If you hear “beep, beep” like the Roadrunner is overheard, then it’s likely you’d look up even if you didn’t anticipate the sound to be coming from a drone. Yet you’d hear no warning as Snoopy the flying drone launches a man-in-the-middle attack and silently sucks all the data out of your smartphone.
At Black Hat Asia in Singapore, SensePost researcher Glenn Wilkinson will raise awareness of mobile device vulnerabilities with a presentation titled “The Machines That Betrayed Their Masters.”
You’d be looking up for a drone if you were expecting a delivery from your pharmacy like the plans in the works for QuiQui drones to deliver prescription medicines and other drugstore goods to San Francisco’s Mission District. The “drones will fly below 500 feet, for a $1/delivery fee and will operate 24 hours a day — with orders arriving in less than 15 minutes.”
You would be alerted that your items arrived via the QuiQui app and then "swipe to drop." CEO and founder Joshua Ziering wants the drone to drop the delivery, beep like the Roadrunner, and then fly away.
But with Snoopy flying overhead, there would be no telltale “Beep, beep” to snag your attention. Instead, the noisy one is your smartphone. Snoopy, “a distributed tracking and profiling framework," was developed by SensePost Research Lab researchers Daniel Cuthbert and Glenn Wilkinson and was claiming victims by 2012. Now Snoopy has been mounted on a quadcopter and flying over London spoofing Wi-Fi networks. The researchers were able to obtain “network names and GPS coordinates for about 150 mobile devices” in less than one hour. They also stole Amazon, PayPal and Yahoo credentials.
Here’s the thing, mobile devices such as smartphones are constantly searching for Wi-Fi networks that they remember connecting to in the past. That connectivity feature is both a convenience and a risk; while you may have your smartphone put away in your pocket or your purse, it can automatically connect to a familiar wireless network. Snoopy, like the WiFi Pineapple, can spoof Wi-Fi networks and trick your device into connecting to it.
"Their phone will very noisily be shouting out the name of every network its ever connected to,” explained SensePost security researcher Glenn Wilkinson. "They'll be shouting out, 'Starbucks, are you there?...McDonald's Free Wi-Fi, are you there?"
CNN Money added, “Devices two feet apart could both make connections with the quadcopter, each thinking it is a different, trusted Wi-Fi network. When the phones connect to the drone, Snoopy will intercept everything they send and receive,” including passwords, usernames, sites visited, credit card numbers entered, and location data. Snoopy also scoops up the MAC address, tying the traffic to a specific device. The researchers were even able to track a phone to the owner's home.
Not all drones are intent on “evil” surveillance to invade your privacy; we’ve looked at some cool drone innovations and a war-flying, Wi-Fi-sniffing drone that could be used for more “wicked” purposes like penetration testing. But a Snoopy drone really should make you stop and think about just how easily your leaky mobile device can betray you. Wilkinson warned, “Such signals may be used to track you, or be used toward more malicious intent.”
It’s wise to turn off your device’s Wi-Fi when you are out and about and otherwise not using it. “Check which Wi-Fi network you're connecting to,” the researchers advised. “If you're connecting to Starbucks when you're nowhere near a branch, something's wrong.” You should “tell your phone to forget networks once you're done with them, and be careful about joining ‘open’ aka ‘unencrypted’ networks.”