The U.S. military does not think much of Iraqi militants’ technological capabilities. How else to explain the fact that their Predator drone surveillance planes used unencrypted links to send down to their military operators? The lack of encryption means that the drones’ data is less secure than most home wireless internet networks, a serious vulnerability in the unmanned aerial network.
According to a story in The Wall Street Journal today, video feeds from Predator drones have been intercepted by militants in Iraq. Senior defense and intelligence officials said Iranian-backed insurgents intercepted the video feeds by taking advantage of an unprotected communications link in some of the remotely flown planes’ systems. Shiite fighters in Iraq used software programs such as SkyGrabber — available for as little as $25.95 on the Internet — to regularly capture drone video feeds, according to a person familiar with reports on the matter [The Wall Street Journal]. Officials are saying that they don’t believe militants were able to take control of the drones, but by downloading the videos they were able to keep up with which areas were being monitored.
The Defense Department has responded by saying they discovered the vulnerability a year ago, and are working to encrypt all drone communications links in Iraq, Afghanistan, and Pakistan. However, there are at least 600 unmanned vehicles and thousands of ground stations to upgrade, so the security improvement will not happen overnight. However, officials say they have made technical adjustments to systems in key threat areas to block the signal interception.
The breach arose because the Predator unmanned aerial vehicles do not use encryption in the final link to their operators on the ground. (By contrast, every time you log on to a bank or credit card Web site, or make a phone call on most modern cellular networks, your communications are protected by encryption technology) [CBS News]. After a Shiite militant was captured in Iraq with a laptop full of intercepted drone feeds, and following similar discoveries, officials concluded that groups were trained and funded by Iran to intercept and share video feeds.
The problem is similar to street criminals listening to police scanners, according to Dale Meyerrose, former chief information officer for the U.S. intelligence community. The military has known about the vulnerability for more than a decade, but assumed adversaries would not be able to exploit it [AP]. The surveillance network described in most news reports suggests that the final link between the drone and the operator is between a satellite flying around in space and that that final link is unencrypted for reasons unfathomable to anyone with even cursory knowledge of network communications. Maybe they wanted to save on bandwidth costs [Crunch Gear]?
Following the publication of The Wall Street Journal’s story on the security breach, Bryan Whitman, a U.S. defense official and Pentagon spokesman, said on Thursday that they have fixed the leak, but declined to discuss any details.
Image: U.S. Air Force
Source: A Hack of the Drones: Insurgents Spy on Spy Planes With $26 Software
