Hacker-built drone can hunt, hijack other drones

Security researcher Samy Kamkar created the hacker drone, which uses the Parrot AR.Drone 2.0 radio-controlled quadcopter – a popular unmanned helicopter with four rotors.

Made by French wireless products manufacturer Parrot, the AR.Drone 2.0 has a built-in Wi-Fi wireless controller that’s used to control the drone remotely from iOS or Android mobile devices.

Kamkar’s drone carries a Raspberry Pi embedded computer running Linux and has two USB wireless adapters connected to it, an Alfa AWUS036H Wi-Fi network card with an external antenna and an Edimax EW-7811Un nano Wi-Fi adaptor. A lightweight 1000mAh USB battery is also part of the payload and powers the Raspberry Pi.

The Alfa Wi-Fi adaptor is important because its wireless chipset can run in monitor mode. The monitor, or RFMON (Radio Frequency MONitor), mode can be used to monitor and inject raw packets into other wireless networks without being connected to them, Kamkar said in his SkyJack presentation video.

Kamkar developed a Perl application dubbed SkyJack that runs on the Raspberry Pi and uses other open-source software to hijack drones.

SkyJack uses the Alfa adapter’s monitor mode to identify other Parrot AR Drones by their MAC addresses, which all contain Parrot’s vendor identifier, and then attempts to deauthenticate their real owners.

This is done using Aircrack-ng, an open-source programme for hacking into wireless networks. According tothe Aircrack-ng documentation a deauthentication attack “sends disassociate packets to one or more clients which are currently associated with a particular access point.”

Once the real owner is disconnected from a targeted drone, SkyJack connects to it pretending to be the owner and starts sending commands using node-ar-drone, an open-source library that implements the networking protocols used by the Parrot AR Drone 2.0.

The Parrot drone with the Raspberry Pi attached is only needed for mobile attacks, but the SkyJack application can also run from any Linux laptop on the ground and hijack drones out of the sky, Kamkar said in a blog post.

The researcher released SkyJack on GitHub and said that the idea for creating a drone hijacking application came to him after reading that Amazon is considering using drones to deliver packages.

“Today Amazon announced they’re planning to use unmanned drones to deliver some packages to customers within five years. Cool!” Kamkar said. “How fun would it be to take over drones, carrying Amazon packages…or take over any other drones, and make them my little zombie drones. Awesome.”

Kamkar is known for releasing the infamous Samy cross-site scripting worm on MySpace in 2005, forcing the company to temporarily shut down the website, an act for which he served three years of probation during which he could not use a computer.

Since 2008, he has been involved in security research, uncovering a serious flaw in PHP, exposing privacy risks associated with the collection of GPS coordinates and wireless network information by mobile devices, and releasing Evercookie, a highly persistent browser cookie that demonstrates how many technologies can be used to track users.