Commercial use of drones isn’t widespread, but with the recent announcement of Amazon Prime Air, it looks like it may only be a matter of a few years before we see drones moving packages and products to and fro. Many people have expressed concerns, for example, what’s to stop someone from shooting down an Amazon drone and stealing the package? That may not be the only threat that these drones, or other similar drones, might face. SkyJack is a drone that’s capable of hacking drones flying near it and handing over control to the attacker.
Developed by hacker Samy Kamkar, known for his “Samy” exploit that brought down MySpace back in 2005, SkyJack uses a Parrot.AR.Drone with a Raspberry Pi circuit board attached alongside two wireless transmitters and a small battery. It is able to detect wireless signals of nearby Parrot drones, hack into those wireless connections and commandeer the drone’s flight and camera systems. SkyJack is also capable of running on devices based on Linux and hacking drones that are within radio range. Kamkar won’t be manufacturing and selling SkyJack drones, he has made all hardware and software details that hobbyists need to know to build their own drone capable of hijacking other drones. Kamkar rhetorically wondered on his blog that “How fun it would be to take over drones, carrying Amazon packages… or take over any other drones and make them my little zombie drones.”
Actually, it all boils down to how secure a drone’s wireless connection is. At this point in time, SkyJack can only hack into drones that have MAC addresses within a specific block reserved by Parrot.AR.Drones, so if a MAC address that falls outside that block is detected, SkyJack isn’t able to commandeer that drone. However, the software has been developed in such a way that drones with communications systems similar to Parrot may be susceptible to remote hacking as well. I believe Amazon will pay particular attention to the communication systems of its delivery drones, because it certainly wouldn’t want packages ending up where they’re not supposed to.