Hacking UK Trident

HACKING
UK TRIDENT:
A Growing Threat
JUNE 2017
BASIC
Stanislav Abaimov and Paul Ingram
British American Security Disclaimer
Information Council (BASIC)
3 Whitehall Court
Only publicly available information has been used in
Westminster
the research behind this publication. No classified
London SQ1A 2EL
information has been disclosed. We have been
careful not to include a level of detail that could be of
Charity Registration No. 1001081
use to any group that might be motivated and
capable of compromising the security of the
T: +44 (0) 20 77663465
operational systems concerned. Any cyber-attacks
www.basicint.org
that have any hope of success could only be
mounted by a highly-sophisticated group probably
© British American Security Information with the backing of a major state. This report will
Council (BASIC), June 2017 have no impact upon the awareness or capabilities of
any such group.
The opinions expressed in this publication
are the responsibility of the authors and do
not necessarily reflect the views of BASIC. We have included in this report a number of
scenarios to illustrate the type of threat this report is
All rights reserved. No part of this publication discussing. The stories, characters and incidents
may be reproduced or transmitted in any form portrayed in those illustrations are fictitious.
or by any means, electronic or mechanical No identification with actual persons (living or
including photocopying, recording or any deceased), specific subcontractors, hacking groups
information storage or retrieval system, or foreign entities is intended or should be inferred.
without the prior written permission of the
copyright holder.
Please direct all enquiries to the publishers.

The Authors British American Security
Stanislav Abaimov is a PhD
researcher in Cyber Security and BASIC is a think tank based in Whitehall in London,
Electronic Engineering in the taking a non-partisan, inclusive and dialogue-based
University of Rome, Tor Vergata. approach to encourage stable global nuclear
He has earned a degree of MSc disarmament, arms control and non-proliferation.
in Information Security, Royal The organization works to facilitate constructive
Holloway, University of London, engagement between siloed communities on
an Academic Center of Excellence in Cyber Security, traditionally sensitive or complex issues of nuclear
certified by EPSRC and GCHQ. He is also a policy, to create space for new and diverse
graduate of the Moscow State Institute of Electronics perspectives to grow from those interactions. Over
and Mathematics, faculty of “Automated Systems the 30 years since the organization was founded, in
and Informatics in Control Systems”. During his 1987, BASIC has developed institutional expertise
Master Studies Stanislav conducted his research in across a number of transatlantic issue areas,
the field of Advanced Persistent Threat, security including the UK-US nuclear relationship, the UK’s
testing, digital forensics, and cyber warfare and Trident programme, the politics of disarmament and
defence. His Ph.D. research focuses on CBRNe arms control in the UK Parliament, NATO nuclear
cyber security and Industrial Control Systems in weapons in Europe, the Middle East, the evolving
Critical Infrastructure. Stanislav is supporting role of responsibility in nuclear governance,
research in SCADA systems in CBRNe and Critical and expanding technological threats to SSBN
Infrastructure, ICS malware and his interests vary platforms.
from cyber security in ICSs and Autonomous
Weapons Systems to Wireless Communications,
Threat Modelling, Network Analysis, and
Cyber Defence.
Paul Ingram is BASIC’s

Executive Director. Paul has
authored numerous BASIC
reports and briefings covering a
variety of nuclear and
non‑nuclear issues since 2002,
including cyber security and
emerging vulnerabilities of SSBNs. He has extensive
media experience and formerly hosted a weekly
peak-time talk show on IRINN (Iranian domestic TV
News in Farsi) from 2007-2012, addressing issues
relevant to global security. Paul also taught systems
approaches on the flagship Top Management
Programme at the UK Government’s National School
of Government from 2006-2012.
Executive Summary
This paper reviews the growing potential for cyber-attack

on the UK’s operational fleet of Vanguard-class submarines
armed with nuclear-tipped Trident II D-5 ballistic missiles,
and some of the implications for strategic stability.
A successful attack could neutralise operations, penetrate and why). This has a transformative impact
lead to loss of life, defeat or perhaps even the upon all forms of warfare. But there is a particular
catastrophic exchange of nuclear warheads (directly danger associated with nuclear weapons by virtue of
or indirectly). But the very possibility of cyber-attack their destructiveness that demands policy makers
and the growing capability to launch them against and those responsible for managing the systems to
SSBNs, could have a severe impact upon the consider more seriously the dangers involved when
confidence of maintaining an assured second-strike deploying nuclear weapon systems in an
capability and therefore on strategic stability ever‑changing technical and strategic environment.
between states. Recent suggestions that the fleet is
vulnerable have sometimes been met with Malware injection during manufacturing, mid-life
complacency and claims that the isolated ‘air-gapped’ refurbishment or software updates and data
systems cannot be penetrated. Whilst we recognise transmission interception allow potential adversaries
that it is important not to be alarmist, these claims to conduct long-term cyber operations. BASIC has
are false. already highlighted the future potential for emerging
technologies to deliver high confidence in global
In a time of global interconnectivity and enhanced detection of submarines.1 Future weaponized
accessibility to cyber tools, cyber warfare has underwater drones may facilitate close proximity
already become a vital component of conventional kinetic and cyber-attacks on ballistic missile
warfare, a new military domain in its own right. submarines (SSBNs). Advanced nano and bionic
We are not talking about a lone wolf teenager in a technologies such as implantable and subdermal
basement hacking into the controls of a missile and data storage and communication devices may be
warhead and starting a nuclear war. Rather, we smuggled into the vessel and activated
consider the most significant threat by some margin autonomously, manually or remotely.
originates from the expanding investments by
leading states in their offensive cyber capabilities, This report considers the major electronic network
alongside their exiting intelligence networks. The and communication systems associated with the UK
exponential growth in the complexity of cyber-attack Trident system to identify its level of exposure to
techniques outmatches the defensive capabilities, a modern and future cyber-attacks. It reviews the
trend that can only continue partly because any submarine systems architecture and its modus
defensive operations have to anticipate all possible operandi, and identifies potentially applicable
attack vectors before they are mounted, and partly cyber‑attack techniques and scenarios. As it is based
because the most effective form of defensive cyber upon publicly available sources, its conclusions
operation involves offensive cyber intelligence cannot be considered final or definitive.
(hacking into one’s opponents’ systems to glean
information on what it is they are attempting to
The report provides illustrative attack vectors aimed
at disrupting, destroying or endangering operations.
On the other hand, it also confirms that it takes “In addition to significant
sophisticated, well-resourced and sustained cyber- investment in cyber defence,
attacks to exploit the vulnerabilities in remote
submarine subsystems. These attacks are beyond
those responsible also need to
the scope of all but the most well-resourced and consider strategies that build
extensive non-state groups. Essentially, the resilience within the systems,
principal threat comes from other states’ cyber
operations alongside extensive and highly
and to incorporate this threat
sophisticated intelligence activities. into broader assessments
relevant to the choice of
The overall submarine network architecture is
weapon systems, platforms
physically isolated from the internet and any civilian
network, thus severely limiting the possibility of real and broader defence and
time external access into the command network by security strategies.”
remote hackers. This does not prevent attacks from
inside the submarine or the prior injection of malware
into submarines, missiles, warheads or other
infrastructure at the manufacturing, construction and The challenge of maintaining covert and secure
maintenance stages. Regular radio-transmissions patrols under reliable operational control is of utmost
from ashore could be used for limited bandwidth importance to an effective nuclear deterrence
cyber-attacks, spoofing or activating pre-installed posture based upon submarines. The continuous
malware programmes. Such highly covert, adaptive and rapid development of new cyber technologies
and targeted programmes could be designed to will inevitably result in some loss of confidence in
trigger in response to particular events. This was the future patrols, with negative results on strategic
case in the advanced malware used in the so-called stability. It is crystal clear that the highest level of
‘Stuxnet’ or ‘Olympic Games’ attack on Iran’s priority must be given to cyber protection at every
centrifuge systems, a cyber-physical attack that was stage in the construction of the UK’s Dreadnought
delivered into Natanz by unsuspecting class, across the whole supply chain, if the UK is to
subcontractors. contain this hit on confidence. This will inevitably

have major implications for the programme budget,
with uncertain success.
The report concludes that the vulnerability to cyber-
attacks is real. It can be reduced by significant,
1. David Hambling, The Inescapable Net: Unmanned
vigilant and continuous cyber protection, but cannot
Systems in Anti-Submarine Warfare, British American
be eliminated. It is therefore essential that in addition Security Information Council, (13 July 2016), http://bit.
to significant investment in cyber defence, those ly/1RC55KE
responsible also need to consider strategies that
build resilience within the systems, and to
incorporate this threat into broader assessments
relevant to the choice of weapon systems, platforms
and broader defence and security strategies.
FICTIONAL SCENARIO 1:
A strategy to acquire
Dreadnought-class
SSBN designs
Memo Dated: 17 March 2012
From: [Foreign] Naval Intelligence, Unit 6B
Mission: To steal Successor-class SSBN Designs for the purpose of ascertaining its capabilities,
likely patrol characteristics, weaknesses in its stealth, and for developing naval capabilities to seek
and destroy the Dreadnought once it is on patrol.
Objective: Attack the network systems of Gyro Instruments Ltd (GI), a UK-based sub-contractor
involved in design and development, and the supply of components.
Method: Remote access to GI’s network. Failing that to deploy intelligence assets to conduct direct
physical intrusion on site.
Using acquired and/or developed tools, our arms-length cyber-team DEVCOM_2 will perform remote
reconnaissance, enumeration and vulnerability scanning, weaponization (acquisition and preparation
of tools), exploitation (including zero-day exploitation) and initial breach.
If GI has air gapped a number of its systems or a network segment from the internet, DEVCOM_2 will
investigate options for gaining authorised access to those systems. It may be that there are indirect
means to enter via third-party network connections, using lateral movement techniques and acquired
credentials during the operation, and then ensuring our code propagates to the primary target.
If the target network is completely isolated from the internet or other networks DEVCOM_2 will report
back and we will activate Secret Intelligence Service sleeper operatives (KL56 and NU7) currently based
in Leeds, about 50 miles from the site. They will gain access to the target network as contractors or
employees using physical devices supplied by the team (we are still exploring possibilities, but could
include nano-routers, antennas, microcomputers, etc.). This will enable the DEVCOM_2 to bypass
what perimeter defences may be in place. Once they have access and have acquired the designs these
will be forwarded to the forensic team in Unit 61 for analysis. They will explore options to maintain continuous
and permanent surveillance throughout the supply chain, manufacture and operation of UK Successor submarines.
Contents
1. Introduction 8
2. The Origin of the Cyber Threat 11
3. Command and Control of the Trident System 16
4. Attack Vectors on Trident 18
4.1 Air gapping 18
4.2 Potential attack vectors on the whole system 19
4.3 Supply chain and construction 19
4.4 Patrolling 20
4.5 Maintenance 20
5. Vanguard’s Electronic Vulnerabilities 21

5.1 Communications to and from the submarine 22
5.2 Internal submarine networks 23
5.3 Navigation 25
5.4 Life support 26
5.5 Reactors and power supply 26
5.6 Command and control of missiles and warheads 26
5.7 Advanced persistent threat 27
6. Implications of These Vulnerabilities 30

