Attacks/Breaches
12/16/2011
12:09 PM
50%
50%

Iran Hacked GPS Signals To Capture U.S. Drone

Exploit of well-known bug in drone's software made it think it was landing at an American airfield, not 140 miles inside Iran.

Iran recently captured a CIA batwing stealth drone by spoofing the GPS signals it received, fooling the drone into thinking it was landing at its home base.

The Christian Science Monitor, broke that news Thursday, after interviewing an Iranian engineer who's been reviewing the systems of the captured RQ-170 Sentinel drone, which was downed by Iranian forces on December 4 near Kashmar, which is about 140 miles inside northeast Iran.

"The GPS navigation is the weakest point," the engineer told the Monitor. Indeed, numerous researchers have warned that GPS signals are relatively easy to spoof, given that the related signal broadcast by satellites is relatively weak. Accordingly, the Iranians focused on spoofing the GPS data being received by the drone.

[ A nationwide broadband network is at risk due to GPS interference. See Lightsquared Disrupts Airplane Navigation GPS, Feds Say. ]

To make the drone rely only on GPS, however, first the Iranians jammed the remote-control communications channel used to guide the drone from its control center. "By putting noise [jamming] on the communications, you force the bird into autopilot. This is where the bird loses its brain," said the engineer. Notably, it's also much easier than trying to crack the encrypted remote-control communications channel.

With the drone relying solely on GPS to determine its latitude, longitude, altitude, and velocity, the Iranians then broadcast carefully spoofed GPS coordinates, which allowed the drone to land at what it believed was its home base. In reality, it landed well inside Iranian borders. The altitude of the spoofed location was slightly different, however, which ended up denting the drone's underbelly, as can be seen in video footage released by Iran.

Tuesday, the Obama administration appealed to Iran to return the drone, but voiced doubts that the country would comply with that request. At least one semi-official Iranian news agency also appeared to dismiss the request. Furthermore, the Swiss ambassador to Iran--who handles American interests with Iran--was summoned by Iranian officials on Thursday to account for "America's violation of the country's airspace with a spy drone," reported Haaretz.com.

U.S. officials have said the drone, which was under the control of the CIA, was conducting reconnaissance of sites that might be used for nuclear energy or weapons production. In a press conference this week, U.S. defense secretary Leon Panetta said that "important intelligence operations" such as the drone program would continue.

According to the Iranian engineer that spoke with the Monitor, Iran's takedown of a U.S. drone didn't occur overnight. Rather, its engineers have been studying drones since 2007, and especially since 2009, which is when the RQ-170 first deployed in Afghanistan. They also reverse-engineered the systems of two less-advanced drones that had been downed inside Iran in recent years, looking for exploitable vulnerabilities.

The revelations over Iran's GPS jamming capabilities mean that the country could be able to divert any GPS-guided missiles launched at targets inside its borders.

IT's spending as much as ever on disaster recovery, despite advances in virtualization and cloud techniques. It's time to break free. Download our Disaster Recovery Disaster supplement now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
EazyMoney
50%
50%
EazyMoney,
User Rank: Apprentice
1/24/2013 | 1:55:38 PM
re: Iran Hacked GPS Signals To Capture U.S. Drone
Before that the Video feed was being broadcast in real-time un-encrypted at one point and software was released to allow insurgents access to us military's birds eye view...
EazyMoney
50%
50%
EazyMoney,
User Rank: Apprentice
1/24/2013 | 1:52:54 PM
re: Iran Hacked GPS Signals To Capture U.S. Drone
In addition the drones have software that have been plagued by viruses that log each key stroke... even after cleaning the systems software the virus still reappeared... Worse yet the techs that worked on this issue didn't report it for weeks trying to fix but completely dumbfounded... Must run windows XP... LMFAO
EazyMoney
50%
50%
EazyMoney,
User Rank: Apprentice
1/24/2013 | 1:46:19 PM
re: Iran Hacked GPS Signals To Capture U.S. Drone
Seems that the GPS system wasn't designed to be secure... it's not encrypted and GPS signals can easily easily overpowered with false signals locally that overpower the signals from the satellites... This has been know for some time...
Tom LaSusa
50%
50%
Tom LaSusa,
User Rank: Apprentice
12/19/2011 | 8:13:53 PM
re: Iran Hacked GPS Signals To Capture U.S. Drone
I'm still trying to sort out why our military would willingly send out something they know has a exploitable vulnerability.

If the gov't knows the GPS is easily duped and manipulated, doesn't it stand to reason that you fix that before sending it out to recon an adversary that has the technological savvy to exploit it?

Each drone costs us what -- up to $10 million to build? How much would it cost to get some intelligent programmers in to combat the problem?

Tom LaSusa
InformationWeek
Bprince
50%
50%
Bprince,
User Rank: Ninja
12/17/2011 | 1:35:18 AM
re: Iran Hacked GPS Signals To Capture U.S. Drone
Surprised the drone doesn't have some sort of self-destruct or remote-destruct capability.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
5 Reasons the Cybersecurity Labor Shortfall Won't End Soon
Steve Morgan, Founder & CEO, Cybersecurity Ventures,  12/11/2017
Oracle Product Rollout Underscores Need for Trust in the Cloud
Kelly Sheridan, Associate Editor, Dark Reading,  12/11/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Gee, these virtual reality goggles work great!!! 
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.