Category Archives: drones

NASA hacking?

A post on allegations of NASA being hacked from Del Brazil of Advent IM

There have been allegations of numerous hacks into the systems controlled or operated by NASA. These have ranged from secret UFO files being accessed, through to drones being infiltrated and subsequently controlled by unauthorised persons.

Advent IM Cyber SecurityThis raises the questions about how secure the NASA websites, servers and systems are.  There are a whole host of individuals who claim to have hacked NASA including a 15 year old who is alleged to have caused a 21 day shutdown of NASA computers, through to an individual who claims to have found evidence that NASA has or is in the process of building ‘space warships’ and finding lists of ‘non-terrestrial military officers.’

The latest alleged hack involves the release of various videos, flight logs and personal data related to NASA employees.  This hack is believed to originally to have started over 2 years ago with a hacker paying for initial access; although it is not yet confirmed, it is fair to assume that this purchase would be associated with a NASA employee.  The hacker then carried out a ‘brute force’ attack against an administers SSH password, resulting in a successful compromise within 0.32 seconds as the password is alleged to have been still set to the default credentials.  Having infiltrated the system with an administrator’s Image courtesy of Master isolated images at FreeDigitalPhotos.netpassword the hacker was then pretty much free to navigate his/her way around various NASA systems collecting information as they went.  It’s not unusual to find CCTV systems and/or other Base Management Systems Administrator settings being still set on their default setting, what is unusual is to find that NASA has systems are potentially falling foul of this too.  There were also claims that one of NASA’s unmanned drones used for high altitude and long duration data collections had been partially taken control of during the hacking with a view to potentially crashing it in the Pacific Ocean.

The information claimed to have been obtained includes 631 videos of weather radar readings and other in-flight footage from manned and unmanned aircraft between 2012 and 2013 along with personal information related to NASA employees.  It is widely

Image courtesy of digitalart at FreeDigitalPhotos.net

image courtesey digitalart on freedigitalphotos.net

 

reported on the internet that the personal information obtained relating to the NASA employees has been verified by another media client, as they have allegedly attempted to contact those individuals by telephone; although it is further reported that no actual conversations took place and that verification was obtained from answerphone machines pertaining to those NASA employees.   There is no reports that the same media client has received any return calls from the alleged NASA employees nor is there any documented communication from NASA’s IT Security Division, the Glenn Research Center, the Goddard Space Flight Center, the Dryden Flight Research Center, the NASA Media Room or the FBI.

This is certainly not the first and won’t be the last alleged hack of NASA.  It is well known that there are a whole host of individuals who are continuously attempting to attack large organisations; whether their motive be criminal or just inquisitive you can be assured that any alleged successful hack will make headline news. Hackers are widely regarded as kudos- seekers; reputation and status hungry within their own fields and targets like this are very highly sought after.

Protected filesLet’s consider the sensitivity of the alleged data?  Any sensitive or ‘secret’ information is likely to be securely stored in a manner to prevent or at least deter any potential hacker; however no system is 100% secure and so there is, albeit very small a possibility that a hacker maybe successful.

NASA have responded by stating that ‘Control of our Global Hawk aircraft was not compromised. NASA has no evidence to indicate the alleged hacked data are anything other than already publicly available data. NASA takes cybersecurity very seriously and will continue to fully investigate all of these allegations.’  So the old ‘he said, she said’ playground argument continues with neither party being proved or dis-proved but what we do know is that hackers will continue to attack high profile organisations for ‘Kudos’ status or bragging rights.

Advertisements

Got a Drone for Christmas? Don’t forget Registration and Regulation

Whilst trying to contain my disappointment at not getting Millennium Falcon drone in my stocking, I asked Advent IM Security Consultant, Del Brazil, what the implications are for those of us who do have drones, Star Wars based or not…

Civil Aviation Authority (CAA)

Image courtesy of Salvatore Vuono at FreeDigitalPhotos.net

Image courtesy of Salvatore Vuono at FreeDigitalPhotos.net

As Christmas has been and gone many of us will now be the proud owner of a drone in some form or another.  The excitement and thrill of being in control of your own flying machine coupled with maybe a camera of some description is only matched by the recent hype related around the new Star Wars movie.  Some people including the author may disagree including; however some people may view the freedom of flying a drone quite a fun hobby but we all have our own vices.