7. Counter Measures 31
8. Future Related Trends 33
9. Conclusion 36
1. Introduction
Cyber threats have co-exited with the emergence and

ubiquitous use of computers to control critical systems.
Cyber warfare has also been with us for some time but Trident’s sensitive cyber systems are not connected
has achieved a scale that matches the highest priority to the internet or any other civilian network.
military programmes only recently. In the context of Nevertheless, the vessel, missiles, warheads and all
this report, the principal threat arises from state the various support systems rely on networked
hacking capabilities, principally because it is states computers, devices and software, and each of these
that possess the necessary resources, intelligence have to be designed and programmed. All of them
and motivation to target nuclear weapon systems. incorporate unique data, and must be regularly
updated, upgraded, reconfigured and patched.
Trident, based upon a fleet of four Vanguard class
ballistic missile submarines, is the only nuclear
weapon system operated by the UK. In 2016, the UK
Ministry of Defence stated its purpose as to “deter
the most extreme threats to our national security and
way of life [nuclear attacks by other states], which
cannot be done by other means”.3 Each of four
“We take our responsibility
submarines when on patrol carries forty to maintain a credible nuclear
independently-targetable thermonuclear warheads deterrent extremely seriously
on eight Trident ballistic missiles. They are based at
the Clyde Naval Base near Glasgow, Scotland, and
and continually assess the
operate a continuous patrolling posture. Relying as it security of the whole deterrent
does upon numerous computers, complex software programme, as well as its
and endless lines of code, the Trident system is
operational effectiveness,
undeniably vulnerable to cyber interference.
including against threats
It is obvious, but needs to be stated clearly, that from cyber.”2
cyber-attacks are not exclusively limited to those
conducted over the Internet. They can target the Spokesperson for UK Ministry of Defence, 30 March 2016,
apparently in response to articles in the Guardian and
command and control of computers and network Independent suggesting there existed a serious cyber
connected devices, and therefore refer to any efforts threat to Trident.
to steal, disrupt, deny, degrade, distort or destroy the
information that these systems rely upon, store,
process and generate.
8 HACKING UK TRIDENT: A Growing Threat

Applied to the UK nuclear weapons context, Recently leaked classified data from the US Central
this means we need to consider ever-emerging Intelligence Agency (CIA) disclosed numerous
vulnerabilities and challenges for the following:4 malware and exploits used for cyber offensive
operations and surveillance.6 They include, among
the vessel (stealth, submerged state, etc.); others, technologies able to remotely connect to
consumer communication devices (iPhones, Android
systems aboard the vessel (the nuclear reactor,
phones, smart TVs, and Microsoft Windows, MacOS
navigation, life support, etc.);
and Linux (multiple) operating systems). The
control software for the missiles, the warheads Guardian alleges that the thousands of leaked
and the torpedoes; and documents focus mainly on techniques for cyber
operations and reveal how the CIA cooperated with
secret design or operational intelligence about all British intelligence to engineer a way to compromise
aspects of the submarine, its payload, the crew smart televisions and turn them into improvised
and the directives. surveillance devices. A programme called Weeping
Angel describes how to manipulate a Samsung
The House of Commons voted on 18th July 2016 by a F8000 TV set so that it appears to be off but can still
large majority to proceed with building a replacement be used for monitoring. A CIA attack system
fleet of Dreadnought-class submarines to be called Fine Dining provides 24 decoy applications for
operational by the early 2030s, thereby extending CIA spies to use for covert operations that require
operations to at least the 2060s.5 physical presence of the agent inside or outside the
The WannaCry Ransom: $300 to $600.
cyber attack Backdooring: The worm loops through every RDP

session on a system to run the ransomware as with
The WannaCry ransomware cyber worm attack is
user-level privileges. It also installs the
an ongoing cyberattack targeting the Microsoft
DOUBLEPULSAR backdoor. It corrupts shadow
Windows operating system. It started on 12 May
volumes to make recovery harder. (source:
2017, having infected more than 230,000 computers
in 150 countries with the software demanding ransom Malwarebytes)
payments in the cryptocurrency bitcoin in 28
Kill switch: If the website:
languages. The attack has been described by
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.
Europol as unprecedented in scale. The systems
com is up the virus exits instead of infecting the target
affected by the WannaCry attack around the world
(source: Malwarebytes). This domain has been
included hospitals, doctors’ surgeries, banks and
reregistered, removing the access to command and
ATMs, transport systems, trains and airlines, ticket
control of the malware. This action that stopped the
sales, car production plants, telecoms firms, power
spread of the worm.
providers, logistics firms, schools and universities,
and the Russian Interior Ministry. Legacy: A minor variant of the virus has been found,
Virus Name: WannaCrypt, WannaCry, WanaCrypt0r with the kill switch edited out (disallowing the remote
2.0, WCrypt, WCRY shutdown of the malware), allegedly not created by
the original malware author. The ransomware module
Vector: All Windows versions prior to Windows 10 are is corrupted, however, and does not work – the worm
vulnerable, if not patched with the MS-17-010 update. only propagates. Yet the encryption keys and the
The malware exploits the EternalBlue MS17-010 bitcoin addresses are the same.
vulnerability to propagate (discovered by the NSA and
stolen by the cyber-criminal group Shadow Brokers). Microsoft issued its first patch for Windows XP since 2014.

target facility.7 Multiple instances of the disclosed 2. UK Ministry of Defence, Defence in the media –
Wednesday 30th March 2016, Ministry of Defence,
developed and improved malware are able to jump
(30 March 2016), http://bit.ly/2qAbVaJ
air-gapped security systems (over USB drives, local
3. UK Ministry of Defence, UK Nuclear Deterrence: What
wireless networks, etc.).8 You Need to Know, Policy Paper, (24 March 2016), http://
bit.ly/1WRHC83
The recent global attack that hit on 12 May 2017 4. The Defense Technical Information Center, Universal
Joint Task List, (16 May 2017), http://bitly/2ruAyWd
involved the WannaCry worm. This was reported to
5. BBC, ‘MPs Vote to Renew Trident Weapons System’,
have originated from a sophisticated cyber weapon
(19 July 2016), http://bbc.in/29Q4eDl
developed by the US National Security Agency
6. Wikileaks, ‘Vault 7: CIA Hacking Tools Revealed’, (7 March
(NSA) that exploited vulnerabilities in Windows 2017), http://bit.ly/2nal1Id
operating systems they had identified. This had been 7. Ewen MacAskill, ‘WikiLeaks publishes ‘biggest ever leak
stolen by the hacker group, the Shadow Brokers, and of secret CIA documents’, The Guardian, (7 March
2017), http://bit.ly/2lYPxou
released online. Microsoft had distributed the patch
8. Swati Khandelwal, ‘10 Things You Need to Know about
MS17-010 to address this vulnerability a month
“Wikileaks CIA Leak”’, The Hacker News,
before it was stolen by the hacker group Shadow (8 March 2017), http://bit.ly/2n75w4E
Brokers. However, those systems whose operators 9. Warwick Ashford, ‘Businesses Urged to Apply Windows
did not download the patch remained vulnerable and Patch to Avert WannaCry Attacks’, Computer Weekly,
the worm attacked two months later.9 The Shadow (15 May 2017), http://bit.ly/2rjqizZ
Brokers claim to have a large number of other cyber 10. Andrew Futter, ‘Cyber Threats and Nuclear Weapons’,
RUSI Occasional paper, (July 2016), http://bit.
weapons they have acquired, and are threatening to ly/2qvhgBP
release them regularly.
Whilst there has been much talk of the development

of offensive cyber capabilities across many sectors,
and growing investment by governments in these
techniques and the means to combat them, there has
been surprisingly little consideration given in public
to the resulting emerging vulnerabilities to the Trident
system and similar nuclear weapon systems.
One notable exception to this is the excellent report,
Cyber Threats and Nuclear Weapons, authored by
Andrew Futter, published by the Royal United
Services Institute in July 2016.10 Futter explored
amongst other things in that occasional paper the
exposure of nuclear weapon systems to cyber
espionage and sabotage, and the wider implications
for strategic stability. This report picks up and
expands on a some of the themes in that report and
applies them specifically to the UK systems around
existing Vanguard and future Dreadnought
submarines.

2. The Origin of the Cyber Threat
Cyber warfare involves “actions by a nation-state to penetrate another

nation’s computers or networks for the purposes of causing damage or
disruption”,11 but other definitions can sometimes encompass non‑state
actors, such as terrorist groups, companies, political or ideological
extremist groups, hacktivists and transnational criminal organizations.
Considering the range of motivations behind States have a strong incentive to discover the
cyber‑attacks and the capability of groups to conduct patrolling locations of other states’ submarines, their
them enables better assessment of the threat and design and detailed capabilities, their defences,
the prediction of which systems have to be secured.12 tactics and other operational details and acquire an
On both counts, in the context of Trident systems, edge in the naval military contest or even to
it seems most likely that attackers will be states. neutralise a nuclear threat. This can be achieved
either by using this intelligence in combination with
When a UK Trident crew member went public in 2015 its more physical naval assets, or by deploying cyber
with his many concerns about lax security and poor tools directly to degrade an opponent’s ability to hide
safety at the Faslane naval base and on board the and deliver nuclear warheads on target. The suite of
Vanguard submarines themselves, his prime tools available for cyber intrusion is rapidly
expressed concern was that terrorists could gain proliferating and improving.14 When used in
access to the system. His evidence notwithstanding
13 combination with other intelligence assets (such as
(and it included some surprising and alarming claims), rogue officers, crew members, maintenance and
there are so many vulnerable systems that would other personnel), the capabilities of states to infiltrate
deliver the desired effect that it seems unlikely are significant.
terrorists would target Trident systems. Hacktivists
and cyber criminals currently do not possess sufficient Those responsible for defending against cyber-
capability to conduct operations of the required scale attacks can attempt to isolate critical systems and
and sophistication relevant to penetrating Trident anticipate the numerous possible methods of attack,
systems, as far as we can judge. So the principal whilst minimising inconvenience for their authorised
threat, and the one considered in this report to be users. Cyber intrusions are covert and virtually
most relevant, comes from other states, particularly impossible to attribute if conducted with expert-level
those that have the potential to emerge as strategic operational security. They vary based on motivation
competitors to the United Kingdom and its allies. of the attackers, targetable assets and the activities
conducted by attackers.
Industrial espionage and backdoor injection during
manufacturing allow adversaries to conduct long- Malware and attacks involve malicious software used
term cyber operations that may operate for years to disrupt computer or mobile operations, gather
before they are discovered. Cyber-attacks are also sensitive information or gain access to computer
used for military surveillance, warfare support and in systems. Malware injection requires prior knowledge
recent years, for full-scale operations in their own of the software and hardware architecture and a
right. Over the past decade, cyber warfare has delivery mechanism and can sometimes grant virtually
become a vital part of conventional warfare and a full control over the target system or even network.
new military domain.

Some relevant cyber incidents
One of the earliest publicly announced events related In an attack attributed by some as a retaliation for
to the CBRN infrastructure vulnerability to cyber Stuxnet, the Malware ‘Shamoon’ in 2014 wiped
attacks occurred in January 2002. The Slammer 30,000 workstations in Saudi Aramco’s corporate
worm successfully breached the perimeter network network, raising concern over cyber-attacks that can
defences at Ohio’s Davis-Besse nuclear power plant bypass firewalls and intrusion detection systems to
(employees claim the network was protected by a physically affect operations technology networks in a
firewall), infiltrated a private computer network and large scale.
disabled a safety monitoring system for nearly
five hours. In 2014, 13 different types of malware disguised as
ICS/SCADA software updates (such as Siemens
The 2010 ‘Stuxnet’ event in Iran confirmed that Simatic WinCC, GE Cimplicity and Advantech) were
information technology could be used not only to detected in spear-phishing emails. After a due
trigger remote CBRN attacks, but also could be seen forensic investigation, the malware was identified as
as a direct threat to physical CBRN ICS equipment. the re-purposed banking Trojan, aiming to collect
Stuxnet was the first malware to infiltrate and cause private information and credentials. This event
physical and tactical disruption in multiple ICSs in a confirms the capabilities of ICT malware to be used
CBRN facility (the uranium enrichment plant) and against industrial networks.
numerous other facilities over two years with similar
equipment. But it also infected computer networks The world’s first proof-of-concept PLC worm was
across the global internet, and the cyber security presented at BlackHat 2015 conference (August
community and CBRN defence experts united in their 2015), showcasing the malware that can replicate
attempts to neutralise its spread and protect the itself directly from one PLC unit to another, attacking
integrity of global digital systems. ICS firmware and hardware.
In 2011, the Trojan ‘Poison Ivy’ was used to collect In December 2015, the Denial of Service in a power
intellectual property from 29 international chemical plant and multiple substations in Ukraine triggered a
companies. It was one of the largest acts of industrial power outage. In February 2016, it was
espionage in history, raising the awareness of cyber acknowledged that BlackEnergy malware was used
security specialists in the topic of cybersecurity of for the cyber attack.
critical infrastructure.

