Hacking Device from the Sky

Monday, August 8, 2011 @ 01:08 PM gHale

A radio-controlled model airplane outfitted with a computer and 4G connectivity could create an aerial hacking device for targets unreachable by land.

“There is some really evil stuff you can do from the sky,” said Mike Tassey, who together with Richard Perkins spent more than 1,300 hours building, testing, and refining the device they call the Wireless Aerial Surveillance Platform (WASP). The two demonstrated their device at the Black Hat Security Conference in Las Vegas last week.

Tough Task: Smartphone Security
New DoS Tool Hits Cyber Street
Cyber Report: Crime Costs Climb
Fake Anti Virus via Social Means

Created with off-the-shelf equipment and open-source software, costing $6,100, the demo plane was capable of wireless network sniffing and cracking, cell tower spoofing, cell phone tracking and call interception, data exfiltration, and video surveillance.

Built on top of a surplus Army target drone, the device had multiple wireless antennae and a microcomputer loaded with GPS, wireless sniffing tools, and the Backtrack 5 penetration testing toolkit. The 14-pound, 6-foot-long plane connects through a 4G dongle with a small base station that controls it using Google Earth and an open-source autopilot software solution. The base station streams data gathered by the plane and sends it over a VPN connection to a more robust back-end PC, which can take care of the heavy-lifting, such as crunching through large dictionaries to perform brute-force attacks. The Internet connectivity would make it possible to also crowd source data to multiple hackers with different skill sets if a project needed the manpower.

The plane itself gets its power from an electric engine hard to detect by ear even as close as 50 feet away. Though FAA regulations prohibit flight of such devices from going above 400 feet, the drone itself could fly as high as 20,000 feet.

Perkins and Tassey said a device such as the one they developed could potentially be used for run-of-the-mill hacking, but also for drug trafficking and terrorism. On the positive end, the drone could see use for search and rescue, military and law enforcement operations, and even be capable of providing emergency cell service in disaster zones.

The two said they still could not find a good way to protect against a WASP-like attack. Not even missiles would work against these drones because they don’t put out the kind of heat or radar signatures necessary for missiles to track and destroy them.

“So how do you defend against this? We need the right people to start thinking about this,” Perkins said. “Because if we thought of it, someone else has, too.”

Leave a Reply

You must be logged in to post a comment.