September 7, 2023 By Mike Elgan 3 min read

Cybersecurity staff at an East Coast financial services company last summer detected unusual activity on its internal Atlassian Confluence page originating inside the company’s network. The MAC address used locally belonged to an employee known to be currently using the same MAC address remotely, according to a security specialist named Greg Linares, who had secondhand information about the attack.

So, the team used a Fluke AirCheck Wi-Fi Tester device to identify the device logged in, which led the team to the roof of the building. And what they found there surprised everybody: Two drones.

One drone was a DJI Phantom with an attached Wi-Fi Pineapple device, commonly used for penetration testing but misused in this case to hijack an internet connection (The device spoofed the legitimate network, and when employees tried to log in to the fake network, they revealed their login credentials). The second drone was a DJI Matrice drone with a connected Raspberry Pi, a tiny GPD laptop, a modem, a Wi-Fi device and some batteries.

(A later investigation revealed that the Phantom drone had been used days before to capture the worker’s credentials undetected.)

Fast action by the security team thwarted a more damaging attack. But the perpetrators were never caught.

How drones can enable cyberattacks

Using drones in cyberattacks was theorized long before real attacks happened. For example, nearly a decade ago, security researcher Samy Kamkar created a drone rig that he called SkyJack, which was designed to use custom software on an attached Raspberry Pi to take control of other drones in flight autonomously.

Other tech researchers demonstrated conceptual hacks over the years. But after last year’s hack described above, drone hacking has gotten very real in the war between Russia and Ukraine. That war is considered the first full-scale “hybrid war,” combining military with cyber warfare. And drones play a role in that conflict in the gathering of intelligence, the bypassing of physical security, jamming communications (and drone signals themselves) and the delivery of malware.

In general, drones are useful to cyber attackers because they can perform a range of high-flying functions:

Physical surveillance: Drones equipped with high-quality cameras can be used to observe shift changes, gather information on security protocols and plan physical attacks.

Network sniffing and spoofing: Hackers can equip drones with small, modifiable computers (like a Raspberry Pi) to sniff out information about a Wi-Fi network, such as the MAC addresses and SSID. The drone can then mimic a known Wi-Fi network. If unwitting employees connect to this fake network, hackers can access sensitive information. This approach can be used to bypass security protocols and gain direct access to a network.

Denial-of-Service attacks: Drones can carry devices to perform local de-authentication attacks, a type of Denial-of-Service (DoS) attack that targets communication between a user and a Wi-Fi wireless access point. They can also carry devices to jam Wi-Fi or other communications.

Why the risk grows every year

While Ukrainian ingenuity is pioneering tactics for using consumer drones for cyberattacks, the drone industry itself is rapidly improving drones in ways that make them better suited to that purpose.

Drones are evolving quickly to become quieter and faster, fly further from their operators, fly around all obstacles, track moving objects and take much higher-resolution pictures and videos.

To pick one random, specific example, a cyber attacker could sit in the corner of an office parking lot to track an employee. Using an under-$700 DJI Mini 3 Pro (too light to require registration and folds up to fit into a pocket), the hacker could select the employee’s car and press a single on-screen button to lock on. As the employee drives away, the drone automatically follows and tracks the employee’s car while shooting 4k video as far away as seven miles. Once the employee arrives home, the drone could land on the roof and begin hacking the home network used by the employee’s home office. From there, the attack possibilities are obvious.

Five years ago, this set of capabilities would have cost thousands of dollars. Ten years ago, they would have been impossible.

Consumer drones are evolving quickly to become increasingly valuable to cyber attackers.

How to protect against consumer drone-enabled attacks

As drone-powered cyberattacks transition from theoretical to practical to (in the future) widespread, the time is now to safeguard against this emerging threat. Here’s how:

  • Inspect physical security with drones in mind. Evaluate physical spaces accessible by drones where networks and visual data are exposed.
  • Deploy network segmentation and intrusion detection.
  • Consider wired network connections instead of wireless, where drones could hover or land.
  • Include drone-enabled attacks in penetration testing to discover vulnerabilities.
  • Use privacy screens on user systems where sensitive or credential data might be displayed.
  • Place motion-detection cameras on rooftops to alert about drones if they land.
  • Embrace security standards and controls and best practices like zero trust security architectures.

While solid security practices, tools and services are the best protection, it’s really time to re-think physical security and consider all the many ways drones can defeat it.

More from Risk Management

Back to basics: Better security in the AI era

4 min read - The rise of artificial intelligence (AI), large language models (LLM) and IoT solutions has created a new security landscape. From generative AI tools that can be taught to create malicious code to the exploitation of connected devices as a way for attackers to move laterally across networks, enterprise IT teams find themselves constantly running to catch up. According to the Google Cloud Cybersecurity Forecast 2024 report, companies should anticipate a surge in attacks powered by generative AI tools and LLMs…

Mapping attacks on generative AI to business impact

5 min read - In recent months, we’ve seen government and business leaders put an increased focus on securing AI models. If generative AI is the next big platform to transform the services and functions on which society as a whole depends, ensuring that technology is trusted and secure must be businesses’ top priority. While generative AI adoption is in its nascent stages, we must establish effective strategies to secure it from the onset. The IBM Institute for Business Value found that despite 64%…

Ermac malware: The other side of the code

6 min read - When the Cerberus code was leaked in late 2020, IBM Trusteer researchers projected that a new Cerberus mutation was just a matter of time. Multiple actors used the leaked Cerberus code but without significant changes to the malware. However, the MalwareHunterTeam discovered a new variant of Cerberus — known as Ermac (also known as Hook) — in late September of 2022.To better understand the new version of Cerberus, we can attempt to shed light on the behind-the-scenes operations of the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today