6 ms·
AR Drone That Infects Other Drones With Virus Wins DroneGames
- paupino_masano 14y agoThe source code for this is on Github: https://github.com/substack/virus-copter https://github.com/substack/virus-copter
- 0x0 14y agoDid I read that correctly, that you can simply telnet to the copter's IP address and get a (root?) shell just like that?
- jlgreco 14y agoLooks like you read that correctly. Probably shouldn't be too surprising since they are toy helicopters, though you would probably want to close that if you try to run a taco delivery company with them.
- ConstantineXVI 14y agoNot awfully surprising. It's a toy, not a Predator. Security likely was not a major design concern, and I don't really blame them. Probably even intentional to a degree, to make (owner-sourced) hacking easier.
- jlgreco 14y agoYeah. You can probably think of it basically like the wireless equivalent of a Roomba's SCI port.
- 0x0 14y agoNot complaining, just slightly surprised. I thought you'd have to go to an extra effort to remove the username+password prompt from the standard telnetds :)
- zb 14y agoRandom factoid: the prompt actually comes from getty, not telnetd.
- bigiain 14y agoYou know the Predators were (and possibly still are) transmitting all their video without any encryption?[1] And they've also suffered virus infection on their ground-station computers?[2] I don't know whats running on the actual drones, but it wouldn't surprise me at all to find there's well known exploits against something like QNX or VxWorks (or, and I shudder at this thought, Windows CE) that the drones are vulnerable to whilst in-flight… [1]http://arstechnica.com/tech-policy/2009/12/predator-drones-use-less-encryption-than-your-tv/ http://arstechnica.com/tech-policy/2009/12/predator-drones-u... [2] http://nakedsecurity.sophos.com/2011/10/10/malware-compromises-usaf-predator-drone-computer-systems/ http://nakedsecurity.sophos.com/2011/10/10/malware-compromis...
- donpdonp 14y agoI was surprised too. Anyone have a video of a drone infecting another drone? The symptoms of infection should be obvious: var actions = [ function () { up(Math.random() * 2 - 1) }, function () { left(Math.random() * 2 - 1) }, function () { turn(Math.random() * 2 - 1) }, ]; actions[Math.floor(Math.random() * actions.length)]();
- kleiba 14y agoOMG!!! What if terrorists did the same thing to turn drones against us?? We need more drones to fly above the current generation of drones and monitor them NOW!
- phy6 14y agoThey tried this in Terminator Salvation, it was just a honeypot. Here's another nefarious use for AR drones: http://static.usenix.org/events/woot11/tech/final_files/Reed.pdf http://static.usenix.org/events/woot11/tech/final_files/Reed...
- saym 14y agoThis 'virus' shows how open the drones truly are. Let's get started on a security module! I think the AR Drones provide a great platform that non-programmers can get excited about and in turn want to program themselves. The drone is a perfect combination of functionality and openness.
- sp332 14y ago"Security module"? You can't bolt-on security.
- enraged_camel 14y agoWhat I liked about this the most is that the winning team thought outside the box. While most people focused on "how do we make this drone fly better?" these guys focused on "how do we sabotage the other drones?"
- mephi5t0 14y agoThe Game of Drones. Winter is coming.
- gorrillamcd 14y agoWhat's interesting is the "virus" could be combined with the second-place winner ("multidrone") to make a drone botnet instead of just having the infected drones "run amok".
- stephengillie 14y agoCould we set up a mesh network on that drone-botnet? How much storage would each one have? We could hide that datacenter in a cloud!
- gorrillamcd 14y agoActually, there's some practical application for that. In an emergency situation where communication is down, a network of drones could be setup to provide a network for first-responders and aid-workers to coordinate their efforts. It could even tie-in to base stations that would have the long-range power to connect different meshes. (note: I know nothing about these drones, but looking at what's been done already, it's seems feasible).
- sliverstorm 14y agoOr you could just use skilled radio operators. Though I suppose those have been getting scarcer than sophisticated drones anymore :(
- TeMPOraL 14y agoCan you run IP over Skilled Radio Operators? That kind of drone network could be useful for transmitting video, or other important data that isn't that good to send by voice. Not to mention remotely controling the other drones, that would do things like searching for people in the rubble.
- sliverstorm 14y agoNot sure if TCP/IP has been done, but packet radio [http://en.wikipedia.org/wiki/Packet_radio http://en.wikipedia.org/wiki/Packet_radio] is a thing. That said, you don't need digital transmission for a video signal [http://en.wikipedia.org/wiki/Slow-scan_television http://en.wikipedia.org/wiki/Slow-scan_television] or for remotely controlling things. A more sophisticated network like that provided by TCP/IP is always a nice thing to have, but you pay the price in terms of lost range when you start trying to use WiFi for everything. My little handheld radio can reach up to 5 miles; my WiFi station might go 500 feet. Which link would you rather have in a disaster? It's true, robots can enhance the capabilities of rescue operations, but the comment I replied to was specifically talking about using drones to establish lines of communication. My point is that we already have that, and it doesn't require a hundred drones in the air. You might also be interested in APRS [http://en.wikipedia.org/wiki/Automatic_Packet_Reporting_System http://en.wikipedia.org/wiki/Automatic_Packet_Reporting_Syst...]
