Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Hardware Hacker Demos Zombie Drone Hijacker

The SkyJack drone automatically seeks out and hijacks other nearby Parrot drones. Will this mean trouble for Amazon's planned drone delivery fleet?

Military Drones Present And Future: Visual Tour
Military Drones Present And Future: Visual Tour
(click image for larger view and for slideshow)

Efforts to develop drones that can handle a number of routine tasks, such as restocking warehouse shelves or delivering parcels and pizza, keep garnering headlines. But what if hackers could hijack those unmanned aerial vehicles and turn them into "little zombie drones"?

In fact, that's the promise of a newly announced drone-hijacking program called SkyJack, which was developed by privacy and security researcher Samy Kamkar.

"SkyJack is a drone engineered to autonomously seek out, hack, and wirelessly take over other drones within WiFi distance, creating an army of zombie drones under your control," Kamkar said on his autonomous drone hacking project site.

"I developed a drone that flies around, seeks the wireless signal of any other drone in the area, forcefully disconnects the wireless connection of the true owner of the target drone, then authenticates with the target drone -- pretending to be its owner -- then feeds commands to it and all other possessed zombie drones at my will," Kamkar said. He also uploaded to YouTube a semi-gonzo basement demonstration of a target Parrot drone -- connected to his iPad -- being forcibly disconnected and compromised via his automated "drone strike" software.

[ Devices are replaceable; Mobile Security Is All About The Data. ]

To date, his SkyJack drone, which uses a Parrot drone that he's modified, is only able to hijack similar Parrot drones.

The project is surprisingly affordable; Kamkar said the cost of building a SkyJack drone is less than $400. The full list of required hardware includes a Parrot AR.Drone 2, which retails for about $300, plus a credit-card-sized Raspberry Pi computer (about $35) that runs Linux, an Alfa AWUS036H wireless transmitter (about $20) with 1000mW of broadcast power, and a USB battery pack. That power supply needs to remain relatively light, however, because the drone has a carrying capacity of only about 400 grams.

Parrot AR.Drone 2.0.
Parrot AR.Drone 2.0.

On the software side, Kamkar's SkyJack buildout calls for the aircrack-ng key-cracking program, which can forcibly disconnect a target drone's WiFi connection. After that happens, Kamkar's drone-strike software connects to the drone using the node-ar-drone JavaScript library, which can be used to communicate with and control any Parrot AR Drone 2.0.

Kamkar has released his SkyJack code on Github.

Once a drone has been compromised, Kamkar said his drone-strike software "starts actually recording images from the front-facing camera, as well, and you can watch that live." In addition, an attacker can remotely connect to the SkyJack drone to retrieve feeds of -- and control -- all in-range compromised drones.

Furthermore, using his drone-strike software, not all attacks need be launched from an aerial platform. "SkyJack also works when grounded as well, no drone is necessary on your end for it to work," he said on the project overview page. "You can simply run it from your own Linux machine/Raspberry Pi/laptop/etc and jack drones straight out of the sky."

News of the SkyJack project comes hot on the heels of Amazon publicizing tests it's been conducting with drones -- known as octocopters -- in its quest to one day deliver goods of up to five pounds by air, future FAA regulations permitting. Cue "Amazon Prime Air."

For the cynically inclined, that news was delivered in a 60 Minutes interview Sunday with Amazon CEO Jeff Bezos, which aired on the eve of Cyber Monday. That, of course, is a day cooked up by online retailers to urge consumers to buy more of their wares.

Timing aside, Wall Street is bullish on drone technology. According to Bloomberg, in the first nine months of 2013 venture capitalists invested a total of $40.9 million in drone startups.

With that level of investment, it's unlikely that even the efforts of hackers wielding autonomous drone hijacking software would ground investors' exuberance in drone technology.

Knowing your enemy is the first step in guarding against him. In this Dark Reading report, Integrating Vulnerability Management Into The Application Development Process, we examine the world of cybercriminals -- including their motives, resources, and processes -- and recommend what enterprises should do to keep their data and computing systems safe in the face of an ever-growing and ever-more-sophisticated threat. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
12/4/2013 | 8:44:02 PM
Re: Droning on drones
Cyberattack Tuesday?
David F. Carr
50%
50%
David F. Carr,
User Rank: Strategist
12/4/2013 | 6:12:13 PM
Re: Droning on drones
In just a few years, we'll go from Black Friday to Black Hawk Down Friday
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
12/4/2013 | 5:43:01 PM
Re: Droning on drones
Oh, come on! The possibilities are so cool. One could build a huge drone army in secret to defend the republic ... oh, wait, those are clones.

Seriously, while it is premature, for once it would be nice if the FAA had some foresight into potential problem before making policy.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/4/2013 | 1:35:29 PM
Droning on drones
I for one, have no doubt that drones will be commercialized at some point in the near future. But speculating about how they will be hacked is just plain silly right now.
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
Why AI Will Create Far More Jobs Than It Replaces
John DiLullo, CEO, Lastline,  5/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Talk about vendor lock in...
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10076
PUBLISHED: 2019-05-20
A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
CVE-2019-10077
PUBLISHED: 2019-05-20
A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
CVE-2019-10078
PUBLISHED: 2019-05-20
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
CVE-2019-12239
PUBLISHED: 2019-05-20
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.
CVE-2019-12240
PUBLISHED: 2019-05-20
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php.