A few weeks ago I attended the Black Hat hacker conference in Las Vegas and one of the hot topics was the use of drones for electronic surveillance. Drones, also known as unmanned aerial vehicles (UAV) or unmanned aircraft systems (UAS) are being used for many purposes, some of which include cyber-attacks.
One way that UAS’ are used for cyber-attacks is by equipping the UAS with equipment known as a wireless Pineapple. The Pineapple is designed to mimic a legitimate wireless access point and can even target specific mobile devices. When attached to a UAS, a cyber-criminal could hover over a home, business, or other location and have Internet capable devices begin to associate with it. The Pineapple device can perform what is called a “Man-in-the-Middle” (MiTM) attack against a mobile device, meaning that it can capture Internet traffic between the device and the Internet gateway and manipulate the traffic. This is just one of numerous attacks these devices can be used for.
A hacker can launch attacks such as IP redirection, DNS spoofing, injecting malicious code into a traffic stream, and other manipulation of data. For example, an iPhone user may connect to a Pineapple and type in www.google.com on their phone. When the iPhone passes that request to the Pineapple, an attacker could manipulate the Domain Name Service (DNS) response and instead of sending the iPhone to the real Google page, it sends the user to a fake Google page. When the iPhone user sees the Google page that is actually coming from a hacker’s server instead of Google, they believe it is real and begin to enter data into it. All of this data is collected by the hacker and could include any number of important details. While Google might be a benign example, an attacker could easily do this for financial websites, healthcare websites, and others, allowing an attacker to harvest user credentials. This is often called website scraping, DNS redirection attacks, and pharming.
Another troubling example of how a UAS equipped with a Pineapple device could be used against the government, businesses, or individuals is by dropping drones onto buildings and collecting wireless Internet traffic. Just imagine a hacker flying a UAS under the cover of darkness and landing it on the roof of an institution. When employees begin to arrive at work, they may have various personal and business systems associate with the Pineapple. Even if nothing associates with the Pineapple, it will still promiscuously sniff and record the wireless traffic in the area. When the hacker is done collecting information, the UAS takes off from the building at night again and returns to the hacker.
The use of UAS for reconnaissance whether it is with high-definition video or sniffing wireless Internet traffic is a real threat. I think drones have many great use cases, but like any other technology, criminals quickly identify ways to exploit it.
* * *
Josh Moulin is a cyber security and digital forensics expert who leads a team of defense contractors that protect some of the nation’s most critical national security programs for a United States federal agency. Josh has a Master’s of Science in Information Security and Assurance and holds multiple digital forensics, cyber security, and law enforcement certifications. Prior to working with the federal government, Josh spent 11 years in law enforcement with his last assignment as a lieutenant and commander of a FBI cyber crimes task force.