Someone At DEF CON Made a Drone That Hacks Computers

The Aerial Assault penetration testing drone on display at 2015's DEF CON in Las Vegas, Nev.

Aerial Assault

AA Font size + Print

The Aerial Assault penetration testing drone on display at 2015's DEF CON in Las Vegas, Nev.

You can buy it for $2,500 — and turn it into a flying malware injector.

LAS VEGAS, Nev. – Forget Facebook drones that broadcast Wifi. The future is drones that hack from above.

A company called Aerial Assault has turned a quadcopter into a flying hacker that scans the world below for insecure devices and vulnerable Wifi ports. Its makers say they built the tool for penetration testing — to help “good guys” diagnose their own weaknesses — but they concede that with a bit of modification, it could be used to exploit those vulnerabilities and install malware from the air.

The unnamed drone, which may be the first unmanned aerial penetration tool for sale to the public, was on display at the DEF CON hacker conference here last week. It uses a small Raspberry Pi computer running the Kali Linux penetration tester software with the broadcast range extended by alpha radio antennas. It will retail for $2,500 when the Web site goes up in a few days, its makers say.

“We’ve set it up so it does some basic [penetration] testing stuff and coordinates all that data with GPS coordinates from the flight controller. From that, you can extend it with every type of capability that you want Kali Linux to do,” said David Jordan, a representative from Aerial Assault who was selling it on the floor at the DEF CON conference in Las Vegas, Nevada on Sunday.

While the drone isn’t specifically designed to distribute malware, Jordan acknowledged it could be modified to do so. “It is up to the user to decide what they do with it. If the user, they have Raspberry Pi with Kali on it, they can reprogram custom scripts. That’s good for doing more extensive [penetration] testing. But, you know, scripts can be whatever they are,” he said. “Our intended use is for pentesters to be able to diagnose vulnerabilities and help people understand what their Wifi accessibility is, even up in the air.”

Close [ x ] More from DefenseOne
 
 

Thank you for subscribing to newsletters from DefenseOne.com.
We think these reports might interest you:

  • Ongoing Efforts in Veterans Health Care Modernization

    This report discusses the current state of veterans health care

    Download
  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

    Download
  • Top 5 Findings: Security of Internet of Things To Be Mission-Critical

    As federal agencies increasingly leverage these capabilities, government security stakeholders now must manage and secure a growing number of devices, including those being used remotely at the “edge” of networks in a variety of locations. With such security concerns in mind, Government Business Council undertook an indepth research study of federal government leaders in January 2017. Here are five of the key takeaways below which, taken together, paint a portrait of a government that is increasingly cognizant and concerned for the future security of IoT.

    Download
  • Coordinating Incident Response on Posts, Camps and Stations

    Effective incident response on posts, camps, and stations is an increasingly complex challenge. An effective response calls for seamless conversations between multiple stakeholders on the base and beyond its borders with civilian law enforcement and emergency services personnel. This whitepaper discusses what a modern dispatch solution looks like -- one that brings together diverse channels and media, simplifies the dispatch environment and addresses technical integration challenges to ensure next generation safety and response on Department of Defense posts, camps and stations.

    Download
  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

    Download

When you download a report, your information may be shared with the underwriters of that document.