lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAC121272SPdhLRw26yaUp=f4kssBKYLfDQpPqdDnmj25k_p-dg@mail.gmail.com> Date: Sun, 1 Feb 2015 16:09:47 +0530 From: Rahul Sasi <fb1h2s@...il.com> To: fulldisclosure@...lists.org Subject: [FD] Maldrone for drones. I wrote a blog post last week regarding a small project I was working on my free time "Learning about Drones and security issues" . And a youtube demo video titled "Maldrone first malware for drones". The blog is a preview of few things I would be presenting at my upcoming talk at Nullcon <http://nullcon.net/website/goa-15/about-speakers.php> . Video: https://www.youtube.com/watch?v=5SlWdl4ZuAI Blog: http://garage4hackers.com/entry.php?b=3105 Maldrone came as a by product of my attempt to build a generic tool to debug drones. Since most drones I was experimenting were running on ARM Linux, I decided to make a tool that would work on most of the civilian drones out there. Later I added some functionality to make it act like a backdoor[phun] and added it to my presentation. The blog got a bit of media attention .Mainly because of two reasons. 1) It is related to Drones [Kind of interesting stuff] 2) Some guy crashed a phantom DJI drone into whitehouse lawn. <http://edition.cnn.com/videos/cnnmoney/2015/01/29/money-dji-drone-white-house.cnnmoney> So many online medias wrote different version of the story. And few journalist directly contacted me . As usual there were people who only followed news sites and never bothered to read the actual blog. And came up with "n" number of ridiculous questions. So I am sharing the actual blog here which has mentions to what it does and references all previous work in same line as maldrone. Looking forward to have discussion with people who are interested in drones and drone security. *Original Blog:* http://garage4hackers.com/entry.php?b=3105 *Introduction:* There are over 70 nations building remotely controllable drones. Most of these drones are capable of making autonomous decisions. Countries buy drones from there neighbors. What are the possibilities that there could be a backdoor in the drone you brought. What are the possible ways you can backdoor a drone. What would be the impact if a security issues is found in a computer devices that make decisions of there own. This is part of my ongoing research, some of it which I would be answering/demonstrating at Nullcon this feb 7th, 2015 http://nullcon.net/website/goa-15/about-speakers.php . *Maldrone: Backdoor for Drones.* Features: Maldrone will get silently installed on a drone. Interact with with the device drivers and sensors silently. Lets the bot master controller the drone remotely . Escape from the Drone owner to Bot master. Remote surveillance. Spread to other drones *. *Demo:* In this we would show infecting a drone with Maldrone and expecting a reverse tcp connection from drone. Once connection is established we can interact with the software as well as drivers/sensors of drone directly. There is an existing AR drone pioloting program. Our backdoors kills the auto pilot and takes control. The Backdoor is persistent across resets . https://www.youtube.com/watch?v=5SlWdl4ZuAI For this research we are using Parrot Ar Drone 2.0 and DJI Phantom .Maldrone is developed for AR drone arm linux . In this demo we will install the drone with Maldrone. Once its installed. The Maldrone will connect back to botmaster and wait for commands. Maldrone can proxy the device driver and sensor communications. Maldrone could interact with the drone communication and proxy data from the drone sensors . *Maldrone would be a good buddy for http://samy.pl/skyjack/ <http://samy.pl/skyjack/> .*Samy's skyjack is an exploit for parrot ardrone . Maldrone is a payload and not an exploit. So once you hack a drone using skyjack or any drone specific vulnerability. You then install Maldrone as a backdoor. *The idea: AR drone Introduction* Ar drone quad-copter contains a 9 degrees-of-freedom (DOF) . "Degrees Of Freedom" or "DOF" is a number of axis and sensors combined for balancing a plane, a helicopter or a robot. ref: http://playground.arduino.cc/Main/Wh...9DOF10DOF11DOF <http://playground.arduino.cc/Main/WhatIsDegreesOfFreedom6DOF9DOF10DOF11DOF> in-ertial measurements unit (IMU) a) 6 DOF gyroscope and b) 3 DOF magnetometer. c) ul-trasound sensor[ used for low altitude measure-ments d) a pressure sensor [Altitude measurement at all altitudes. c) a GPS sensor. *The access to these sensor data are made available via serial ports. * The Ar drone has a binary named program.elf which controls the entire drone using these nav-board data. This little program is smart enough to perform auto landing , flight stability and various other AR drone tricks. Check out this video: https://www.youtube.com/watch?v=IcxBf-kegKo *Is Maldrone the first malware for drones?