- cs702 14y agoA clever strategy that few thought of; it deserved to win. On the downside, this is surely going to give me nightmares about government drones getting infected with a terrorist virus and unleashing drone-botnet-mageddon on the masses.
- aaronblohowiak 14y agoIf you want a taste of that today, there are places you could move (Yemen, Pakistan..)
- sliverstorm 14y agoHow quaint, a terrorist virus? No, it'll probably just be normal government drones with normal government software that unleashes drone-ageddon on the masses. Whether it's a robot uprising, or a bug/oversight in the software, or Big Brother, is up to your own personal taste in dystopian horrors.
- r00fus 14y agoThe terrorist virus is simply plausible deniability so the government can continue it's progression towards new world order. I mean, who really thought Bin Laden had that much power or legitimacy?
- lostlogin 14y agoBin laden had legitimacy? I'd say that he did until he started organising the killing of people.
- biot 14y agoThis reminds me of a time in high school where I participated in a physics olympics competition. One of the events was to construct a bridge out of provided materials capable of supporting the most weight. The score you received was calculated as: (sum of weights supported) / (time taken to place weights) The winning team placed a really small amount of weight in what the judges measured as 0.1 seconds of time. They cleverly gamed the rules to take advantage that a small time would act as a multiplier. Our team came in second for that event even though our bridge supported many times the weight theirs did, even if you took as long as you wanted to place the weights. It was a bit of an abuse of the rules and I felt it went against the spirit of the competition which was to engineer a solid bridge. In this situation, by crippling potentially better drones the virus copter may have ended up technically winning but the measure by which it won may be different than what was intended. That said, it will definitely bring to the forefront a better approach to security which will have long-term benefits.
- sliverstorm 14y agoThe scoring calculation just needs to be tweaked a little. Presumably the goal is to prevent teams from building a fragile bridge that needs exceedingly delicate placement of weights. So perhaps something like: (sum of weights supported) / exp(time taken to place weights) Then, select units or add a constant such that you ensure contestants have a minute or two where the ramp-up of time penalty remains modest.
- cs702 14y agoI'm not sure your analogy applies in this case. The team that won the DroneGames HAD the BEST strategy: crippling the other drones! This reminds of a story I heard a long time ago about a fighter in the middle of some nasty civil war who complained to a TV reporter: "no one here respects the Law of The Jungle anymore!"
- biot 14y agohttp://dronegames.co/ http://dronegames.co/ doesn't state what the judging criteria is. If it's "survive to the end" then why not heavily shield your drone, bolt it to a fixed stand, affix a heavy EMP generator, and fry all the other electronics in the room? Your drone won't be able to do anything useful as it's bolted down but its shielding will at least allow the electronics to blink some lights and technically you could win on that fact alone. Presumably such a tactic would violate the spirit, which I take to be demonstrating cool and unique capabilities without having to deal with hostile threats. However, I haven't been following, so perhaps drone to drone interference is actively encouraged and expected.
- dkersten 14y agoNext time they should combine these with this: http://www.youtube.com/watch?v=SNPJMk2fgJU http://www.youtube.com/watch?v=SNPJMk2fgJU
- tmarthal 14y agoI know it's science-fiction, but the 2010 book <a href="http://en.wikipedia.org/wiki/The_Quantum_Thief>The http://en.wikipedia.org/wiki/The_Quantum_Thief>The Quantum Thief</a> makes use of weapons like these: basically firing a missile to get physical access to your adversary's computer systems with some sort of payload, and that payload of which will scan and disrupt the opponent's system.
- Ingaz 14y agoMore realistic episode was in http://en.wikipedia.org/wiki/Kikokugai:_The_Cyber_Slayer http://en.wikipedia.org/wiki/Kikokugai:_The_Cyber_Slayer . Physical attack on enemy corporation was just a diversion. The real attack was on corporation network. Main computer gone nuts and started selling and buying in most ineffective way. Corporation was destroyed after several minutes.
- wingerlang 14y agoIs there any video of this in action?
- kunil 14y agoThis sounds weird to me. How do they infect a system that they never saw before? Did the wrote the virus on the fly? Or those drones have a common library with a bug or something. This is like a Hollywood movie with a bad script
- Aissen 14y agoThe drones are identical for this competition; and are running an unprotected telnet server on the same wireless network. Just look at the code: https://github.com/substack/virus-copter https://github.com/substack/virus-copter This only proves that the organizers had no technical background whatsoever.
- yardie 14y agoThese are the retail standard AR Drones with their own Wifi APs and telnetd enabled. It's not the organizers job to secure them. Would you expect the Defcon organizers to do the same for the attendees?
- sandfox 14y agoPray child, please explain further how you have come to this conclusion. I'm not sure I'm following you.