DATE MALWARE SCOPE CYBER TOOL(S) ANNOUNCED
USED
2007 BlackEnergy Targeted Denial of Service on HTTP-based 2008

(First generation) 54 communications, finance and DDoS botnet
government websites in Georgia
2009–2010 Stuxnet Centrifuged compromised in ICS override 2010

Natanz Nuclear Facility
2010 BlackEnergy2 Cyber-Fraud in Ukrainian Rootkit, credentials 2010

and Russian banks capture
2011 Duqu Espionage in the Middle East Information gathering 2011

(scope unknown) about ICS, Keylogger
2012 Flame Espionage in the Middle East Modular malware 2012

(scope unknown)
March 2015 BlackEnergy3 Power outage in Ukraine, Modular malware, December 2015
impacting 225,000 customers ICS override
2015 Irongate Detected on VirusTotal by Man-in-the-Middle 2016

(First generation) FireEye* attack, Sandbox
evasion
2017 WannaCry Over 300 000 Computers Ransomware 2017

and systems running Windows
operating systems infected
and held for ransom

“Sabotage can involve the introduction of autonomous malware
during the development, procurement or configuration phase while
the submarine, missiles, warheads or any other internal system,
are being built, or when the submarine is in port for maintenance,
refurbishment and software updates.”
Of course, UK Trident submarines, once 11. Richard A. Clarke and Robert K. Knake, Cyber War: The
Next Threat to National Security and What to Do About It,
commissioned, are only out at sea around 30-45% of
1st edition, HarperCollins, (2011)
the time. Sabotage can involve the introduction of
12. Tyler Moore, Cyber War, Wellesley College, (6 December
autonomous malware during the development, 2010), http://bit.ly/2pXmjbk; Tavish Vaidya, ‘2001-2013:
procurement or configuration phase while the Survey and Analysis of Major Cyberattacks’,
submarine, missiles, warheads or any other internal Georgetown University, (July 2015), http://bit.ly/2ruP0wF;
Arthur Beesley, ‘EU Suffers Jump in Aggressive
system, are being built, or when the submarine is in Cyber-attacks’, Financial Times, (8 January 2017) http://
port for maintenance, refurbishment and software on.ft.com/2i9gR3T
updates. Remote radio transmissions to the 13. William McNealy, ‘The Secret Nuclear Threat’,
submarine could be used to activate any covert (May 2015), text available on Nuclear Information
Service website, http://bit.ly/2qVpYKW
dormant malware in one of the systems on board (if
14. Col Williams J. Poirier, Maj James Lotspeich, ‘Air Force
the malware has access to the receiving software/
Cyber Warfare: Now and the Future’, Air & Space Power
hardware, or the activation signal is properly relayed Journal, (September-October 2013), http://bit.
to the malware process). It is more likely, however, ly/2p4t9OA
that malware would be pre-configured to activate in
response to a particular event (such as the order to
launch a missile).
Autonomous Denial of Service (DoS) of the internal

systems, delivered by pre-installed malware
(hardware or software), may cause inconvenience,
distraction or severe disruption of any affected
systems (even auxiliary). This may be a primary or a
secondary goal of the attackers, to orchestrate a
chain of events and carry out a sophisticated
multidimensional attack.
A cyber-attack may target the submarine, command

and control, or the missile launch system. It can
attempt to disrupt or change launch coordinates to
divert the original course of the missile, or to disrupt
or neutralise the warheads themselves.

A possible strategy to
infiltrate UK SSBN
Command and Control
Memo Dated: 23 February 2018
[Foreign] Naval Intelligence, Unit 6B
Mission: to develop the capability of disrupting and neutralising UK and NATO SSBN Command and Control
via remote access.
Objective: to infiltrate and compromise the network of the UK submarine command Northwood HQ, UK and
establish ability to launch Denial of Service or other cyber-attacks at a time of our choosing and without
detection.
Method: Establish remote access to Northwood’s network and on-going hardware and operations
surveillance using APT tactics and a variety of cyber tools that deliver the ability to neutralise
communications to patrolling SSBNs. To trigger the intelligence asset on site and additional assets in London
with established ability to access secure facilities as contractors, and to insert unauthorised hardware and
software facilitating the objective.
The mission will commence by commissioning our arms-length cyber-team DEVCOM_2 to assess network
exposure, and scope out options to determine the components of an extended APT operation on the facility
network. This will require an audit of suppliers to the facility with the purpose of identifying vulnerable
systems to act as entry nodes into the secure network.
We need to make early contact with the intelligence asset already inside Northwood to establish possible
entry points and requirements. At the same time, to operationalise commercial assets in London to establish
technical credentials and cover stories for future entry. At the right time we need to transport preconfigured
hardware into the operation, for connection into the Network. This could then facilitate system error and/or
force the unscheduled reboot and prevent normal loading process (disable certain services), enable us to
bypass the authentication and possibly to load system-level privileges for remote access by DEVCOM_2.

3. Command and Control
of the Trident System
UK nuclear weapons are predicated on the idea that they guard the
nation against nuclear attack or blackmail.15 Trident is designed to be
a stealthy, invulnerable system, almost impossible for an enemy power
to eliminate before an attack, and would consequently be able to
retaliate in the event of any nuclear strike against the UK.
The Royal Navy’s four Vanguard Class communications between the Prime Minister and the
nuclear‑powered submarines carry Britain’s Trident Vanguard commander on patrol. Two officers on
nuclear deterrent. board the submarine are required to authenticate
each stage of the process, using the codes that are
Under the practice of Continuous At-Sea Deterrence stored inside two safes opened with keys held by the
(CASD) at least one submarine is always on patrol. ship’s executive and weapons engineering officers.
Another submarine is usually undergoing The submarine commander is responsible for the
maintenance and the remaining two are in port or on activation of the firing trigger.18
training exercises. Four submarines enable some
latitude for unforeseen events. The submarine If the commander has a reason to believe that the
patrols at depth within a series of planned government has ceased to function and has been
topographical “boxes” measuring several thousand destroyed, the letter of the last resort would be
square miles, but the exact location and route is retrieved from a safe bolted to the control room deck
known to only three or four people on board the and its instructions followed.19 The letters of last
vessel. The submarine will only make contact with resort are four identical handwritten letters from the
naval command in an extreme emergency, serving Prime Minister to the commanding officers of
as communication from the submarine could give each Vanguard-class submarine, orders on what
away its location. Intelligence is usually relayed to action to take in the event that an enemy nuclear
the vessel by low frequency and very low frequency strike has destroyed the British government.
radio, and more occasionally by higher frequency
bands using satellites, giving known details of 15. Peter Cannon, ‘The Necessity of Nuclear Deterrence’,
shipping movements and potentially hostile aircraft The Henry Jackson Society, (18 June 2012), http://bit.
or submarines in the area.17 ly/2qv7cZo
16. http://bit.ly/1Q50BtP
17. UK Ministry of Defence, ‘Strategic Defence and Security
Only the Prime Minister can authorise the launch of
Review published’, Ministry of Defence,
Trident ballistic missiles. These orders would likely (19 October 2010), http://bit.ly/2ridwVm
be issued from the PINDAR command bunker under 18. International Court of Justice, ‘Legality of the Threat or
MoD Main Building in Whitehall, central London, Use of Nuclear Weapons’, (1996), International Court of
Justice, http://bit.ly/1hW3TeQ
with strict protocols in place to confirm her identity,
19. The process by which a Trident submarine commander
though she can issue these orders from elsewhere.
would determine whether the British government is
This order would be conveyed directly in person over functioning includes, among other checks, establishing
secure link to the CTF 345 operations room in whether BBC Radio 4 continues broadcasting. This was
Northwood, the only facility with direct first described in Peter Hennessy, The Secret State:
Whitehall and the Cold War, (Allen Lane, 2003).

UK Vanguard submarines
specifications
Length: 492 ft
Displacement: 15,900 tonnes
Crew: 132
Top speed: 25 knots (though at this speed the submarine

generates significant noise that will reduce its stealth,
it generally patrols at walking pace)
In service: 1993 to present and planned to early 2030s
Armament: Spearfish torpedoes and up to 16 Trident II D5

nuclear missiles (the 2010 SDSR reduced the maximum
number carried to 8 operational missiles per patrol)16
Power: Rolls Royce PWR2 nuclear reactor

4. Attack Vectors on Trident
The nuclear ballistic missile submarine is perhaps the most sophisticated

naval vessel ever built, with a great deal of interdependence between
systems. Whilst there are many protections and back-up systems,
sub-system malfunction and failure can conceivably trigger the collapse
of the submarine’s operation and neutralise its primary purpose.
Cyber-attacks may be mounted in concert with more Protocol may ban the introduction of storage devices
conventional sabotage or military attack. during operation, and include a ban on wireless
A particularly effective attack could enable enemy connections or similar restrictions on
access to the submarine’s command network. electromagnetic leakage from the secure network
Remote communication and passive reconnaissance through the use of a Faraday cage or some other
(using long range antennas to monitor wireless form of EmSec (security measures to prevent
transmissions) could enable attackers to capture electromagnetic radiation leaking data).
encrypted information or to distort it without an initial
breach into the system. Cyber-attacks are difficult to A number of recent events (such as Stuxnet, Duqu
control and many of their effects likely unanticipated. and BlackEnergy3) prove that air gapping and
They may have an intended effect on a particular network segmentation cannot be considered an
sub-system but then have broader unintentional effective defence against all cyber-attacks. Every
impacts on the wider system. electronic system inevitably has a means for new
code to be introduced, be it by USB memory stick or
some more sophisticated method, particularly at
4.1 Air gapping more vulnerable times.
A secure computer network is said to be air gapped Efforts to develop methods to penetrate an
when it is physically isolated from other insecure air‑gapped network have been the focus of much
networks, particularly the public Internet or any research over many years. The viability of acoustic
insecure local area network. Networks that employ signalling in defeating air gap isolation was
dedicated cryptographic devices that tunnel packets demonstrated in 2013.20 In 2014, researchers
over untrusted networks while avoiding packet rate introduced AirHopper, a bifurcated attack pattern
or size variation are also considered air gapped, as showing the feasibility of using a mobile phone to
there is no ability for computers on opposite sides of achieve data exfiltration from an isolated computer,
the gap to communicate. Submarines on patrol are using FM frequency signals.21 In 2015, BitWhisper,
clearly air gapped, not being connected to the a covert signalling channel between air-gapped
internet or other networks, except when receiving computers using thermal manipulations achieved
(very simple) data from outside. As a consequence, Proof of Concept. BitWhisper supports bidirectional
it has sometimes been claimed by officials that communication and requires no additional dedicated
Trident is safe from hacking. But this is patently false, peripheral hardware. Later in 2015, researchers
and complacent. introduced GSMem, a method for exfiltrating data

from air-gapped computers over cellular frequencies.