The CAA defines a drone as an unmanned aircraft which unlike traditional remote controlled model aircraft, which have been used by enthusiasts for many years, have the potential to pose a greater risk to the general public and other aircraft.   Unlike manned or model aircraft there are currently no established operating guidelines so operators may not be aware of the potential dangers or indeed the responsibility they have towards avoiding collisions.  Anyone flying a drone either recreationally or commercially has to take responsibility for doing so safely.

The CAA’s focus is purely safety. For the criminal use of drones, including harassment, anti-social behaviour or damage to property, it is a police matter. If people have concerns about a drone being flown in public they should call the police, a CAA spokesman says. “Local police can assess the situation in real time and, if there is any evidence of breaching the air navigation order, they will pass on any information on to us.”

It has been reported that the CAA has prosecuted two Unmanned Aerial Vehicle (UAV) operators relating to safety breaches with another four investigations pending. The Association of Chief Police Officers was unable to say how many prosecutions the police have made over drones but there have been a few; although during the ongoing House of Lords select committee inquiry on remotely piloted aircraft systems, Chief Inspector Nick Aldworth of the Metropolitan Police said: “We do not have a criminal privacy law in this country, so it is not the concern of the police to try to develop or enforce it.”

Is there any other legislation that drone operators may fall foul of?  Well according to Chief Inspector Aldworth “The most obvious example to date is the Sexual Offences Act 2003 and the specific offence of voyeurism.”

The number and frequency of incidents being report around the world is on the increase which include a Euro 2016 qualifier in Belgrade being stopped after a drone trailing an Albanian flag was flown over the stadium whilst in France a number of nuclear power stations were buzzed by drones in a number of mysterious incidents.

A number of associations affiliated with flying and/or airspace The British Airline Pilots Association (BALPA) is campaigning for drones to be programmed not to enter certain airspace – known as geo-fencing. The Phantom series of drones, sold by manufacturer DJI, already includes geo-fencing. The GPS of the drone is programmed with the co-ordinates of thousands of airports around the world. It cannot enter these areas. If it tries to it will be forced to land. And within a 2km radius of a major airport its height will be capped at just 10m.

Another step that BALPA is calling for is that, just like with a car or television, people purchasing a drone would have to give their personal information to the retailer and that this information should be logged or that there is a requirement for users to register their drones with the relevant authority.  This has a twofold effect in that if a drone is apprehended the owner can be traced to ensure that it is returned to its rightful owner and that it may also assist in any investigation relating to illegal activity that may have been undertaken by the operator.

Another possible solution would be to build in strict height limitations just like the Phantom 2 which is limited to a height of 400 feet; although this is likely to be easily circumvented with software.

Regulations have just come into play in the United States which requires hobbyists to register drones as small unmanned aircraft systems on the Federal Aviation Administration website.  The online registration service is active but it is unclear as to the scale of uptake and amount of registrations that have actually taken place thus far.

In Ireland as of 21st December 2015 it is now mandatory for all drone operators to register any drone that weighs more than 1kg in accordance with the Small Unmanned Aircraft (Drones) and Rockets Order S.I. 563 of 2015.  There is clear ‘do’s and don’t guide’ available on the Ireland Aviation Authority (IAA) website.

At present there is no actual regulation in place within the UK that requires operators to register their drones; however that is likely to change as more incidents occur that not only threaten life but also privacy.  There are plans afoot within the House of Lords EU Committee for a drone register to be created which initially would capture business and professional operators and eventually normal consumers too.  There is an Official UK Drone Register but this is specifically for drone operators/owners who voluntarily add their details to a public register to aid in returning drones if they go astray.

