NATIONAL PROTECTION AND PROGRAMS DIRECTORATE | OFFICE OF CYBER AND INFRASTRUCTURE ANALYSIS
UAS FOR WIRELESS SYSTEM EXPLOITATION
Malicious actors could utilize UASs in order to wirelessly exploit access points and unsecured networks and
devices. This can include using UASs in order to inject malware, execute malicious code, and perform man-in-the-
middle attacks. UASs can also deliver hardware for exploiting unsecured wireless systems, allowing malicious
actors persistent access to the wireless system until the hardware is detected or runs out of power. While OCIA
does not know of a confirmed incident utilizing UASs to exploit wireless systems, researchers have demonstrated
this capability.
In 2016, researchers in Israel flew a UAS outside of an office building and were able to compromise smart
lightbulbs installed within the building using equipment attached to the UAS. The researchers were able to
perform over-the-air firmware updates to take control of the lightbulbs at a range of 350 meters.
,
In 2015, researchers in Singapore attached a smartphone holding applications to a UAS to detect printers
with unsecured wireless connections. The researchers flew the UAS outside an office building, had the
phone pose as the printer, and tricked nearby computers to connect to the phone instead of the printer.
When a user sent a document for printing, the phone intercepted the document and sent a copy to the
researchers using a 3G or 4G connection. The document was then sent to the real printer so the user
would not know the document had been intercepted.
,
UAS FOR EXTRACTING INFORMATION
In addition to computer systems exploitation, UASs can be equipped to receive exfiltrated data sent through a
visual or radio signal that a malicious actor may not otherwise be able to access due to physical barriers, heavily
defended networks, and air-gapped systems.
In 2017, researchers in Israel demonstrated the ability to exfiltrate data from an air-gapped computer
utilizing the computer’s hard drive indicator LED light. Malware installed through separate means on the
computer manipulated the LED light to blink rapidly, with information encoded and sent through the LED
light. A camera attached to a UAS outside the window received the data transmitted from the LED light.
While the use of UASs for information extraction is possible, the risk for infrastructure operators of this technique
being used for the theft of large amounts of data is low. OCIA does not know of a confirmed incident utilizing a
UAS to extract information, and the use of such a method would require a high level of sophistication in order to
extract a limited amount of data. Such a method, however, could be used in order to steal small amounts of highly
sensitive data to be used in future malicious actions, including information on critical infrastructure systems,
administrative credentials, and encryption keys.
MALICIOUS ACTORS CAN EXPLOIT COMPROMISED UAS
While UASs can be used as a tool for an attacker, they are also vulnerable to exploitation. Many commercial UAS
variations, for example, currently communicate with ground stations and operators using unencrypted feeds. This
can allow a malicious actor to intercept and review data sent to and from the UAS.
,
Malicious actors can target UASs belonging to critical infrastructure operators, using vulnerabilities within UAS
software or firmware in order to compromise the systems and access sensitive networks and information.
Malware can also be pre-installed in a UAS application or in UAS software or firmware by a malicious actor with
access to the UAS’ supply chain. Likewise, embedded malware could compromise the computer, phone, or tablet
An air-gapped system refers to a system which is not directly connected to the Internet or connected to other systems that are connected to
the Internet. Zetter, K. (2014). “Hacker Lexicon: What Is an Air Gap?” Wired. www.wired.com/2014/12/hacker-lexicon-air-gap/. Accessed
January 16, 2018.
While the researchers did not state how the air-gapped computer became infected with the malware, three potential methods were
mentioned: supply chain attacks, social engineering, and hardware with pre-installed malware. Guri, M. et al. (2017). “LED-it-GO: Leaking (a lot
of) Data from Air-Gapped Computers via the (small) Hard Drive LED.” https://cyber.bgu.ac.il/advanced-cyber/system/files/LED-it-GO_0.pdf, p.
4. Accessed March 20, 2018.