The transmission, generated by a standard internal general inability of personnel to keep to protocol and
bus, enables the computer to operate as a small commanders to enforce protocols effectively.23 His
cellular transmitter antenna. account of security lapses is sobering to anyone
sceptical about the possibility of the delivery of a
ProjectSauron malware, discovered in 2016, cyber weapon into the Trident system. He attested,
demonstrates how an infected USB device can be ‘it’s harder to get into most nightclubs than it is to get
used to remotely leak data off from an air-gapped into the [‘highly secure’] Green Area’ at Faslane. He
computer. The malware remained undetected for five also claimed that as a junior crewman, he and many
years and relied on hidden partitions on the USB others frequently went onto base and into the
drive not visible to Windows as a transport channel submarine without their bags being checked.24
between the air-gapped computer and a computer
connected to the internet, presumably as a way to The recreational computer network on board is one of
share files between the two systems.22 the more vulnerable systems that could be used as a
cyber entry point. Malware can be introduced and
Sophisticated malware can clearly exploit various even written on board the vessel using one of the
hardware combinations to broadcast sensitive personal computers, and then the malicious code
information from air-gapped systems. These could be introduced into the control systems network
hardware combinations use a number of different using available data transfer capacities (USB drives,
mediums to bridge the air-gap, including: acoustic, SD cards, etc.).
light, seismic, magnetic, thermal and radio-frequency.
4.3 Supply chain and

4.2 Potential attack vectors construction
on the whole system
The procurement and operation of the submarines
An attack vector is a path or means by which a involves several stages: research and development,
malicious actor can gain access to a computer or manufacturing, assembly, sea-trialling,
network server in order to deliver a payload or a weaponization, deployment and maintenance.
malicious outcome. Attack vectors enable attackers Security flaws can be introduced deliberately or
to exploit system vulnerabilities, including hardware, inadvertently at the manufacturing, assembly and
software and the human element. maintenance stages, to be potentially exploited in the
future. Otherwise, malware may be uploaded into a
It is often said that the weakest link in any complex component or a network of components, for it to lie
system are the human beings responsible for dormant ready to activate at a predefined moment or
managing it, and they are often targeted by cyber- under specific circumstances.
attackers. It is estimated that 80% of global cyber-
attacks originate from social engineering and Cyber espionage may be used prior to or during
spearphishing. The famous hacker Kevin Mitnick construction to acquire highly classified design
describes himself more as a social engineer focused information or operational secrets, enabling
on exploiting human weaknesses. It does not matter competitors to develop their capabilities to track the
how strict the systems are; unless everyone involved Trident submarines.25 Bear in mind that the design and
is on continuous high alert, they are highly operation of the reactor is treated as a higher
vulnerable to manipulation or misdirection. classification than the warhead design itself, because
of implications for submarine stealth and efficiency.
When in May 2015 Able Seaman William McNeally
outlined his numerous security concerns about the Such intrusions might also be used to enumerate and
operation of Vanguard submarines, his principal identify systems as a precursor for future attack and
focus was on the poor levels of security on shore at possible sabotage. The hacker group thought to be
the Faslane base and on board during patrol, and the behind the release of the WannaCry worm in May

2017, the Shadow Brokers, claimed on 16 May to communication devices can be conducted during any
have data relevant to nuclear and missile stage of the submarine operation, including on
programmes in several countries that they could patrol.28 It is generally easier to spoof
release publicly in the coming months. 26
Defence communications from satellites.
laboratories and contractors in the United States
involved with manufacturing and maintaining the
Trident missile, its software and its fire control 4.5 Maintenance
systems (upon which the UK relies) have been
targeted by hackers looking for sensitive nuclear-
Maintenance involves replacement, remodelling,
related intelligence in the past.27 We can assume the
reconfiguration, update and upgrade of systems.
Atomic Weapons Establishment in Berkshire, where
During this process systems interact with external
the UK nuclear warheads are designed and
networks and devices. Malicious software could be
maintained, is also a highly desirable target, as well
uploaded deliberately or unwittingly onto the vessel
as the primary submarine contractors in the UK, BAE
subsystems using storage devices, giving access to
Systems, Rolls Royce and Babcock, and companies
design or operational intelligence. It could also
within their supply chains.
potentially sabotage or damage the missiles, missile
control or any other onboard system. This does not
Protection against intrusion at every level of the
necessarily require the presence of a malign human
supply chain is a monumental task, one it is hard to
actor anywhere near the submarine, missile or
believe the industry is up to. Security can never be
warhead facilities, or in the facilities of any contractor.
guaranteed even in the most secure facilities of a
Maintenance, like the construction stage, has a less
prime contractor, but those facilities for secondary
secure supply chain that is vulnerable to external or
contractors are unlikely to be any match for a
internal attack.
concerted and resourced group of attackers,
particularly with the resources of state intelligence 20. John Leyden, ‘Hear that? It’s the Sound of BadBIOS
services behind them. Wannabe Chatting Over Air Gaps’, The Register, http://
bit.ly/2quYGKa
21. Guri, Mordechai; Monitz, Matan; Mirski, Yisroel; Elovici,
Yuval, ‘BitWhisper: Covert Signaling Channel Between
4.4 Patrolling Air-Gapped Computers Using Thermal Manipulations’,
IEEE 28th Computer Security Foundations Symposium,
(April 2015), http://bit.ly/2pZWGpM
Among all potential intentional attack threats to a
22. BBC, ‘‘Project Sauron’ malware hidden for five years’,
patrolling submarine in communications receive (9 August 2016), http://bbc.in/2aWpx9K
mode only, there are three major vectors: malware 23. William McNealy, ‘The Secret Nuclear Threat’,
injected before the patrol, insider threat (infiltration) (May 2015), text available on Nuclear Information
Service website, http://bit.ly/2qVpYKW
and external radio transmission to the submarine.
24. Symantec Corporation, ‘Internet Security Threat Report
Until new technologies emerge, the vessel is less
2014’, Volume 19, (April 2014), http://symc.
vulnerable to real-time external electronic and ly/1kmEX7O
communication attack when submerged (VLF radio 25. Andrew Futter, ‘Is Trident safe from cyber attack?’,
simply does not have the bandwidth to receive Article prepared exclusively for the European Leadership
Network, (February 2016), http://bit.ly/1LxfDKf
malware), though it is more vulnerable to attacks
26. See blog, ‘OH LORDY! Comey Wanna Cry Edition’,
from inside the submarine. If compromised while
available in: http://bit.ly/2qmLzLa
underwater, systems failure might lead to critical
27. Lockheed Martin, ‘Lockheed Martin-Built Trident II D5
malfunction, decompression and loss of the vessel Missile Achieves 130th Consecutive Successful Test
and strategic payload. Flight’, PR Newswire, (28 December 2009), http://prn.
to/2qwGwry
28. Kim Zetter, ‘How Attackers Can Use Radio Signals
One possible attack vector may include spoofing or
and Mobile Phones to Steal Protected Data’, Wired,
false orders from hacked radio transmission facilities. (11 March 2014), http://bit.ly/2qvlOrX
Though rare and requiring special equipment and
conditions, radio frequency attacks on

5. Vanguard’s Electronic Vulnerabilities
All critical systems in a vessel are automated and controlled by its

computer systems. As military infrastructure is heavily guarded and
segmented, one of the most effective means to attack these systems
would be the use of malware.
Table 1 outlines two main network structures vulnerable to malware injection: those on board the submarine
and those within the command and control facility on land.
Activity Critical system Examples of possible consequences

Malware injected Communications (remote) xx Engaging emergency protocols;
into one of the xx interception and misdirection of communications
systems on from HQ, spoofing or loss of communications.
board the vessel Communications (internal), xx Loss of coordinated operation;
and any computer in the facility xx increased vulnerability of the vessel;
xx decreased mobility and response capacity of
the vessel;
xx malware propagation across the facility network
from the most vulnerable system to the most
critical, with potentially multiple effects.
Navigation xx Decreased mobility;
xx confusion around location;
xx the vessel might be forced to surface to
periscope depth.
Life support xx Threat to human life and operation of the vessel.
Reactor xx Loss of control;

xx overheating and core meltdown;
xx irradiation, area contamination;
xx at extreme, vessel destruction.
Control of missile and warhead xx Confusion over communications between missile
operations and control;
xx missile abort or misdirection;
xx premature explosion of warheads.
Malware injected Interception of communication xx Interruption of communications, preventing
into a system in system smooth C&C.
the C&C facility
Distortion or substitution of xx False orders could include:
communication system, leading to xx notice to fire;
false orders and information xx taking submarine off alert;
xx ordering the vessel to prematurely return to port.
Human-Machine Interface (false xx False sense of security;
reading on the system about the xx false alarms;
submarine status and location) xx false orders.

5.1 Communications to and communication whilst the submarine is at maximum
depth, but require huge transmitters, a great deal of
from the submarine energy, and can only transmit very low bandwidth.
They have largely been abandoned.
Possible attacks against digital communication
systems include: VLF can penetrate to a depth of around 20 meters
below the surface and can transmit at roughly 300
Interception – unauthorised capture of transmitted
bit/s, translating to around 450 words a minute.
data, encrypted or not;
Submarines can sometimes use a submerged buoy
Spoofing – impersonation of the transmitted data, at this depth with an antenna, so that the vessel can
faking its origin and context; remain at greater depth. VLF can be affected by
salinity gradients in the ocean and natural sources of
Bit flipping – compromising the integrity of the VLF radiation, but the quality of data transmission is
transmitted data by damaging the transmitted not strongly influenced by environmental conditions
encrypted data, causing scrambled date or false and is therefore useful for reliable global
interpretation; communications. The US Navy’s VLF systems serve
as a back-up for global communication use during
Jamming – blocking the data transmission in a
hostilities when nuclear explosions may disrupt
particular area or over a certain channel.
higher frequencies or satellites and other
transmitting equipment may be destroyed by enemy
The chance of miscalculation, misperception or
actions.
unauthorised use due to “spoofing attacks” and
electronic impersonation remains a possibility, and
there are protocols in place when on patrol to guard The transmission antennas need to be large, to the
against these possibilities. Of course, these depend point that they can cover a site of several square
upon crew members sticking to protocol, and in any kilometres, so this is a one-way communication from
case, are not guarantees for success. It is also shore-based command centres to surface ships and
conceivable that cyber-attackers could target UK submarines. Its range can be extended by
radio communications, just as they have in the past broadcasting to several satellites at once. The British
US submarine radio transmissions.29 This would use a VLF transmitter at Skelton near Penrith, but
present particularly acute challenges during the time other NATO and US transmitters can also be used to
of crisis and time-pressure, when the need for quick communicate with British submarines.31
and clear coordination and communication is
paramount. Details of the communication systems in A review on Very Low Frequency (VLF) submarine
Vanguard-class submarines are of course classified, communication methods by the Pentagon in the
but the technology they rely on is not. Modern radio mid‑1990s unearthed a firewall vulnerability that could
frequency attacks can target not only data in transit, have enabled hackers to gain control of naval radio
but also the transmitters and receivers, and their communications “for broadcasting nuclear launch
internal software. orders to Trident submarines”.32 The investigation
showed that cyber terrorists could potentially infiltrate
External communication to the submarine transmits this network and insert false orders for launch, or to
data (such as targeting and battlespace information, neutralise such orders, sidestepping the chain of
and brief messages from families to the crew) over command. The investigation led to “elaborate new
very low frequency (VLF) and low frequency (LF) instructions for validating launch orders” from two
radio without using satellites, picked up by a long independent instructions to fire, which will have been
antenna trailing in the water behind the submarine.30 replicated by UK protocols.33 Whilst this will have
Data is transmitted using an internet protocol (IP) made spoofing and other attacks more challenging,
system, and uses a US-UK common military grade they remain a possibility.
encryption system at both ends of the
communication. Extremely low frequency (ELF)
systems have been in use in the past, enabling

