Wardriving Evolves Into Warflying

BLACK HAT USA 2011 -- Las Vegas -- Yesterday at Black Hat, two security researchers demonstrated how a radio-controlled model airplane outfitted with a computer and 4G connectivity could be used to create a nearly undetectable aerial hacking device that could perpetrate aerial attacks on targets otherwise unreachable by land.

Created completely with off-the-shelf equipment and open-source software -- and with a budget of only about $6,100 -- the demo plane they brought on stage with them was capable of wireless network sniffing and cracking, cell tower spoofing, cell phone tracking and call interception, data exfiltration, and video surveillance.

"There is some really evil stuff you can do from the sky," said Mike Tassey, who together with Richard Perkins spent more than 1,300 hours building, testing, and refining the device they call the Wireless Aerial Surveillance Platform (WASP).

Built on top of a surplus Army target drone Perkins had sitting in his basement, the device has been equipped with multiple wireless antennae and a microcomputer loaded with GPS, wireless sniffing tools, and the Backtrack 5 penetration testing toolkit. The 14-pound, 6-foot-long plane connects through a 4G dongle with a small base station that controls it using Google Earth and an open-source autopilot software solution. The base station streams data gathered by the plane and sends it over a VPN connection to a more robust back-end PC, which can take care of the heavy-lifting, such as crunching through large dictionaries to perform brute-force attacks. The Internet connectivity would make it possible to also crowdsource data to multiple hackers with different skill sets if a project needed the manpower.

The plane itself is powered off of an electric engine that is hard to detect by ear once it is as close as 50 feet away. Though FAA regulations prohibit flight of such devices from going above 400 feet, the drone itself would be capable of going well above 20,000 feet in altitude.

Perkins and Tassey said a device such as the one they developed could potentially be used for a number of nefarious reasons beyond run-of-the-mill hacking, including drug trafficking and terrorism. On the plus side, such drones could also be used by forces of good, including for search and rescue, military and law enforcement operations, and even to provide emergency cellular service in disaster zones. Whether built for good or bad, the design is not complicated, they said.

"You don't need a Ph.D. from MIT to do this," Perkins said.

Unfortunately, both presenters said they couldn't yet think of a good way to protect against a WASP-like attack. Not even missiles would work against these drones because they don't put out the kind of heat or radar signatures necessary for missiles to track and destroy them.

"So how do you defend against this? I don't know. That's what you guys are for. We need the right people to start thinking about this. How would you defend against something like this?" Perkins said. "Because if we thought of it, someone else has, too. They're just not telling you about it."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.