Wärtsilä FOS-Onboard

The core failure in Wärtsilä's FOS-Onboard software stems from the use of hard-coded cryptographic keys — a well-known and avoidable anti-pattern in secure software development. Hard-coded keys are inherently dangerous because any attacker who discovers them (through reverse engineering or a leak) gains a permanent, shared secret that cannot be rotated without a full software update. In this case, the consequences are severe: unauthorized firmware updates, arbitrary code execution, and credential theft on maritime operational technology (OT) systems. This matters enormously in marine environments where software integrity directly affects vessel safety and operational continuity. The incident underscores that cryptographic secrets must never be embedded in code and that OT vendors must apply secure-by-design principles from the earliest stages of development.