Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Hardware Hacker Demos Zombie Drone Hijacker

The SkyJack drone automatically seeks out and hijacks other nearby Parrot drones. Will this mean trouble for Amazon's planned drone delivery fleet?

Military Drones Present And Future: Visual Tour
Military Drones Present And Future: Visual Tour
(click image for larger view and for slideshow)

Efforts to develop drones that can handle a number of routine tasks, such as restocking warehouse shelves or delivering parcels and pizza, keep garnering headlines. But what if hackers could hijack those unmanned aerial vehicles and turn them into "little zombie drones"?

In fact, that's the promise of a newly announced drone-hijacking program called SkyJack, which was developed by privacy and security researcher Samy Kamkar.

"SkyJack is a drone engineered to autonomously seek out, hack, and wirelessly take over other drones within WiFi distance, creating an army of zombie drones under your control," Kamkar said on his autonomous drone hacking project site.

"I developed a drone that flies around, seeks the wireless signal of any other drone in the area, forcefully disconnects the wireless connection of the true owner of the target drone, then authenticates with the target drone -- pretending to be its owner -- then feeds commands to it and all other possessed zombie drones at my will," Kamkar said. He also uploaded to YouTube a semi-gonzo basement demonstration of a target Parrot drone -- connected to his iPad -- being forcibly disconnected and compromised via his automated "drone strike" software.

[ Devices are replaceable; Mobile Security Is All About The Data. ]

To date, his SkyJack drone, which uses a Parrot drone that he's modified, is only able to hijack similar Parrot drones.

The project is surprisingly affordable; Kamkar said the cost of building a SkyJack drone is less than $400. The full list of required hardware includes a Parrot AR.Drone 2, which retails for about $300, plus a credit-card-sized Raspberry Pi computer (about $35) that runs Linux, an Alfa AWUS036H wireless transmitter (about $20) with 1000mW of broadcast power, and a USB battery pack. That power supply needs to remain relatively light, however, because the drone has a carrying capacity of only about 400 grams.

On the software side, Kamkar's SkyJack buildout calls for the aircrack-ng key-cracking program, which can forcibly disconnect a target drone's WiFi connection. After that happens, Kamkar's drone-strike software connects to the drone using the node-ar-drone JavaScript library, which can be used to communicate with and control any Parrot AR Drone 2.0.

Kamkar has released his SkyJack code on Github.

Once a drone has been compromised, Kamkar said his drone-strike software "starts actually recording images from the front-facing camera, as well, and you can watch that live." In addition, an attacker can remotely connect to the SkyJack drone to retrieve feeds of -- and control -- all in-range compromised drones.

Furthermore, using his drone-strike software, not all attacks need be launched from an aerial platform. "SkyJack also works when grounded as well, no drone is necessary on your end for it to work," he said on the project overview page. "You can simply run it from your own Linux machine/Raspberry Pi/laptop/etc and jack drones straight out of the sky."

News of the SkyJack project comes hot on the heels of Amazon publicizing tests it's been conducting with drones -- known as octocopters -- in its quest to one day deliver goods of up to five pounds by air, future FAA regulations permitting. Cue "Amazon Prime Air."

For the cynically inclined, that news was delivered in a 60 Minutes interview Sunday with Amazon CEO Jeff Bezos, which aired on the eve of Cyber Monday. That, of course, is a day cooked up by online retailers to urge consumers to buy more of their wares.

Timing aside, Wall Street is bullish on drone technology. According to Bloomberg, in the first nine months of 2013 venture capitalists invested a total of $40.9 million in drone startups.

With that level of investment, it's unlikely that even the efforts of hackers wielding autonomous drone hijacking software would ground investors' exuberance in drone technology.

Knowing your enemy is the first step in guarding against him. In this Dark Reading report, Integrating Vulnerability Management Into The Application Development Process, we examine the world of cybercriminals -- including their motives, resources, and processes -- and recommend what enterprises should do to keep their data and computing systems safe in the face of an ever-growing and ever-more-sophisticated threat. (Free registration required.)

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/4/2013 | 1:35:29 PM
Droning on drones
I for one, have no doubt that drones will be commercialized at some point in the near future. But speculating about how they will be hacked is just plain silly right now.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
12/4/2013 | 5:43:01 PM
Re: Droning on drones
Oh, come on! The possibilities are so cool. One could build a huge drone army in secret to defend the republic ... oh, wait, those are clones.

Seriously, while it is premature, for once it would be nice if the FAA had some foresight into potential problem before making policy.
David F. Carr
50%
50%
David F. Carr,
User Rank: Strategist
12/4/2013 | 6:12:13 PM
Re: Droning on drones
In just a few years, we'll go from Black Friday to Black Hawk Down Friday
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
12/4/2013 | 8:44:02 PM
Re: Droning on drones
Cyberattack Tuesday?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9079
PUBLISHED: 2020-08-11
FusionSphere OpenStack 8.0.0 have a protection mechanism failure vulnerability. The product incorrectly uses a protection mechanism. An attacker has to find a way to exploit the vulnerability to conduct directed attacks against the affected product.
CVE-2020-16275
PUBLISHED: 2020-08-10
A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.
CVE-2020-16276
PUBLISHED: 2020-08-10
An SQL injection vulnerability in the Assets component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
CVE-2020-16277
PUBLISHED: 2020-08-10
An SQL injection vulnerability in the Analytics component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
CVE-2020-16278
PUBLISHED: 2020-08-10
A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.