Black Hat, a UBM TechWeb event in Las Vegas, how a radio-controlled model airplane outfitted with a computer and 4G connectivity could be used to create a nearly undetectable aerial hacking device that could perpetrate aerial attacks on targets otherwise unreachable by land.
Created completely with off-the-shelf equipment and open-source software--and with a budget of only about $6,100--the demo plane they brought on stage with them was capable of wireless network sniffing and cracking, cell tower spoofing, cell phone tracking and call interception, data exfiltration, and video surveillance.
"There is some really evil stuff you can do from the sky," said Mike Tassey, who, together with Richard Perkins, spent more than 1,300 hours building, testing, and refining the device they call the Wireless Aerial Surveillance Platform (WASP).
Built on top of a surplus Army target drone Perkins had sitting in his basement, the device has been equipped with multiple wireless antennae and a microcomputer loaded with GPS, wireless sniffing tools, and the Backtrack 5 penetration testing toolkit. The 14-pound, 6-foot-long plane connects through a 4G dongle with a small base station that controls it using Google Earth and an open-source autopilot software solution. The base station streams data gathered by the plane and sends it over a VPN connection to a more robust back-end PC, which can take care of the heavy lifting, such as crunching through large dictionaries to perform brute-force attacks. The Internet connectivity would make it possible to also crowdsource data to multiple hackers with different skill sets if a project needed the manpower.
The plane itself is powered off of an electric engine that is hard to detect by ear once it is as close as 50 feet away. Though Federal Aviation Administration regulations prohibit flight of such devices from going above 400 feet, the drone itself would be capable of going well above 20,000 feet in altitude.
Read our report on how to guard your systems from a SQL attack. Download the report now. (Free registration required.)