Drones Behaving Badly

Presented at

Oct 21, 2014

Mar 20, 2015

@SecureUtah

Hello!

  • a review of the capabilities and interesting applications of the consumer / hobbyist variety of airborne devices
  • meant to stir your imagination
     
  • a wake-up call

This presentation is:​

Drone, UAV or UAS?

It depends on who does the talking - ​

Objectively defined:  a drone is some kind of flying machine that does not contain a person inside, and it can do anything from take your picture to end your life

These kinds of drones:

How mainstream?

"Imagine what Louis XIV could have accomplished at Versailles if he'd had one"

How did we get here?

Military research!

  • Offspring of 9/11
    • ​the mass-market drones we see today are descendants of the R&D that poured into satisfying the U.S. military's demand for more and better combat and recon UAVs
    • aka Trickle Down Warfare - Alex Stamos @ RSA2013

Drone Problems:

Criminal mischief

Drone Problems:

Less-than-lethal

Drone Problems:

Swarms

Drone Problems:

Evildoers

 

Drone Problems:

Surveillance, Privacy and Safety

Drone Problems:

Oops

  • Alternate theory:

Drone-assisted IT attacks:

Published research 

Drone-assisted IT attacks:

Published research 

Drone-assisted IT attacks:

Drones + InfoSec = a naming opportunity

CompTIA Drone+

Certified Ethical Droner

Offensive Drone Security Professional

Airborne Penetration Threat

Red Team: Paratrooper Squad

Aerial Intrusion Detection System

Drone-Assisted Rapid Penetration Attack

Just another tool

How else can a drone be used in combination with existing tools?

Airdrop an evil payload!

Drone-assisted IT attacks:

Drone:  Quadcopter + FPV Camera + deployment / retrieval

Missing:  PoC and catchy name

Payload:  RasPi + Kali Evil AP w/ 3G access + LUKS + Battery / Solar / Leech

Just another tool

  • RFID scraper
  • WiFi range extender (yours or your neighbor's)
  • Network hops on demand, solo or swarm
    • Movable hop to thwart tracking or obfuscate geolocation
    • WiFi canary - it goes down / gets busted, you escape
  • High-rise penetration
    • fly up to the CEO's window, plant a solar-powered RasPi EAP
    • perch on the roof/balcony, scan a hotel during a conference
    • removes the need to physically be inside - no cover ID, no security cam footage, no money trail

Drone-assisted IT attacks:

Just another tool

  • Air-numeration
    • Survey tall buildings with the greatest of ease
    • No need to social engineer your way in past the guard
  • Targeted harassment
    • De-Auth / jam APs, relocate - support staff slowly goes mad
    • Denial of Service - use a swarm for Distributed DOS
    • Diversion while other actions are carried out
  • Site survey
    • before & after, thermal inspection, physical security vulns
  • Hack yourself first

Drone-assisted IT attacks:

Drone-assisted IT attacks:

OpSec, aka Where Did It Land???

Drone Solutions:

Emergency / Search & Rescue

Drone Solutions:

Activism

  • Quis custodiet ipsos custodes?  Drones mounted with HD cameras and FPV could record riots, protests, and police or government action remotely, keeping the operator safe and greatly reducing the threat of device confiscation or witness intimidation.
     
  • Animal rights groups take to the air to bypass Ag Gag laws, but not without casualties
     
  • Art vs Predator drones - #NotABugSplat

Drone Solutions:

Fun & Ingenious

Drone Solutions:

Commercial

Drone Solutions:

Possibly Beneficial Military Research

Drone Defense:

Needs work

Get a drone:

Read, learn, buy

Get a shirt

Drunk Predator Drone

My Little Droney

Dress to Impress

Legal:

Seriously, don't fly here

Don't fly here

Legal:

Utah SB167 signed into law April 1, 2014 

             68          63G-18-103. Warrant required -- Exceptions.
             69          (1) A law enforcement agency may not obtain, receive, or use data acquired through an 
             70      unmanned aerial vehicle unless the data is obtained:
             71          (a) pursuant to a search warrant;
             72          (b) in accordance with judicially recognized exceptions to warrant requirements; or
             73          (c) subject to Subsection (2), from a person who is a nongovernment actor.

New Utah law

Legal:

Utah SB167 signed into law April 1, 2014 

             74          (2) A nongovernment actor may only disclose data acquired through an unmanned
             75      aerial vehicle to a law enforcement agency if:
             76          (a) the data appears to pertain to the commission of a crime; or
             77          (b) the nongovernment actor believes, in good faith, that:
             78          (i) the data pertains to an imminent or ongoing emergency involving danger of death or
             79      serious bodily injury to an individual; and
             80          (ii) disclosing the data would assist in remedying the emergency.

New Utah law

Legal

National laws are all over the place

Legal:

  • A small UAS operator must always see and avoid manned aircraft. If there is a risk of collision, the UAS operator must be the first to maneuver away.
  • The operator must discontinue the flight when continuing would pose a hazard to other aircraft, people or property.
  • A small UAS operator must assess weather conditions, airspace restrictions and the location of people to lessen risks if he or she loses control of the UAS.
  • A small UAS may not fly over people, except those directly involved with the flight.
  • Flights should be limited to 500 feet altitude and no faster than 100 mph.
  • Operators must stay out of airport flight paths and restricted airspace areas, and obey any FAA Temporary Flight Restrictions (TFRs).

New FAA rules

A framework of regulations

Predictions

  • Batteries are the biggest anchor on drone development. Once battery and/or recharging tech advances to a point where a sub-$100 device can stay airborne for days by recharging as it flies...
     
  • Highly autonomous drones - perform mission, recharge, repeat, repeat, repeat
     
  • Privacy debate will get louder and more entertaining
     
  • FAA regulations will restrict off-the-shelf device capabilities

Conclusion

Just another tool

  • A tethered 'watchdog' drone, armed with a 10 lb paintball gun, four 2000-ball hoppers weighing 64 pounds, and a cam linked to a laptop running motion-detection software.  You have an overly-complicated yet awesome anti-crow system, anti-trespasser system, or a fun addition to the Scout Camp obstacle course.
     

  • How many of you have a child age 9-13?  You just got them their own emergency escape vehicle.  Link 2 or 3 together, now an adult has a controlled descent from the top of a burning building down to the ground.

Skunk riot control drone carries 40 kg / 88 lbs:

Thank you!

Much thanks to the authors of all the source material I linked to.  This presentation wouldn't have been possible without their research, writing, and experimentation.
 

Huge thanks to BSidesSLC for the opportunity to speak and to all of you for attending!

dronesbehavingbadly.com

Made with Slides.com