Submarines can also receive data from satellites at There are multiple isolated local area networks inside
higher frequency when on or near the surface the submarine. The networks controlling the
(with an antenna raised). This uses UHF, SHF and submarine are separated from that of weapons
more recently EHF radio communication for faster systems, as well as from the recreational network.
bursts of data transmission, as well as for However, emerging developments deliver the ability
communications from the submarine to itself.34 This to bypass the physical isolation of networks. The
form of communication does leave the submarine notorious cyber-attack on the Natanz Nuclear
vulnerable to detection, and satellite facilities, labelled Stuxnet (Iran, 2010), is an
communications to conventional cyber-attacks, as illustration of airgap-jumping malware, that can
they use encrypted but generic network protocols for propagate via USB storage devices carried by
data transmission and security (including TCP/IP, unsuspecting and authorised users. In this case, it is
NetBIOS and RDP).35 believed that malware was written in the United
States and Israel, delivered by USB by contractors
and subcontractors within Iran responsible for
5.2 Internal submarine maintenance. 36 The virulence of the code was such
that it rapidly spread to computers worldwide, but it is
networks believed only had physical impact upon the specific
target: Siemens controllers connected to the Iranian
Network connectivity inside the submarine uses centrifuges.
internal wired radio and computerized systems which
transmit data from sensors to the monitoring stations
Backdoor, a malicious process that facilitates access
to inform decisions and control the submarine.
or code execution by an attacker without proper
Effective command and control requires correct and
authentication, may be introduced during the
timely tactical data delivery, and is fully dependent on
development of the software by intention (including
this network infrastructure.
the scenario when the attackers infiltrate the network
of a defence contractor or sub-contractor further up
In common with many military systems, the the supply chain) or by accident, when the backdoor
electronic systems involved in SSBNs are based on may be introduced during the debugging process
legacy technology onboard (both hardware and implemented by the developers and not removed.
software), that is bespoke and highly classified. This
has ambiguous implications for security. The search
The Submarine Command System (SMCS) was first
for vulnerabilities requires a great deal of reverse
created for the Vanguard-class submarines as their
engineering and study. Yet the operating systems,
tactical information and torpedo weapon control
software and hardware for the Trident submarines
systems.37 It has a long and complex pedigree. Its
are designed with weak legacy architecture, with only
updated versions are based upon a version of
a limited number of engineers involved in their
Windows XP and known colloquially as ‘Windows for
development and security. Whilst the code is often
Warships’. These have now been installed on all
old and may be unfamiliar to today’s hackers, and
active Royal Navy submarine classes.
many cyber hacking tools will be inappropriate to it,
there are more likely to be many potential
Both Windows-based and Linux-based operating
vulnerabilities lurking within as fewer people will
systems hold the legacy of vulnerabilities from
have been involved in creating and testing it. Those
the original systems, even though they operate
vulnerabilities will have been around for a long while,
on obscure and classified equipment and run
and active external support often suspended
bespoke programmes.
enabling potential hackers to develop back-doors,
trojan horses and other tools to compromise the
Prior to the Vanguard class, Royal Navy ships and
code. As the victims of the WannaCry worm over the
submarines had command systems built by Ferranti
weekend of 12-15 May 2017 discovered, older
using custom-built electronics and specialised
operating systems that may not have universal
proprietary processors. Soon after the decision in
support from the suppliers can be more exposed.
1983 to proceed with the Vanguard programme, an

open competition for the command system was won Vanguard fleet into the 2020s. The programmes in
by Gresham-CAP, who proposed an innovative place for other submarine improvements were mainly
distributed processing system based on commercial for new sonar equipment.40
off-the-shelf processors, and with a modular software
architecture largely written in the Ada programming In 2002, it was proposed to convert SMCS to run on
language. standard x86 hardware redesigned specifically for
naval command systems. The plan was to convert
Each set of the Initial Phase SMCS equipment had the SMCS infrastructure and applications to run on
multiple computer nodes. At the centre of the system the Microsoft Windows operating system and known
there is an Input/Output Node (providing interfaces to as SMCS-NG (“Next Generation”), or “Windows for
weapons systems and sensors) and a Central Warships”.41 This is based upon a variant of Windows
Services Node (conducting fast numeric processing). 2000 and Windows XP. SMCS-NG was retrofitted
Each central node is duplicated (“mirrored”) to create into all Royal Navy submarines by December 2008.
a fault-tolerant system which is dual modular The software is supplied as a universal release
redundant. The human-computer interface is configured for the sensor and weapon fit of each
provided by multi-function consoles and some submarine.
additional terminals. The dual redundant central
nodes are linked to each other and to the consoles Windows has an entangled monolithic structure, as
via a dual-redundant fibre optic network connection. opposed to a modular architecture.42 It is therefore
Most processing was done by Intel 80386 single- impossible to change the proprietary operating
board computers, each with its own Ada run-time system by means of reconfigurations and third-party
environment. CAP Scientific (later part of Sema modules. This structure of the consumer-friendly
Group) created a complex layer of middleware to link operating system exposes potentially vulnerable
the many processors together. SMCS was the services and features that might not be required for
largest Ada project to date. As a result, the SMCS the adequate functioning of the submarine.
project encountered many challenges with the large-
scale use of Ada compilers, Ada development tools Defence Minister Adam Ingram later gave
and the special characteristics of the Ada 83 assurances to parliament in 2004 that this was a low
programming language. risk use of Microsoft Windows, on the basis that it
was more likely to have long-term product support.43
By 1991, the SMCS project was owned by There was no mention of its security features, and it
BAeSEMA, a joint venture between Sema Group and is worth noting that Microsoft has ceased general
British Aerospace. The decision was taken to migrate product support for both Windows 2000 and
SMCS to the Solaris operating system on UNIX, Windows XP, one of the reasons why the WannaCry
running on SPARC (single-board) computers. To limit worm spread to so many personal computers and
risk, only the control consoles were converted to commercial and public networks in May 2017. MoD
Solaris; the central nodes were kept in the same form negotiated an ongoing bespoke Custom Support
as the Initial Phase equipment. This threw up Agreement with Microsoft when general support
particular problems arising from a mixed architecture ended, but it remains unclear how this arrangement
of Intel and SPARC, such as endianism.38 is in patching the systems.
By 2000 the SMCS project was fully owned by BAE However, other suppliers have taken a different path.
Systems. In its 2003 Defence White Paper, the The consoles for the new Sonar 2076 supplied by
government agreed numerous improvements for Thales Underwater Systems for the Astute class
Royal Navy submarines, but no changes to the submarines, and which may be retrofitted to other
Vanguard-class submarines or to the Trident missile classes, are built with the Linux-based operating
system.39 It was assumed that the SMCS equipment, system rather than Windows.
maintained under a support contract with Ultra
Electronics, would outlast the service life of the

5.3 Navigation On the surface or at periscope depth, submarines
can use these methods to fix their position:44
Electro-magnetic radiation (light, infra-red, radio

Satellite navigation: global positioning system (GPS).
waves, wifi, etc.) does not generally penetrate far
into water unless it is particularly long wavelength ( Terrestrial radio-based navigation systems.
extremely low frequency) radio, and submarines
therefore cannot always rely upon it for accurate Radar navigation, normally used in friendly waters
navigation, avoiding obstacles and to detect threats. while entering and exiting ports. Radar can be
When on the surface, a global positioning system directed to reduce the chances of detection by
(GPS) can accurately determine latitude and third-party sensors.
longitude, but this system cannot work when the
Active sonar (similar to radar, active sonar
submarine is submerged below periscope depth.
systems are easily detected).
Underwater, the submarine uses inertial guidance
systems (electric and mechanical) that keep track of Pilotage — conventional system of navigational
the ship’s motion from a fixed starting point using aids in coastal and internal waters, (buoys,
gyroscopes. The inertial guidance systems are navigational markers, lighthouses, etc.), utilizing
accurate to 150 hours of operation and must be the periscopes when near the surface to obtain
regularly realigned by other navigational systems lines of position to plot a course.
(GPS, radio, radar, celestial or sea bed navigation,
as listed below). With these systems onboard, the Voyage Management System: utilizes digital
crew can accurately navigate to within several tens charts and data streaming from sensors and
of metres of the intended course. navigational devices to establish the vessel’s
position. Other information may also be entered
in manually to improve the quality fix or position.
To locate a designated target, a submarine can use
active and passive sound navigation and ranging
At depths below the periscope depth submarines
system (SONAR). Passive sonar involves listening to
determine their position using:45
sounds generated by the target. Active sonar emits
pulses of sound waves that travel through the water,
Dead reckoning from the ship’s gyrocompass,
reflect off the target and return to the ship. By
estimating speed and local ocean currents.
knowing the speed of sound in water and the time for
the sound wave to travel to the target and back, the Inertial navigation system is an estimated position
instruments can quickly calculate direction and source based upon acceleration and deceleration,
distance between the submarine and the target. pitch and roll as data sources.
Active sonar risks giving away the presence of the
Bottom contour navigation may be used in areas
submarine to other vessels listening in, though its
where detailed bathymetry data has been charted
direction of emission can be controlled, particularly
and there is adequate variation in sea floor
when navigating (directed at the sea bed), limiting
topography. This may use directed sonar or an
the spread of the sound wave and the chances of
electronic gravimeter that accurately measures
being picked up. Sonar systems can also be used to
the minute variations in gravity caused by changes
realign inertial navigation systems by identifying
in the sea bed.
known ocean floor features, and make more precise
real-time location calculations.

To calculate precise readings, submarine systems An attack on the propulsion systems could lead to
need to be synchronised. Should the malware be a variation in the power output, or could interfere
introduced during development or maintenance of with the navigation of the vessel.
the navigation components, it could disrupt internal
synchronisation data (such as time and date,
bathymetry data, calculations or sequence numbers). 5.6 Command and control of
Ultimately this could confuse navigation, divert the missiles and warheads
submarine from its original course or cause collisions.
The United States and UK draw their Trident II D5

missiles from a common pool at Kings Bay, Georgia.
5.4 Life support These missiles and their electronic components are
built and maintained in the United States by
Life support systems include air filtering, water contractors working with a complex web of
purification (the distillation system), temperature subcontractors, any one of which may be the victim
regulation and sanitization systems on board the of human intelligence and penetration. The security
vessel. They are critical for personnel survival and and maintenance of the missile pool and its
sustaining health over the longer term. Compromise associated systems is therefore under the sole
and damage to those systems could have severe control of the United States. The UK Trident
impact upon the crew and its operation of the warheads are maintained, refurbished and stored by
submarine. the UK Atomic Weapons Establishment at
Aldermaston and Burghfield in Berkshire. They are
transported over land by road to Royal Naval
5.5 Reactors and power Armaments Depot Coulport where they are stored
and loaded onto the Trident submarines prior to
supply patrolling. The missiles and warheads are vulnerable
to cyber interference at each stage of this process.
Nuclear submarines use propulsion systems that
include a nuclear reactor, steam turbines and The US Navy installed Permissive Action Link (PAL)
reduction gearing to drive the main propeller shaft.46 devices on all its ballistic missile submarines near
These systems also provide the electric power to the end of the Cold War to prevent unauthorised
operate the equipment on board and to power up the launch. Missile launch requires a code sent by the
storage batteries. These systems are managed and Chiefs of Staff on behalf of the US President. The US
monitored by sophisticated electronics and software, posture involves preparation for a nuclear exchange
including programmable logic controllers (PLC) and in which the President or his deputies remain in
computers, interconnected as a single logical charge and in communication with launching crews
network. at the moment of release. In contrast, the UK Ministry
of Defence chose not to install PALs on Vanguard-
Attacks on the nuclear power plant have the potential class submarines because the system is designed to
to be the most dangerous of all on an SSBN. threaten a devastating second strike response in the
Malware can propagate over the network of event that the capital and government has been
interconnected PLCs, corrupt data from sensors and eliminated. This is the purpose of the letter of last
can even deny access to infected systems. Damage resort, the idea being that an adversary would not
to any of these systems could have devastating seek to destroy the UK and its government in the first
consequences. place, knowing that the capacity to respond in
retaliation exists after destruction.
An attack could result in changes to power
generation, or even reactor overheating. It is important to point out that the electronic missile
control systems are entirely separate from those
If the entire power battery unit is disabled, the
running the submarine. The mechanical trigger that
vessel’s systems will rely directly and exclusively
launches the Trident missile is modelled on a Colt 45
upon the reactor.