Round-up: Top posts of 2015

2015 is almost over and we have been pleased and delighted to welcome many new followers and contributors to the Advent IM Holistic Security blog. It’s hard to wade through all the content but we thought it would be nice to present you with a list of some of our most popular posts this year, by month. (This is based upon what people read and not necessarily when they were published.)

jAN 2015In January, we warned you to watch out for phishing emails if you had nice shiny new devices for Christmas. We were recognised as Cyber Security Solution Suppliers to Her Majesty’s Government and we enjoyed a visit from The Right Honourable Francis Maude to talk all things CyberSec.

 

In FFEB 2015ebruary, we had a visit from James Morrison MP to talk about how cyber attacks affect local and national businesses, we launched Whitepaper on CCTV in schools and discussed the key ‘watch-outs’ in off-shoring data in relation to Data Protection

 

MAR 2015In March, we were exhibiting and speaking at the Security & Policing Event at Farnborough (we will be at the next one too, watch this space for details!) Mike Gillespie’s quote in The Sunday Times, talking about SMEs and Cyber Security back in 2014 suddenly shot back up the blog statistics, as people explored some of our older posts.

 

april 2015In April, law firms were in the sights of the ICO and we blogged about it and people looking for Senior Information Risk Owner Training found their way to the blog. Of course, if you do want to book training you need to go via the website

mAY 2015

In May, Ransomware was on everyone’s radar, including ours.  A lot of readers also sought out an old post on mapping the control changes in ISO 27001 2005 vs. 2013 and we were glad they found our tool to help them with this. We think that more businesses will want to think about this standard in 2016 as security awareness continues to grow and the common sense reveals the huge commercial benefits.

JUN 2015In June, the changes to EU Data Protection regulations had a lot of people talking. Dale Penn gave a no nonsense post, explaining what it meant and it was very well received. We had a Risk Assessment methodology post from Del Brazil, talking, Attack Trees. A post that was also very well read came from Julia McCarron who discussed the risk in continuing to run Windows XP

JUL 2015In July, Social Engineering was a key topic and one of our blog posts was very well visited, The Best Attack Exploit by Dale Penn is still receiving visits. Dale also wrote about hacking Planes, Trains and Automobiles, with clarity, as well as the coverage this kind of hacking was receiving.

AUG 2015In August, we heard about Hacking Team being hacked and it revealed some very risky security behaviour. Dale Penn wrote about this event and other security specialists being targeted. In August, a very old blog post started to get some traffic again as people wanted to read about secure destruction of hard drives and a guest post from Malcolm Charnock got hoisted back into the charts.

SEP 2015In September, TOR was in the press sometimes as a hero, but usually as a villain…well perhaps not a villain but certainly suspicious. We tried to throw some light on what TOR is for the uninitiated and explain why and how it is deployed by a variety of users. It came courtesy of Del Brazil. Another very old post on USBs also got raised from the archive – The Ubiquitous Security Breach.

OCT 2015In October, traffic to the blog doubled and we welcomed many more new readers. All of the posts mentioned here were read but far and away the winner was Crime of Our Generation from Chris Cope, talking about TalkTalk’s disastrous breach.  Marks and Spencers were discussed by Julia McCarron in light of their own security failure. Attack of the Drones discussed a variety of drone-related areas, uses and unintended consequences. A nuclear power plant worker was found researching bomb making on a laptop at work and the EU Safe Harbour agreement melted away. It was a very busy month…

NOV 2015In November, The Bank Of England expressed some firm opinion on cyber security requirements in the Financial sector. Morrisons staff took to the courts to sue over the data breach that exposed their personal information. Australia jailed a former junior bureaucrat who leaked defense material onto the notorious 4Chan website. The previous posts on TalkTalk, M&S, BoE, Safe Harbout and EU DP Regulations were also extensively read in November.

dEC 2015And finally, December…Well the Advent Advent Calendar has been a festive fixture for three years now so we had to make sure it was included and it has, as always,  been well trampled and shared. We also added a new festive bit of fun in the form of the 12 Days of a Phishy Christmas and some Security Predictions from the team for 2016. Why would anyone hack the weather? was a look at how attacks can be intended for other parts of a supply chain. Finally TalkTalk popped up in the news and a conversation again, as it emerged that Police had advised the firm not to discuss their breach.

