An SD Card Took the Helm: What DEF CON 34’s Maritime Hacking Village Means for Every Vessel Operator
Researchers hijacked a marine autopilot with a tampered firmware update — no network intrusion required. The industry’s quietest attack surface just got a live demonstration.
August 28, 2026 | By The CyberSurv Team | CyberSurv
Earlier this month in Las Vegas, hackers took the helm — literally. At DEF CON 34’s Maritime Hacking Village (August 6–9), security researchers spent four days exploiting and defending real maritime systems: unmanned surface vessels under live radio attack, a working crane control system donated by one of the world’s largest ports, GPS and AIS spoofing stations, and a capture-the-flag exercise simulating a digital blockade. The demonstration that should command every operator’s attention, though, involved nothing more exotic than an SD card.
We write often about threats that arrive over the network — ransomware targeting the edge devices that keep fleets connected, state actors probing port systems. The village showcased something different: an attacker targeting the electronics at the heart of the vessel itself. The answer, demonstrated on real hardware: they can steer the ship.
An Unsigned Update Took the Rudder
Research presented in the village by Colorado State University’s Carson Green and Rik Chatterjee, first published through the USENIX VehicleSec research program, walked through a complete compromise of a commercial marine autopilot computer. The team reverse-engineered the autopilot’s firmware update binary and found what security engineers dread: no digital signature and no cryptographic integrity checks. The update mechanism would accept — and install — any file formatted to look like legitimate firmware.
The delivery path is disarmingly ordinary. Marine chart plotters accept software updates from SD cards. An attacker who can touch a chart plotter for a moment — or intercept an update anywhere between the vendor and the vessel — can load a tampered image. On the next reboot, the autopilot executes attacker-controlled code with full access to the NMEA 2000 backbone, the CAN-based network that connects navigation, propulsion displays, steering, and sensor systems on hundreds of thousands of vessels. From there, the researchers demonstrated persistent injection of arbitrary messages, including rudder control commands and address claims that let the compromised device impersonate other equipment on the network.
Read that again: a hijacked autopilot issuing rudder commands, indistinguishable to the network from legitimate steering input, surviving reboots, requiring no ongoing access.
This Is Not Just a Pleasure-Craft Problem
It is tempting to file NMEA 2000 research under “recreational boating” and move on. That would be a mistake, for three reasons.
First, NMEA 2000 and its unauthenticated cousins are everywhere in the working fleet — workboats, fishing vessels, pilot boats, patrol craft, and a long tail of smaller commercial tonnage. Second, the architectural flaw on display — a trusted internal bus with no message authentication, fed by devices with unsigned firmware — is the same pattern found in integrated bridge systems and OT networks on much larger ships. The protocols differ; the assumption that anything on the bus is trusted does not. Third, the chart plotter that accepts SD-card updates increasingly also carries Wi-Fi, satellite connectivity, and vendor cloud services — each a potential path for delivering that tampered update without ever stepping aboard.
The village’s other demonstrations reinforced the point. GPS and AIS spoofing scenarios showed how easily unencrypted positioning and identification systems can be manipulated — a threat we examined when GNSS interference became maritime’s everyday cyber threat — and a policy panel featuring retired flag officers took on subsea cables as strategic chokepoints, a risk that stopped being theoretical when two cables went down off Perth earlier this month. Industry veterans have argued the village exists precisely because maritime systems are among the most digitally vulnerable in any sector. After 828 recorded maritime cyber incidents in 2025 — a 103 percent increase over the prior year — the argument makes itself.
The Regulatory Clock Is Already Running
For U.S. operators, this research lands in the middle of a compliance countdown. The Coast Guard’s final rule on Cybersecurity in the Marine Transportation System took effect in July 2025. The cybersecurity training deadline passed in January of this year. The next milestone is the big one: by July 16, 2027, covered vessels and facilities must have a Coast Guard-approved Cybersecurity Plan, a designated Cybersecurity Officer, and a completed cybersecurity assessment behind it.
Here is the uncomfortable question the village poses for that paperwork: will your Cybersecurity Plan account for the systems that actually steer the vessel? A plan built only around IT misses the attack surface researchers just demonstrated on stage. Operators who close that gap now will write plans that survive scrutiny; those who don’t will revise them under deadline pressure.
What Operators Should Do Now
We recommend five concrete moves, none of which require waiting for vendors to fix firmware signing:
Inventory the bus. Know every device attached to your vessels’ NMEA 2000, CAN, and serial networks — including the chart plotters, gateways, and displays crews have added over the years. You cannot defend equipment you have not catalogued. A structured Maritime Cybersecurity Assessment builds exactly this picture, mapped against the Coast Guard’s requirements.
Control physical media. Treat SD cards and USB drives on the bridge the way refineries treat them in the control room: sourced, scanned, and logged. Firmware updates should come from verified vendor channels and be installed deliberately — never from media of uncertain origin.
Put firmware signing in your procurement language. Vendors respond to purchase orders faster than to conference talks. Ask whether updates are cryptographically signed and authenticated before the next refit, and make it a selection criterion.
Test the way attackers do. The village proved these attacks are practical for researchers with modest resources; assume adversaries are at least as capable. Targeted penetration testing of vessel and shoreside systems finds the unsigned update path before someone else does.
Monitor continuously. Village researchers also presented machine-learning intrusion detection for NMEA 2000 networks — a sign of where defense is heading. You do not need to wait for that to mature: RiskGuard 365℠ delivers continuous monitoring and managed detection across your environment today, so anomalous behavior gets flagged by your team instead of announced by your rudder.
Final Thoughts
Every August, Las Vegas gives the security community a preview of the threats operators will face over the next several years. This year’s preview was unambiguous: the maritime attack surface now runs from the satellite antenna down to the autopilot computer, and the tools to exploit it fit in a shirt pocket. The gap between demonstrated at DEF CON and used in the wild closes quickly — and the operators who fare best will be those who treated a conference demonstration as the free warning it was.
The good news: the defenses are neither exotic nor unaffordable. Inventory, media discipline, procurement pressure, testing, and monitoring are within reach of every fleet — and they happen to be the same fundamentals the Coast Guard will expect to see in writing by next July. Building that capability takes leadership as much as technology, which is why we help operators develop both through our Security Leadership Program.
Let’s Explore What’s Possible
Whether you need a vessel-level cybersecurity assessment, penetration testing that reaches the systems that actually move your ship, or a clear path to your 2027 Cybersecurity Plan, our team is ready to help you take the helm before someone else does.