Peacemaker pistol. This mechanical component Those familiar with the systems following the
ensures the standard launch procedure itself is developments speculated that the most likely cause
secure from cyber spoofing. However, there is scope was a failure in the guidance systems that are being
for spoofing on the communication and chain of replaced as part of the Life Extension Programme of
command side of the firing chain, and also on the the missiles. 50
But the failure could have several
other side of the launch, between the trigger and the explanations, including the aging of the guidance
missile. If the control software of the missile or the components or failures in the new, under-tested
warheads is compromised there could be an components. It was also consistent with the injection
unauthorised launch, premature detonation inside of malware into the failing component or into the
the launch bay or during missile flight, corruption of system transmitting telemetry data from the missile.
the flight control data, unauthorised retargeting or In other words, if there had been a hack, this is
simply interruption of launch. possibly what it would have looked like. There is no
strong evidence that has been presented either for or
Missiles are deeply complex and involve a large against such a conclusion.
number of electronic components, including
guidance systems, firing and rocket control systems
and the electronics involved in the re-entry vehicles 5.7 Advanced persistent
and warheads themselves. With missiles, even more
threat
so than for submarines, if any one of these
components malfunctions it could cause a
An advanced persistent threat (APT) is a set of
catastrophic failure. Rocket science is highly
stealthy and long term continuous cyber-attacks.
complicated. All missile development programmes
These would need to be performed by an organized
have involved significant failures in their early years.
and well-funded group of high level cyber experts, if
When a missile fails, there are any number of
they are to affect Trident’s operations. APTs, being
explanations.
costly and requiring a high degree of secrecy over a
protracted time period, usually target critical private
The speculation, first broken by David Sanger and
or public entities for big business, political or military
William Broad in the New York Times in March 2017,
motives. “Advanced” signifies sophisticated
that a US cyber hacking programme could have been
techniques using malware to exploit vulnerabilities in
behind the recent spate of failures in the North
systems. “Persistent” signifies continuous monitoring
Korean missile tests, has been controversial.47
of the external command and control system and
Several analysts have disputed the claims on the
extracting data from a specific target. “Threat”
basis that the failure rate with the new missiles is
indicates human involvement with particular intent.
consistent with the record in other missile
programmes, and the challenges the United States
Recognised APT attack vectors include infected
has experienced in penetrating the North Korean
media, supply chain compromise and social
programme. 48
However, this story highlights the
engineering (exploiting group psychology
exposure of all states’ missile development
weaknesses), to place custom malicious code on
programmes to foreign cyber interference.
one or multiple computers for specific tasks and to
remain undetected for the longest possible period
When HMS Vengeance in June 2016 completed its
while collecting data and readying for a future attack.
shakedown exercise off the coast of Florida after
mid-life refurbishment, it fired a D5 missile recently
In a typical civilian scenario, attackers seek to obtain
picked up from the common pool in Kings Bay. Just a
unauthorised access to confidential data, cause
few weeks after the shakedown the UK Parliament
denial of service, collect valuable information,
voted in favour of renewing the system. But it was
banking credentials databases, in some cases even
only in January 2017 that the incident was made
to cause physical damage to systems and facilities.
public by the Sunday Times.49 It was reported that the
Unauthorised access to systems can be also
telemetry data from the missile contained anomalies
obtained by exploiting bugs, errors, invalid inputs,
and the missile had to be destroyed.
misconfiguration, default settings, etc. Using

sophisticated APT techniques, intelligent intruders 35. Zhuo Jiang, Qian W, Hewu Li, ‘NTCP: Network Assisted
TCP for Long Delay Satellite Networks’, 2016 IEEE/CIC
may remain undetected within an organisation’s
International Conference on Communications in China,
systems for months, concealing their presence with (27-29 July 2016), http://bit.ly/2rv15SN
the noise of a busy network. Insiders are particularly 36. Nate Anderson, ‘Confirmed: US and Israel created
difficult to spot because many of their operations may Stuxnet, lost control of it’, Law and Disorder, (1 June
be legitimate, while a small but significant part of 2012), http://bit.ly/2n7OGWE
their activity is harmful. 37. BAE Systems, ‘Submarine Command System Next
Generation’, http://bit.ly/2pXfvdR
38. Intel architecture is little-endian and SPARC is big-
Attribution is a sophisticated challenge, particularly endian. Endianism refers to the conflicting methods by
as attackers often confuse by using another which hexadecimal memory is stored in the memory as
country’s language or deliberately mashing up their bytes.
39. House of Commons Defence Committee: Written
English.51 Images, text files with specific quotes, IP
Evidence, Session 2002-03, http://bit.ly/2q06Cj1
addresses or hardware brands could all be
40. Ministry of Defence, The Royal Navy Handbook, Conway
calculated to mislead investigators and plant the Maritime Press, (2003)
blame elsewhere. Successful false flag operations 41. Lewis Page, ‘Royal Navy Completes Windows for
could trigger conflict or war directed at states Submarines Rollout’, The Register, (16 December 2008),
uninvolved in the original cyber intrusion. http://bit.ly/2rd0gyo
42. Bill Gates, as Microsoft’s Chief Software Architect, had
given sworn testimony under oath to the US Courts on
APT threats to the UK Trident command and firing this point. Civil Action No. 98-1233 (CKK), Direct
chain could override security protocols, potentially Testimony of Bill Gates, Defendant’s Exhibit 1507, (22
transferring some control of communications in a April 2002), paragraphs 207 to 223.
crisis to the attacking state without the prior 43. Adam Ingram MP, in an answer to Mike Hancock MP,
Written questions, House of Commons, 200036, 428
knowledge of Royal Navy command. One of the c165W, (01 December 2004)
more sophisticated scenarios would be to create a 44. ‘Navigation and Operations’, University of Kansas, Naval
series of false readings on the Human-Machine Reserve Officer Training Corps (2006)
Interface and jamming of communications, leaving 45. S. E., Hamn, ‘Coastal Piloting: Bottom Contour
the commanding officer of the vessel blind. Navigation (Seamanship)’, Trailer Boats, (1995); see
also Undersea Warfare- journal, No. 51 (June
2013)
29. Jason Fritz, ‘Hacking Nuclear Command and Control’,
46. Rolls-Royce, ‘Submarines Capability’, http://bit.
International Commission on Nuclear Non-proliferation
ly/2q07WSS
and Disarmament, (2009)
47. David E. Sanger and William J. Broad, ‘Trump Inherits a
30. VLF is defined as 30 - 300Hz, a wavelength of 1000 to
Secret Cyberwar Against North Korean Missiles’, New
10,000 km. LF as 300 - 3000Hz, a wavelength of 100 to
York Times, (4 March 2017), http://nyti.
1000 km.
ms/2lJUOQA
31. John Ainslie, The Future of the British Bomb, WMD
48. Jeffrey Lewis, ‘Is the United States Really Blowing Up
Awareness Programme, (October 2005), p. 85
North Korea’s Missiles?’, Foreign Policy, (19 April 2017),
32. Scott Peterson, ‘Old weapons, New terror worries’, The http://atfp.co/2ooa4E9
Christian Science Monitor, (15 April 2004), http://bit.
49. Sunday Times, ‘No. 10 Covered up Trident Missile
ly/2pOR729
Fiasco’, Sunday Times, (22 January 2017), http://bit.
33. Bruce Blair, ‘Rouge States: Nuclear Red-Herrings’, The ly/2rv8LUW; see also Ewen MacAskill, ‘How did the
Defense Monitor, Vol. 33, No. 1, (January-February Trident test fail and what did Theresa May know?’, The
2004); Bruce Blair, ‘Why Our Nuclear Weapons Can Be Guardian, (23 January 2017), http://bit.ly/2jhLVyW
Hacked’, The New York Times,
50. Sunday Times, ‘Revealed: Trident’s faulty guidance’,
(14 March 2017), http://nyti.ms/2ruWTD2; Rosetta in the
Sunday Times, (29 January 2017), http://bit.
UK, ‘The Open University Joins Forces with BAE
ly/2qvFr33
Systems to Harness Rosetta Know-how for UK’s Newest
Submarines’, http://bit.ly/2pOXt1e 51. See a blog from someone claiming to be from the
Shadow Brokers, ‘OH LORDY! Comey Wanna Cry
34. Ultra High Frequency (UHF) is between 300 MHz and 3
Edition’, available in http://bit.ly/2qmLzLa
GHz; Super High Frequency (SHF) between 3GHz to 30
GHz; and Extremely High Frequency (EHL) is 30GHz to
300GHz

Disrupting UK SSBN
operations directly
Memo Dated: 6 January 2017
Mission: To compromise the operation of the submarine, gather intelligence data, divert the submarine from
its original course or disable its ability to fire
Objective: Infiltrate the submarine, and establish the means to interrupt operation
Method 1: Introducing malware into the submarine’s systems, its controlling computer network and the systems
controlling missile firing. One of the options we have is to create a “Backdoor” that could be activated via a
communication link (or under predefined circumstances) and transmitting a radio signal through covert channels (e.g.
injecting hidden bits of data into the standard radio messages in both directions). For this to function we will require a
receiver (“listener” - a malware in the communication facility on land) to relay data to Naval Intelligence in Transnistria.
We should also aim for the capability to transmit commands to the submarine through covert channels to provide the
capability to control our malware remotely, alongside packet data [the original communications] transmitted to the
submarine by the Royal Navy. This method will require hardware to be added, or for our agents to modify hardware
destined for incorporation into the submarine during maintenance or overhaul.
Naval Intelligence assets in the UK will need to infiltrate suppliers in order to maximise our chances of
compromising the Dreadnought programme early in its manufacture stage.
Method 2: Any personal computer may have a compiler installed (If the operating system is based on
Windows. Unix/Linux based systems already have compiler installed by default). Our intelligence asset within
the Vanguard gold team will need training up with instructions on writing the code. He will be able to design,
compile, deliver and deploy the malware inside the vessel whilst on patrol, and be able to control and monitor
the malware. This method can be used to map the patrol course of the submarine using the data from the
infected internal network, giving us valuable intelligence for future patrols.
Method 3: Physically introducing long term malware into control systems, similar to Stuxnet, that could distort
data from the sensors in a controlled manner to confuse submarine command, communications, navigation and
missile targeting, or be triggered when the submarine engages in activity consistent with a launch sequence.
The malware that targets control systems matching with those onboard the submarine (any system
connected to critical control systems), can be used to infect control systems within the vessel. Sophisticated
cross-platform malware may operate on multiple control systems and multiple operating systems.

6. Implications Of These Vulnerabilities
Perhaps the most likely form of attack would target critical systems on
the submarine: reactor operations, missile control or the stealth of the
submarine. Other systems could be targeted, such as internal
communications control stations, water purification systems, oxygen level
controllers or sanitation systems, to neutralise the submarine’s operation.
Cyber-attack techniques might be used to interfere The cyber threat to the Vanguard and Dreadnought
with communications to and inside the submarines, submarines cannot be considered an isolated
or to broadcast from the submarine and thereby give challenge. Technologies are advancing at a rapid
away its position; they may either jam (or otherwise and unpredictable pace and present numerous
prevent) the exchange of messages and data, or challenges to current UK military doctrine and
create misleading or incorrect information. The equipment, a problem that can only get worse. Many
worst-case, though highly unlikely, scenario would be of these augment new threats associated with the
unauthorised missile launch (by stealing and cyber domain. The spread and mounting capability of
transmitting launch authorisation codes to the ballistic missile defences, as well as advances in
submarine), or spoofing a nuclear attack. This type of automated and autonomous robotics and
attack would require the most sophisticated, highly engineering (such as underwater drones, aerial
skilled and resourceful hackers working in drones with diving capabilities, etc.), make guarding
combination with an extensive intelligence operation, classified intelligence about stealth technologies,
probably including a so-called “false-flag” operation patrol areas, missile and warhead specifications and
(a major concern due to the problems of attribution of performance data as important as ever and more
cyber-attacks). difficult. The ever-increasing complexity and
sophistication of the control systems upon which the
When on operations, submarines are generally prone submarine, personnel, missiles and warheads rely,
to infiltration and covert surveillance, and in war and makes security of the supply chain and particularly
crisis they are vulnerable to being disabled, software upgrade and updates of paramount
damaged or retargeted by surprise. In other words, importance.
submarines could be widely compromised in
peacetime without anyone knowing, and their Submarines have been assumed to be the most
operations explicitly impacted only during conflict. secure, stealthy, credible and reliable platform
Any electronic interference in the middle of a crisis available since the 1960s. With the latest emerging
could be highly destabilising, not least because crisis malware propagation techniques, the security of UK
involves stress, confusion and often poor decision submarines on patrol is less assured. They may
making. Indeed, cyber interference could make it already have been compromised, but in future
increasingly difficult for all those involved to separate confidence must surely be more uncertain.
malfunction from alerts or attack (particularly if this
also involved denial of service attacks), and
incentivise early missile launch.

