Persistent Firmware-Level Compromise in a Maritime Autopilot System

This work presents a demonstration of arbitrary Controller Area Network (CAN) message injection on a maritime National Marine Electronics Association (NMEA) 2000 network via firmware compromise. By reverse engineering a firmware update binary for a marine autopilot computer, we identify and modify low-level CAN transmission routines to inject spoofed messages, including rudder control commands and address claims. The attack exploits the absence of authentication and cryptographic integrity checks in the firmware update mechanism. An adversary with access to a chart plotter can deliver a tampered update via an SD card, causing the autopilot to accept and install the malicious firmware. Upon reboot, the compromised autopilot executes attacker-controlled code, enabling persistent and arbitrary CAN message injection. This work highlights systemic security deficiencies in embedded maritime systems and demonstrates the risks posed by unauthenticated firmware distribution in safety-critical navigation infrastructure. To the best of our knowledge, this is the first publicly demonstrated instance of firmware-based CAN injection in a maritime context.