Terror in the skies? New malware clips drone wings

Are drones the answer to manned surveillance flights and retail deliveries? Both governments and companies like Amazon have been working hard to sell this line but have been met with stiff resistance. Citizens are understandably concerned about the risks posed by both public and private drones — a concern that seems more justified than ever, thanks to the release of new malware that can hijack these flying devices mid-flight. Has the dream of drone-filled skies become a nightmare?

Going Down!

According to a recent Forbes article, a new strain of malware called “maldrone” is now making the rounds, courtesy of India-based Citrix security engineer Rahul Sasi. Using previous drone hacking techniques as a starting point, Sasi devised a piece of malware which bypasses the device's application programming interface (API) and instead goes directly for the autonomous decision-making unit — effectively the drone's “brain”.

While Sasi's method only works in close proximity, he claims it will work across multiple drone types, from standard Parrot ARs to models like the DJI Phantom. In a video posted to YouTube, Sasi shows the hack taking place in real-time and what happens when he issues a “kill command”, causing the drone to shut off and fall from the sky. This is the real terror in his discovery: While previous attempts focused on giving control to other pilots or malicious attackers, Sasi's effort is focused on drone sensor communication as a way to fully transfer control to a remote desktop or mobile device. Yikes!

As noted above, this isn't the first time drones have been infected with malware. In 2013, Gizmodo reported that security researcher Sami Kamkar created the “SkyJack” malware package, which used a Parrot AR and Raspberry Pi attachment to infect other drones as it flew, creating an army of remote-controlled robots. And in 2012, James “substack” Halliday created a Virus-Copter to infect nearby drones and redeploy them as autonomous infectors.

Crash and Burn

But is all theoretical, right? Not quite. The Verge reports that on January 26^th, a DJI Phantom drone crashed on the White House grounds. This prompted a response from President Obama calling for improved drone regulation, and drone maker DJI said it is introducing mandatory firmware that will prevent its drones from flying over the DC area. While it appears that no malware was involved in this case — the pilot told secret service agents he was drinking — the increased use of drones by private citizens and for public use makes legitimate hacking an inevitability.

In fact, malware has already infected official Air Force Predator and Reaper drones — as reported by Naked Security, in 2011 a piece of unknown keylogging code was detected in these aircraft as they flew over Afghanistan. Defense officials said they could not determine the code's origin or keep drones clean, since after every deletion the malware reappeared.

Air Patrol

Beyond drones, there's also the risk of malware infecting traditional aircraft. We Live Security reports that while some experts think that hacking planes in mid-flight is either difficult or impossible, the increasing amount of wireless technology used on board only makes it a matter of time. As a result, researchers are looking to develop networks that can “reconfigure” themselves around malware once it has been detected and prevent any loss of control. It's also worth noting that in 2010, a Spanish commercial aircraft was brought down in part because of malware that prevented on-board safety systems from warning pilots that the plane's flaps and slats were retracted upon takeoff.

Drone-ing On

Despite potential malware issues, drone makers and delivery services like Amazon continue to push ahead with autonomous flying research. In fact, the retail giant just released a stern letter warning the US that if test flight standards don't loosen, they'll divert testing resources and potential revenue to the UK.

Bottom line? Because something hasn't happened, doesn't mean it won't. Just as the idea of search companies tracking your browsing habits and governments monitoring your IP address seemed like the stuff of science fiction just a few years ago, the idea of malware-infected drones only seems remote because it hasn't happened at large scale. But with pilots drunk-flying onto White House grounds and researchers working to prove that any device, anywhere is a risk, you may want to keep one eye on your digital privacy — and the other on the sky.

Featured image: funkyfrogstock / Dollar Photo Club