7. Counter Measures
Rigorous cyber defensive measures are an essential response to the

growing threat; at every point of operation and intervention:
development, construction, patrol and maintenance. They require very
expensive state of the art detection technologies and simulation
exercises to respond to all potential cyber-attack scenarios.
Cyber security is no trivial task when there is a Physical site (e.g. area subject to flood, unreliable
complex network of hundreds of private commercial power source);
suppliers, many of which it must be assumed have
Organizational (e.g. lack of regular audits, lack of
weak security controls in place. The problem for
continuity plans, lax security protocols).
those that are responsible for cyber security is that
they have to anticipate every possible vulnerability,
Any risk management processes entail prioritisation.
and engage in offensive cyber operations
The Common Vulnerability Scoring System is an
themselves against potential attackers in order to
open framework for communicating the
gather prior intelligence concerning methods,
characteristics and severity of software
intention and attack vectors. It rapidly becomes a
vulnerabilities.53 Vulnerabilities can be categorized in
continuous and active cyber conflict in which all sides
order to develop an adequate response by severity,
attempt to penetrate each other’s systems.
as exploitable and non-exploitable, or as server side
and client side. Responses include adding a patch,
The first step is to assess and classify the
mitigating the risks and remedying the vulnerability.
vulnerabilities. Vulnerability is all about the
intersection of three elements: the existence of a
Access to the internet and the use of wifi and
system susceptibility or flaw, an attacker gaining
bluetooth on board during patrol is strictly forbidden
access to that flaw, and then an attacker developing
for all crew members. Computer systems and
their capability to exploit the flaw. Vulnerabilities are
networks devoted to morale, welfare and recreation
classified according to the asset class they are
are isolated from mission critical systems and
related to:52
protocols in place to minimise the chances of cross-
infection between systems. Personal computers and
Hardware (e.g. susceptible to humidity, dust,
phones are not allowed on board, and only
soiling, unprotected storage);
specifically designed devices are in use.54 Ideally.
Software (e.g. insufficient testing, lack of audit But if the revelations of crew member McNally in
trail); 2015 have any truth to them, such protocols may
only operate on paper. Maintaining high vigilance
Network (e.g. unprotected communication lines, and security priority on patrols that last several
insecure network architecture); months and where trust builds up within crews is a
very tall order.
Personnel (e.g. inadequate recruiting process,
inadequate security awareness);

“Cyber security is no trivial task when there is a complex network
of hundreds of private commercial suppliers, many of which it
must be assumed have weak security controls in place... It rapidly
becomes a continuous and active cyber conflict in which all sides
attempt to penetrate each other’s systems.”
The next generation of SSBN will require a team of 52. ISO/IEC, “Information technology -- Security techniques-
Information security risk management”, ISO/IEC FIDIS
cyber security experts, employed both remotely and
27005:2008
on board, who perform 24/7 monitoring and control.
53. FIRST, ‘Common Vulnerability Scoring System, V3
They will need to monitor all external and internal Development Update’, (10 June 2015), http://bit.
communication. The internal protocols for routine ly/1L4hNz7
internal checks while on patrol will need to be 54. Though there have been reported breaches of these
updated regularly. protocols; Colin Daileda, ‘U.S. Navy Debuts E-Reader
Without Wi-Fi, Which Is Perfect for Submarines’,
Mashable UK, (May 7 2014), http://on.mash.
If a communication channel is encrypted and bi- to/2pXADR3
directional, an attacker can actively eavesdrop by
intercepting an open key exchange message (during
the initiation of the communication channel) and
retransmit the message while replacing the
requested key with his own. As the submarine does
not broadcast communication signals, this type of
attack is only applicable in systems that go through
the process of establishing the full communication
channel (protocol procedures, such as “handshakes”
and key negotiations) in the Command and Control
Centre. When this happens, it leaves a trace. For
example, when attackers perform ARP (Address
Resolution Protocol) spoofing to send or receive
communications, trace elements are left on the
routing devices. It is then possible when detecting
these traces to conduct counter offensive cyber
operations against the attacker.

8. Future Related Trends
The maritime world is moving towards a more demanding techno‑military

strategic environment for submarines in which cyber is a key part,
and this will play an increasingly influential role in decisions over the
UK nuclear deterrent in the years ahead.
Military systems will be highly networked to the space of a year or two.58 Technology involved in
communicate, intercept and control vast swathes of the smart phone is highly relevant to military
territory, at sea and in cyberspace; stealthy technology, including robotics and sensing, that
submarines will be an anomaly attempting to could enable interception and tracking of submarines.
remain ‘off the grid’. The development of civil technologies is starting to
outstrip and determine the application of technology
Development, procurement, testing, deployment and on the battlefield, largely because the market and
installation of SSBN systems, including electronic related investment in R&D is so massive.59
control systems, take years before the submarine
starts its first patrol. The Blair government announced Work on the bespoke software for a submarine’s
its decision to start the concept phase of SSBN command and control system is developed alongside
replacement in December 2006, stating that the the hardware choices made throughout the design
process would take 17 years and that the first and construction of the submarine. By the time the
submarine would be available on patrol in 2024.55 The submarine starts active service the technologies on
Initial Gate, when teams started detailed designs for board will be out-dated by a number of generations,
the system, was four years later in 2011.56 A decision and may already have a large number of
was announced in the November 2015 Strategic vulnerabilities discovered by others despite their
Defence and Security Review that the submarines classification. These discoveries can be made by
would be constructed in a modular manner, and attackers when penetrating other (less secure)
physical work to being constructing the main body of operating, software and hardware systems using
the first submarine commenced in the Autumn of similar code (programming language, framework,
2016.57 This submarine is not now expected to start kernel, etc.), or more directly by attackers targeting
patrolling until the early 2030s, a full quarter century the SSBN systems themselves. Maintenance,
after the decision was first taken to move on this updates and upgrades require further time and
project, and 15 years after the designs were finalised funding, and themselves become sources of
and construction on the submarine began. vulnerability and a means to penetrate the cyber
systems upon which the SSBN depends.
Very basic versions of the predecessor to today’s
smart phone were only just coming onto the market Maintaining strategic superiority in an age of mass
15 years ago. The iPhone 6, launched in September surveillance and data sharing, and rapid
2014, can process instructions 2000 times as fast as development and proliferation of technology and
the computer on board a state of the art US F22 processing power across civil and military sectors, is
Raptor aircraft, the most sophisticated fighter aircraft a major challenge fraught with uncertainty and
on combat duty in the US Air Force today. Each complexity. Information that previously was available
generation of smart phone is overtaken by the next in only by the means of military reconnaissance is now

publicly available to any person with any infiltrate the vessel. Surveillance nano drones, nano
communication device. Military reconnaissance itself microphones and communication devices,
has developed extraordinary capabilities that improve miniaturization of computer systems that can fit in a
year by year. Its ability to detect and neutralise watch, ultra-high capacity data storage devices will
submarines, using a network of capabilities including bring multiple benefits, but also increase the threat of
satellites, aircraft and other maritime platforms; interception and unauthorised manipulation.
unmanned vehicles in the air, on the surface and
under water; and a variety of static and mobile sensors When the Chinese seized a US underwater drone in the
and communication relays is also rapidly developing, South China Seas in December 2016 the incident
using networks of small and cheap platforms deployed surfaced a rapidly-expanding arms race in underwater
at scale and quickly replaced by newer technologies. It surveillance and combat capabilities.63 Aerial Drones
may at some point in future, for example, be possible with diving capabilities are in development.64 A number
to deliver proximity transmitters and hacking devices of sensing and communications technologies are
to the hull of the vessel to infiltrate the submarine rapidly improving and will be deployed on unmanned
onboard network even under water. vehicles across the maritime space in a system of
systems that will have game-changing impact upon the
Underwater communication relays and networks are ability to hunt submarines.65 This technology will be
being deployed that will increase the interconnectivity further developed for rapid underwater payload delivery
of the military systems and facilitate detection and or underwater payload exfiltration from any location in
interception of submarines, including by cyber-attack.60 the world, threatening the viability of future submarines.
The submarines themselves may be able to
communicate more frequently with command facilities 55. Ministry of Defence, ‘The Future of the United Kingdom’s
Nuclear Deterrent’, Defence White Paper (December 2006)
ashore, but this will expand the possibilities for cyber-
56. Ministry of Defence, ‘The United Kingdom’s Future
attacks, and making it more difficult to apply
Nuclear Deterrent: the Submarine Initial Gate
countermeasures against remote hacking. Parliamentary Report’, (May 2011)
57. National Security Strategy and Strategic Defence and
Communications based on optical data transmission Security Review 2015, (November 2015)
(fast-blinking LEDs) can detect undersea vessels.61 58. David Hambling, The Inescapable Net: Unmanned Systems
in Anti-Submarine Warfare, British American Security
Communication will continue to be a vulnerable part of
Information Council, (13 July 2016), http://bit.ly/1RC55KE
command and control, relying heavily on
59. David Hambling, Swarm Troopers, how small drones will
interconnectivity and network architecture. Radio conquer the world, Amazon (2015)
frequency interception remains a possibility, as does 60. The DARPA tactical undersea network is one example;
spoofing. The submarine may become increasingly Shelby Sullivan, ‘Tactical Undersea Network Architectures
(TUNA)’, http://bit.ly/2rvbiP3
vulnerable to radio frequency interception, or possibly
61. Kate Yandell, ‘The Navy’s New Underwater Internet’,
even the use of sonar to steal or inject data.62
Gizmodo, (3 July 2014), http://bit.ly/2qvxdbc
62. Martellini M., Abaimov S., Gaycken S. and Wilson C.,
The construction, assembly and maintenance of Information Security of Highly Critical Wireless Networks,
submarines is ever more automated and robotized, Springer, (2017); Geoffrey Ingersoll, ‘
US Navy: Hackers “Jumping the Air Gap”
and a far greater proportion involves complex
Would ‘Disrupt the World Balance of Power’, Business
electronics. The nuclear reactors themselves are Insider, (November 2013), http://read.bi/2qWhfbF
becoming more sophisticated and rely on complex 63. Ben Blanchard and Steve Holland, ‘China to Return Seized
interconnected devices and electronic networks. U.S. Drone, Says Washington “Hyping Up” Incident’,
Reuters, (18 December 2016), http://reut.rs/2q0lnlR; http://
bit.ly/2r0jTNn; http://bit.ly/1SPtBJ9
Polymer electronics and 3D printed weaponry, 64. http://bit.ly/2r0Akta; Navy League 2017, NRL furthers Flying
undetectable by metal scanners, will require specific Sea Glider effort, IHS Jane’s 360, http://bit.ly/2pXiPpw
security measures. Nano technologies are being 65. BASIC and Pugwash have several publications in
developed to improve surveillance, espionage and production in mid 2017 by Miguel Batista. See also David
Hambling, The Inescapable Net: Unmanned Systems in
warfare. Advancing nano and bionic technologies,
Anti-Submarine Warfare, British American Security
implantable and subdermal data storage and Information Council, (13 July 2016), http://bit.
communication devices, all offer means to covertly ly/1RC55KE

Disrupting guidance
systems for Trident
missiles
Memo Dated: 21 December 2015
Mission: To develop a capability with multiple dimensions to disrupt communications and guidance of
Trident II D5 missiles.
Objective: Complete satisfactory infiltration of the D5 supply chain, insert our hardware and software
into components, and set up a mixed system of autonomous and remote triggers to disrupt, perhaps
even control.
Disrupt guidance and telemetry signals using autonomous malware. Naval intelligence has
operatives in two key sub-contractors involved in the design and supply of components for the guidance
system as part of Lockheed Martin’s life extension programme for the D5. These components are in the
middle of testing and integration, and our operatives have been successful in injecting new forms of
malware that are under development under the guidance of our DEVCOM_2 team. We are now ready to
test the operation of this installed malware in a forthcoming Trident II D5 test by switching to a green light.
Should this test be successful, we plan to expand operations in this direction in order to have multiple
means of disrupting launch, trajectory and warhead separation, and to explore options for disrupting the
fusing of the warhead itself.
intercept signals to confuse communications, perhaps even to take control of the missile. Once
the missile leaves the water our malware on board can communicate via satellite or maritime assets
[ships, aircraft, unmanned vehicles] with naval command. Malware currently in development and
connected to the guidance system on board the missile will, on launch, trigger a transmitter using
variable, cloaked frequency that will enable remote control via satellite or assets nearby. This will enable
naval command to alter the trajectory of the missile, block or disrupt communications between the missile
and US Naval Command and the Trident submarine, or trigger the warhead fuse into premature activation.