Christmas card 2015

Attack of the Drones – guest post from Julia McCarron – Advent IM Director

So this week came the worrying news that mobile phones attached to drones can hack Wi-Fi devices and steal our data. That Star Wars script of yesteryear could be coming into its own! Oh hang on … that was Clones not Drones J But seriously, the use of drones in warfare is becoming more and more prevalent, so could their use in cyber hack-attacks become a common threat too?

Image courtesy of Victor Habbick at FreeDigitalPhotos.net

Image courtesy of Victor Habbick at FreeDigitalPhotos.net

Drone usage in war and the fight against terrorism is a concept that’s been explored by TV and film script writers for a long time. (SPOILER ALERT: An insight into my television habits coming up). 5 years ago an episode of Spooks saw an American drone hacked by the enemy in Afghanistan. An episode of NCIS a couple of years ago saw a systems engineer steal a surveillance drone for the purposes of selling it to a terrorist group who then bombed a high profile event attended by the US military. An episode of Castle saw a government drone hacked and used to kill a government whistleblower. Far-fetched? Maybe. Possible? Definitely. Likely? Well we would hope not! But as we often see, TV dramas have a nasty habit of bringing reality to our screens and indeed drone usage has been part of our warfare arsenal since 1959, albeit they were unsophisticated unmanned aircraft essentially.

Drones have many other uses aside from warfare, cyber or otherwise. The US Navy for example uses tiny drones called Cicada containing sensor arrays that monitor weather and location. But they also have microphones that can eavesdrop on conversations within their vicinity. A useful tool for espionage?

Since 2013 the Police Service Northern Ireland have deployed drones as surveillance cameras to support policing operations during royal visits, political summits, the Belfast Marathon, searching for missing persons and the Giro d’Italia. Arguably a positive use of unmanned aerial vehicles as crime prevention and detection aids and possibly deterrents.

In July this year, a student Videographer shot footage of 4 young people running across a school

Image courtesy of Salvatore Vuono at FreeDigitalPhotos.net

Image courtesy of Salvatore Vuono at FreeDigitalPhotos.net

roof in Northern Ireland. He lived nearby and spotted them on the roof, so sent his drone out to inspect what was going on. The children got spooked and jumped down, running for cover.  Private use of this nature however does open up a wider privacy issue in the same way that CCTV coverage does.

So how can they be used to steal data? Researchers at the National University of Singapore announced on Monday that by attaching a mobile phone containing two different apps to a drone, they successfully accessed a Wi-Fi printer and intercepted documents being sent to it. The apps were designed so that one detected open Wi-Fi printers and identified those vulnerable to attack and the other actually detected and carried out the attack by establishing a fake access point, mimicking the end device and stealing the data intended for the real printer. These are techniques they claim that ultimately could be used by corporate spies for industrial espionage, or indeed by terrorists.

As drones are yet to become common place in our everyday lives, it is likely that we would spot the physical threat before the cyber attack occurs. Today. But what about tomorrow? In the last 30 years technology has taken over our lives. Who would have thought we’d all be carrying around a telephone in our back pockets, that’s also a computer and literally voices, “Don’t forget it’s your Mother’s birthday”!

At some point, in the not too distant future, seeing drones flying above our heads will become the ‘norm’. And that’s when our guard will be down and drone attacks won’t just be connected to air strikes but cyber hack-attacks too.

Its 1984 meets Star Wars but this time it will be ‘Attack of the Drones’. May the Force be with us all!