Mapping the Maritime Attack Surface with LLM-Driven OSINT

TLDR: Maritime infrastructure is suffering from rapid, insecure digitization, leaving critical systems like NMEA/GNSS and vessel tracking portals exposed to the public internet. Researchers at DEF CON 2025 demonstrated an automated, passive OSINT framework using LLMs and the Model Context Protocol (MCP) to map these assets and identify high-impact vulnerabilities. Security professionals can now use this open-source toolkit to perform similar reconnaissance and prioritize remediation for their own organizations.

The maritime industry is the backbone of global trade, yet its digital security maturity remains stuck in the past. While shipping lines and port authorities have rushed to digitize their operations, they have frequently done so by layering modern cloud-based services over legacy IT foundations. This creates a massive, often invisible, attack surface. Attackers have already noticed this trend, as evidenced by the NotPetya fallout and recent ransomware incidents targeting major ports. The research presented at DEF CON 2025 confirms that the problem is not just theoretical; it is systemic.

The Mechanics of Passive Maritime Reconnaissance

Passive reconnaissance is the most effective way to map this ecosystem without triggering alarms. By leveraging indexed search engines like Shodan and ZoomEye, researchers can identify exposed maritime-specific protocols. The core of this research involves an automated framework that chains together OSINT tools—specifically SpiderFoot and BBOT—to enumerate assets and correlate them with known vulnerabilities.

The researchers introduced a novel approach using the Model Context Protocol (MCP) to bridge the gap between LLMs and these security tools. Instead of manually running scans, the framework allows an LLM to act as an agent, orchestrating the reconnaissance process through a standardized interface. This allows for a more sophisticated, multi-agent approach where the LLM can decide which modules to execute based on initial findings, effectively automating the "digging deeper" phase of a pentest.

Technical Vulnerabilities in the Wild

The findings from this automated mapping are alarming. Many maritime organizations are running outdated software that is riddled with known vulnerabilities. For example, the research identified instances of Apache HTTP Server running versions susceptible to CVE-2024-36475, a critical vulnerability that can lead to remote code execution. Furthermore, many systems were found running OpenSSH versions vulnerable to CVE-2023-48795, a protocol-level flaw that allows for prefix truncation attacks.

Beyond standard IT vulnerabilities, the research highlighted the exposure of maritime-specific protocols like NTRIP, which is used for high-precision GNSS positioning. When these systems are exposed without authentication, they become prime targets for manipulation. An attacker could potentially spoof GNSS data, leading to significant operational disruption. The lack of DMARC and SPF records across a large percentage of the scanned organizations also highlights a low baseline for email security, making these entities highly susceptible to phishing and sender forgery.

Automating Your Own Assessment

For a pentester, the value here is the ability to replicate this workflow. The researchers released their Marlin Cyber framework on GitHub, which includes the necessary MCP servers to integrate these tools into your own environment. If you are performing an engagement for a client in the maritime or logistics sector, you can use this to quickly identify the most glaring holes in their external perimeter.

The workflow is straightforward. You define your scope, and the LLM-driven agent handles the heavy lifting of service enumeration and vulnerability correlation. Because the framework is modular, you can easily swap out tools or add custom modules to suit the specific needs of your target.

# Example of initializing a passive scan via the MCP-enabled framework
# This assumes you have the MCP server configured for your chosen tools
$ mcp-client --target "example-port.org" --module "bbot_passive" --preset "fast"

Defensive Priorities for Maritime Infrastructure

Defenders in this space need to stop treating their OT and IT environments as a single, flat network. The most immediate priority is to identify and isolate internet-facing management interfaces. If a service does not need to be public, it should be behind a VPN or a zero-trust access gateway.

Hardening and patching are non-negotiable. The prevalence of end-of-life software in the maritime sector is a massive liability. Implementing a rigorous patch management program, specifically for internet-facing assets, will eliminate the majority of the low-hanging fruit that attackers are currently exploiting. Finally, ensure that basic email security controls like DMARC, SPF, and DNSSEC are correctly configured. These are simple, high-leverage controls that significantly increase the cost of an attack.

The maritime industry is currently a target-rich environment for anyone with a basic understanding of OSINT and automation. As these organizations continue to integrate more IoT and cloud-based systems, the attack surface will only grow. If you are a researcher or a pentester, the tools are now available to map this digital water. It is time to start looking at what is actually floating on the surface before someone else does.