9. Conclusion
This report clearly demonstrates that the UK’s Trident system, though
benefiting from the highest classification of security and attempts to
shore up weaknesses, remains vulnerable to cyber-attack.
The potential cyber-attack vectors cover three life rigorous testing and inspection routines, simulation
stages of submarines: construction, patrol and exercises and “offensive” security tests of various
maintenance. Each of these stages contains specific aspects related to the cyber and information security.
vulnerabilities to be investigated, assessed and All this also acknowledging that such activities
monitored. The defensive measures should include themselves can also be the source of cyber-threat.
physical and cyber-security solutions with the use of False economies when choosing operating systems,
the state of the art detection technologies and software and hardware should be avoided.
simulation exercises to respond to all
potential scenarios. It was announced in the 2015 Strategic Defence and
Security Review that the Successor submarines
In the development stage, one of the attack would be constructed in a ‘staged investment
scenarios is that the sensitive design, or operational programme’, or a modular fashion, which may give
secrets related to the UK nuclear weapons system, greater flexibility in the manufacturing.66 Maintaining
could be compromised through cyber espionage. maximum adaptation in these phases will be critical,
The construction period also entails probability of the but is a huge challenge. There is also a challenging
malware being installed into the electronic devices to trade-off between nimble, flexible and responsive
be activated in patrol. During the manufacturing and systems, and the essential security, including cyber-
assembly of the submarine and internal systems, security, that could reduce the risk of infiltration or
predetermined security flaws may be introduced, to theft. Among the myriad potential threats which need
be potentially exploited in the future. Otherwise, to be continually assessed throughout are wireless
malware may be uploaded into a device or a network communication technologies, networks of unmanned
of devices, for it to conduct an attack autonomously maritime vehicles capable of detecting submarines
at a predefined moment or under specific and possibly delivering electronic payloads, nano
circumstances. The patrol phase relies on internal devices, polymer electronics and 3D printed weaponry.
and external communication and network of systems,
which are vulnerable to internal cyber-attacks. The There should be no doubt that whilst the issues
submarine can be infiltrated with autonomous outlined in this report have strands of both continuity
malware when undergoing maintenance or delivered (anti-submarine warfare, attempts to compromise the
via storage devices or even via remote operations of adversaries’ military activities, ever-
communication channels. unfolding technological change) and disruption
(emerging dominance of cyber as a form of warfare
Another risk is connected with the high speed of and disruption, re-emergence of doubt around the
technology development. Any electronic device ability of leading nuclear weapon states to deliver their
installed in submarines today is soon outdated. A nuclear payloads on an adversary), there are some
team of permanent cyber-security experts will be crucial uncertainties over the consequences emerging
needed online strengthen defence both internally for nuclear doctrine, deterrence and stability.
and externally. Updates of software and hardware
should be implemented on a regular basis, as well as

This report has focused on the cyber vulnerabilities of increasingly expensive nuclear deterrent systems
the UK’s nuclear submarines, but of course, cyber requiring ever more sophisticated cyber defences may
insecurity is relevant to all forms of military equipment, be replaced by other means to achieve deterrence
and particularly for other nuclear weapon delivery and other objectives that lie behind deployment.
systems. It has been said that because of the
operational air gap, submarines are relatively more Just as in counter-terrorist operations, recognising
secure than other platforms. This may be true, but the nature and scale of the cyber threat, systems
there are particular consequences for ballistic missile managers have to consider deterrence, resilience
submarines because of their mission as an assured and mitigation as well as prevention. When
second-strike capability. These have been assumed to developing civilian cyber security systems, it is often
be effectively invulnerable to first strike attack, and to deemed good practice not only to strengthen
have stabilised strategic relations between the United protection but also to assume that the network is
States and the Soviet Union, then Russia, for over half already compromised and act accordingly. In other
a century. If confidence in these platforms is harmed words, as well as having in place a first line of
then this could have unpredictable consequences defence by prevention, network architecture and
upon strategic stability, and crisis instability that need protocols need to be robust. This may involve back-
to be studied more closely. up and recovery procedures, responses to intrusions,
contingency plans that minimise damage, and forms
When an attacker successfully penetrates a nuclear of offensive cyber operations.
weapon system they may have knowledge of that
achievement and the nature of the compromise when There is a particular problem associated with the
defenders do not. It may mean that one state thinks nature of cyber warfare and the trends that appear to
its adversary’s nuclear deterrent is successfully favour offensive over defensive operations as
compromised in the run up to a crisis, when that systems become more complex and integrated,
adversary believes it is operational. One excellent hacking tools proliferate, and states allocate more
example of this was the reported use of Suter by resources to their offensive cyber capabilities.68
Israel to compromise Syrian air-defences and enable Those responsible for cyber security themselves
the attack on the Syrian reactor in 2007.67 Incomplete need to engage in offensive cyber intelligence
knowledge in the cyber domain could encourage operations in order to track the intentions,
overconfident state leaders overplaying their hands capabilities and priorities of any attackers. This
in a crisis. drives a cyber-security dilemma, in which
adversaries compete to penetrate each other’s
Commanders may be less confident of the readings of nuclear weapon systems in part to secure their own.
their instruments, and experiencing denial of service
attacks, may be more reluctant to move to alert status The overall impact is one of far greater instability and
and fire when presented with what appears to be a uncertainty of outcomes. When considering the
nuclear attack or orders from their commander in chief. consequences of nuclear weapons use, and the
This may strengthen the informal nuclear taboo that widespread recognition that once a nuclear
has developed since the Cold War, with uncertain exchange starts between nuclear armed states it is
impact upon the salience of nuclear deterrence. More very unlikely to remain limited, is this really an
likely is that the pressures on commanders to fire acceptable future?
early whilst they still have control of their systems will
add instabilities in crisis situations and the likelihood 66. National Security Strategy and Strategic Defence and
that leaders will fear strategic surprise. Security Review 2015, (23 November 2015),
p. 36, http://bit.ly/1Nnq2ZF
67. Andrew Futter, ‘Cyber Threats and Nuclear Weapons’,
The greater uncertainty may mean that states relying RUSI Occasional paper, (July 2016), p.24, http://bit.
upon nuclear deterrence decide to deploy more ly/2qvhgBP
systems with greater variety in order to maintain 68 Joseph Menn, ‘90 percent of federal cyber budget used
for offensive ops’, Fifth Domain Cyber, http://bit.
reliability. On the other hand, it could have the
ly/2qx7dfT
opposite effect, leading states to conclude that

“The WannaCry worm attack earlier this month
affecting 300,000 computers worldwide,
including vital NHS services, was just a taste of
what is possible when cyber-weapons are stolen.
To imagine that critical digital systems at the
heart of nuclear weapon systems are somehow
immune or can be confidently protected by
dedicated teams of network managers is to be
irresponsibly complacent. When states invest
hundreds of billions of dollars in offensive nuclear
weapon systems, the incentives are there
amongst adversaries to develop capabilities that
could neutralise that threat. Leading states are
now investing billions of dollars in their offensive
cyber capabilities, degrading confidence in the
effect of those nuclear weapon systems, in the
strategic balance and crisis management.
This report assesses those vulnerabilities.”
Lord Browne of Ladyton, former Secretary of State for Defence (2006-8),

is Vice-Chairman of the Nuclear Threat Initiative in Washington DC and
Convener of the European Leadership Network for Multilateral Nuclear
Disarmament and Non-proliferation
British American Security

3 Whitehall Court
Westminster
London SQ1A 2EL
Charity Registration No. 1001081
T: +44 (0) 20 77663465

www.basicint.org

Hacking UK Trident

Uploaded by

Copyright:

Available Formats

Hacking UK Trident

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Hacking UK Trident

Uploaded by

Copyright:

Available Formats

HACKING

Please direct all enquiries to the publishers.

Paul Ingram is BASIC’s

This paper reviews the growing potential for cyber-attack

subcontractors. contain this hit on confidence. This will inevitably

From: [Foreign] Naval Intelligence, Unit 6B

5. Vanguard’s Electronic Vulnerabilities 21

6. Implications of These Vulnerabilities 30

Cyber threats have co-exited with the emergence and

8 HACKING UK TRIDENT: A Growing Threat

The WannaCry Ransom: $300 to $600.

cyber attack Backdooring: The worm loops through every RDP

9 HACKING UK TRIDENT: A Growing Threat

Whilst there has been much talk of the development

10 HACKING UK TRIDENT: A Growing Threat

Cyber warfare involves “actions by a nation-state to penetrate another

11 HACKING UK TRIDENT: A Growing Threat

12 HACKING UK TRIDENT: A Growing Threat

2007 BlackEnergy Targeted Denial of Service on HTTP-based 2008

2009–2010 Stuxnet Centrifuged compromised in ICS override 2010

2010 BlackEnergy2 Cyber-Fraud in Ukrainian Rootkit, credentials 2010

2011 Duqu Espionage in the Middle East Information gathering 2011

2012 Flame Espionage in the Middle East Modular malware 2012

2015 Irongate Detected on VirusTotal by Man-in-the-Middle 2016

2017 WannaCry Over 300 000 Computers Ransomware 2017

13 HACKING UK TRIDENT: A Growing Threat

Autonomous Denial of Service (DoS) of the internal

A cyber-attack may target the submarine, command

14 HACKING UK TRIDENT: A Growing Threat

15 HACKING UK TRIDENT: A Growing Threat

16 HACKING UK TRIDENT: A Growing Threat

Displacement: 15,900 tonnes

Top speed: 25 knots (though at this speed the submarine

In service: 1993 to present and planned to early 2030s

Armament: Spearfish torpedoes and up to 16 Trident II D5

Power: Rolls Royce PWR2 nuclear reactor

17 HACKING UK TRIDENT: A Growing Threat

The nuclear ballistic missile submarine is perhaps the most sophisticated

and complacent. introduced GSMem, a method for exfiltrating data

18 HACKING UK TRIDENT: A Growing Threat

4.3 Supply chain and

19 HACKING UK TRIDENT: A Growing Threat

20 HACKING UK TRIDENT: A Growing Threat

All critical systems in a vessel are automated and controlled by its

Activity Critical system Examples of possible consequences

Life support xx Threat to human life and operation of the vessel.

Reactor xx Loss of control;

21 HACKING UK TRIDENT: A Growing Threat

22 HACKING UK TRIDENT: A Growing Threat

23 HACKING UK TRIDENT: A Growing Threat

24 HACKING UK TRIDENT: A Growing Threat

Electro-magnetic radiation (light, infra-red, radio

25 HACKING UK TRIDENT: A Growing Threat

The United States and UK draw their Trident II D5

26 HACKING UK TRIDENT: A Growing Threat

27 HACKING UK TRIDENT: A Growing Threat

28 HACKING UK TRIDENT: A Growing Threat

From: [Foreign] Naval Intelligence, Unit 6B

29 HACKING UK TRIDENT: A Growing Threat

30 HACKING UK TRIDENT: A Growing Threat