even today, special conduits are used, behind locked panels.
The fibre connector does look about right for the period.
Then Geiger connects that fibre to this box:
In order to take remote control of the ships systems:
Now, I’m old enough to remember these boxes. They certainly aren’t fibre connectors – it’s a serial switch box with a ‘fibre connector’ sticker on it! Artistic licence++, yet there wasn’t any need to fake a fibre connection. An odd choice from the props department
PC visuals were all a bit limited in the 90s; some of these are a fair attempt at reproducing marine control and monitoring interfaces of the time, but some are a bit of a joke!
Here’s Geiger’s laptop UI:
What’s that protocol though?
Ships generally use serial communications, based on NMEA0183 sentences. RS485 and 232 are the most likely protocols in use, so why invent ‘QB488/s’? Who knows
For reference, here’s a genuine UI from about a decade after the movie was released. Not that different!
Conclusion: plausible in principle, but the access method to the core network is a bit fanciful
Hack 2: compromising engine controls
Geiger creates a distraction in the engine room, allowing him to connect a device to an ‘Engine Room Status’ device.
That device appears to be a PDA, but we can’t identify it. It doesn’t look like an old Apple Newton, Compaq iPaq or HP Palm Pilot, nor any other device we can find.
He connects it to a 15 pin d-sub connector and makes some changes, which we assume are related to the ability to shut down the engines remotely later on.
Conclusion: plausible, just,
Hack 3: stopping the engine and causing huge vibration
Stopping the engine. It doesn’t take 10 minutes to stop a ships engine. It takes a few seconds, mostly owing to the rotational momentum of large masses such as the prop shaft. Methinks that taking 10 minutes to stop the engine was simply to add a bit of jeopardy to the movie!
How many engines?? Various GUIs and dialogue suggest anything from 4 to 8 engines! The Seabourne Legend does have four engines, but shutting one down would not result in the huge vibration seen in the movie! Slamming one in to reverse would cause vibration, but that’s not what is shown. There are also explosions seen in the engine room, suggesting that the ‘top end’ covers were blown off. That’s not how an engine failure would be seen. A crankcase explosion is more likely, but that would affect the lower end of the engine. Even then, the crew would have little difficulty stopping the engine by using manual controls on the engine itself. Two large levers control air and fuel, pulling either would stop the engine. One simply wouldn’t ‘lose control’ of an engine in the manner seen.
Conclusion: implausible
Defending against Geiger
1: Adding ballast water to the ship
The ships crew decide to add ballast water to slow the ship down. Adding ‘a million litres of water’ is plausible for a ship of the size of the Seabourn Legend. That said, cruise ships typically carry ballast water for trim – ensuring they are trimmed fore or aft for efficiency. By mis-trimming the vessel with ballast water,, say to the forward ballast tanks, it would slow more than demonstrated.
However, the movie shows opening ballast water doors to accessible deck areas! Ballast tanks are sealed and are accessed only in dry dock for cleaning. Having people walking around areas that could be flooded by ballast water is completely unrealistic.
Conclusion: plausible as a method of slowing the ship, implausible as a method to flood decks.
2: Jamming the rudder
The character played by Jason Patric attempts to swim under the vessel and wrap a steel cable around the propellor. Now, I’ve had unintentional prop wraps on yachts I’ve sailed, so I know that wrapping things around the propellor causes issues with propulsion!
But it simply isn’t necessary in the real world: one would simply take manual control of the steering gear!
Before setting sail, every sizeable vessel will carry out a manual steering check. One would access the steering gear room and actuate the hydraulic rams that move the rudder directly. But that’s no fun!
Conclusion: plausible, if pointless
3: manually winding the bow thruster
The previous two defences were plausible, if pointless. The last one is utterly ridiculous:
As the crew have lost control of the helm (ability to steer the ship), as a last resort the Patric character is directed to the bow thruster controls. These, of course, are under water..
He manually winds the bow thruster, causing the ship to change direction and only strikes the oil tanker with a glancing blow.
Problem 1: a bow thruster on a vessel of this size needs upwards of 1MW of power. Winding a handle manually is going to generate a few Watts of power. So this doesn’t work
Problem 2: the autopilot has been compromised and is holding a fixed course. It would simply correct any deviation and plough straight in to the tanker
Conclusion: totally fanciful
Bringing it up to date
Does the movie represent cruise ship security today? Not really. Cruising has become significantly more complex with the advent of always-on internet connectivity and numerous connected systems to drive safety and efficiency.
If anything, it’s become somewhat harder to secure cruise ships: they combine propulsion, navigation, and power generation with a hotel, restaurant, casino, and theatre, plus safety and fire control systems. That complexity makes maintaining strict separation between OT and IT a real challenge.
However, most operators are making big leaps forward in securing their vessels. Regulations such as IACS UR E26 &27, together with US Coastguard 33 CFR Part 6 are helping drive behaviours too.
