Analysis of Security Vulnerabilities in S-100-Based Maritime Navigation Software

Area of Science:

• Maritime technology
• Software security
• Electronic Chart Display and Information Systems (ECDIS)

Background:

• The S-100 standard for ECDIS relies on Lua scripts for chart rendering.
• Current S-100 specifications lack defined security measures for script execution.
• This gap poses significant cybersecurity risks to maritime navigation systems.

Purpose of the Study:

• To evaluate the effectiveness of automated Static Application Security Testing (SAST) tools against expert manual review for S-100 software security.
• To identify and assess vulnerabilities in S-100-compliant software, specifically the OpenS100 reference implementation.
• To inform the International Hydrographic Organization (IHO) about necessary security enhancements to the S-100 standard.

Main Methods:

• Applied four SAST tools to the OpenS100 implementation.
• Conducted an expert manual security review of the same software.
• Developed a Proof of Concept (PoC) to verify identified vulnerabilities, including Remote Code Execution (RCE).

Main Results:

• Automated SAST tools detected numerous defects but missed 83% of expert-identified vulnerabilities.
• A critical flaw enabling RCE (CVSS 9.3) was discovered via malicious portrayal catalogues.
• SAST tools struggled with maritime domain specifics and C++-Lua interface risks.

Conclusions:

• Identified vulnerabilities are linked to S-100 standard specification gaps, not just coding errors.
• Functional safety certifications need enhancement to cover design-level security risks.
• The IHO must integrate security controls like script sandboxing into S-100 before its 2029 adoption deadline.