* Ar Drone also exposes a high level api , and this is open sourced. This would let you control the drone via AT commands. And could program the drone to do pretty much anything. Lot of previous researches and attempts to backdoor drones used this API . This would make the backdoor concept very generic to AR drone. *Ref previous works: * http://boingboing.net/2012/12/09/fly...irus-copt.html <http://boingboing.net/2012/12/09/flying-malware-the-virus-copt.html> http://www.cbronline.com/news/securi...ection-4483778 <http://www.cbronline.com/news/security/hackers-to-target-firms-via-drone-infection-4483778> I am trying to build something more generic . The programs out there like the above use parrot drone api as a backdoor. Parrot drone is a toy and our research is no way specific to parrot. We are documenting generic ways on how you could backdoor a drone. My idea of taking up this project was to learn how it is possible to backdoor robots and drones in general. So the best bet is to interact with the sensors and navigation data directly. *A good backdoor:* A lot of people are trying to build a custom firmware for parrot ar drone. Technically a custom modified firmware or a replacement for the AR drone program.elf is enough as a substitute for a backdoor. But what we have now are highly unstable. The entire operation of AR drone is done via program.elf which is not opensource. Reversing and figuring out the serial port communication seems really hard, even though I and few other have taken that route. Ref: http://blog.perquin.com/blog/ar-dron...f-replacement/ <http://blog.perquin.com/blog/ar-drone-program-elf-replacement/> https://github.com/ardrone/ardrone https://github.com/felixge/go-ardrone http://embedded-software.blogspot.in...le-format.html <http://embedded-software.blogspot.in/2010/12/plf-file-format.html> *Building the Backdoor:* The drone controller program.elf interacts with the navigation board using the following serial ports. /dev/ttyO0 —> rotors and leds /dev/ttyO1 —> Nav board /dev/ttyPA1 — > Motor driver /dev/ttyPA2 —> accelerometer, gyrometer, and sonar sensors /dev/video0 --> /dev/video1 — > video4linux2 devices /dev/i2c-0 /dev/i2c-1 /dev/i2c-2 /dev/usb-i2c [image: Name: ida_re.jpg Views: 4501 Size: 37.0 KB] program.elf like any other serial port programing uses linux syscall open to read devices . Since program.elf is using those ports, our backdoor would not be able to interact with those sensors. Since we do not have an ideal solution for replacing program.elf and accessing sensors. *Maldrone Idea.* Step 1: Kills program.elf Step 2: Setup a proxy serial port for navboard and others. Step 3: Redirect actual serial port communication to fake ports Step 4: patch program.elf and make it open our proxy serial ports. Step 5: Maldrone communicates to serial ports directly Now all serial communication to navboard goes via Maldrone. He can intercept and modify data on the fly. It will connect to botserver and make it available for botmaster. More technical details of the hack would be presented at Nullcon . http://nullcon.net/website/goa-15/about-speakers.php *Disclaimer *What ever we are demonstrating is for educational purpose only.Working at Citrix has given me the flexibility to conduct research in an area i’m very passionate about. This “maldrone” research was conducted solely by me, Rahul Sasi, and does not reflect the products or vision of Citrix. I am a very curious person . The objective of this research was to learn about Artificial Intelligence programming and get answers to few questions I had. Regards, Rahul Sasi http://twitter.com/fb1h2s http://www.linkedin.com/in/fb1h2s _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists