Hacking Microdrones for Lethal Gain

An assassin's most powerful new weapon could be resting on the shelf at your neighborhood Best Buy. 

Warfare is no longer about dumping thousands of men in a field and shooting at each other. Today, non-governmental forces are packing explosives onto commercially available drones and flying them over crowded areas. This past August, a dissident organization called Soldiers in T-Shirts attempted to assassinate Venezuelan President Nicolás Maduro using a drone. While this attempt was unsuccessful, it marked the first time -- but almost certainly not the last -- that a paramilitary organization tried to assassinate a sitting head of state with a drone.

As early as 2012, Business Insider was sounding an alarm about hacking microdrones for lethal gain. The magazine posited the question: What if mosquito-sized drones could deliver deadly viruses to targeted humans? 

It sounds like bioengineered- and- virological science fiction with a macabre twist. But as President Maduro can attest, we're not far away from it being a reality. Swarms of microdrones armed with viruses, poisons, or other technological weaponry could pose a serious threat to national security and human life in conflict zones. In January, 2018, Forbes magazine interviewed Randall Nichols, a professor of unmanned systems and cybersecurity at Kansas State University. "It is clear to me that increased global investments and research in advanced UAS cyber-related technologies are yielding clever, advanced offensive cyberweapons as payloads," Nichols said. "Combine this with investments and growth in automation capabilities and add ability/threat to use swarming and team efforts with multiple drones against U.S. targets, we have a potential Black Swan event."

The key to global power may rest on a fleet of technological objects the size of an insect but with extraordinary power for good or evil, depending upon whose hands it rests in.

What is a microdrone?

Microdrones have no official specifications, but Wikipedia does a good job defining them. "A micro air vehicle (MAV), or micro aerial vehicle, is a class of miniature UAVs that has a size restriction and may be autonomous. Modern craft can be as small as 5 centimeters." That's smaller than a golf tee or about 3.5 times as long as an aspirin. Basically, these devices are just like the Tracker Jackers your kids read about in The Hunger Games. Only real.

Like the deadly jackers of fiction, microdrones actually emerged from the study of insects. Scientists at Stanford University and at the École Polytechnique Fédérale de Lausanne received funding from the Swiss government to make an electronic, human-controlled robotic wasp. Called the FlyCroTug, this microdrone was built to carry proportionally large and heavy items across long distances the way wasps carry home too-large prey in the wild. According to its write-up in Popular Mechanics, the FlyCroTug possesses three carrying features -- winches, gecko grippers, and microspines -- the same ones a wasp uses. These features give the FlyCroTug the ability to do more than fly around and observe. They also also the microdrone to walk, climb, grasp, and build.

How can microdrones be weaponized?

In 2008, the Air Force Research Laboratory began fashioning the world's first micro-sized killer robot. Larger drones may sometimes misidentify targets, cannot respond to a last-minute maneuver by a target, and can injure or kill nearby civilians so the Air Force decided to create something more focused. It came up with a wasp-sized microdrone that weighed less than one pound and could be controlled at a distance of up to three miles. It only took $1.75 million of American taxpayers' dollars to create. The Chinese military development technologists are working on similar technology.

Microdrones can carry far more weight than they appear able to, 40x as much. Plus, they can work together in swarms, which means a few dozen of them can carry the same virus, poison, or explosive to the same population, exponentially increasing the viability of their threat. Not only that, but they can also work together to accomplish tasks such as opening doors.

Perhaps most disturbing is the concept of hacking microdrones for lethal gain. In this scenario, a terrorist, rogue state actor, or wired-up teen techno-whiz in his mom's basement would not need to build his or her own insect-sized weapons. They could just turn ours against us. By hijacking our drones, outside forces gain control over powerful weaponry. As James O'Malley put it in his article in Engineering and Technology, "There are now thousands of devices out in the wild running insecure firmware. But instead of being used to attack cyberspace, they can be let loose on the physical world."

A microdrone's ability to target terrorist leaders and others who pose a threat to geopolitical security may prove worth the investment. The scary part, of course, is what happens when the other side can create the same technology -- and use it without concern for ethics or the safety of the larger population. 

Is the microdrone threat legit or make believe? 

Are deadly microdrones really something to fear or are they science fiction from the minds of popular techno-whizzes who've read too many Margaret Atwood novels? 

That depends on what you're talking about when you say "microdrone threat." If you are asking about swarms of self-controlled robots that make their own ethical decisions about who lives and dies in a dystopian society, then we're probably a long, long way from that. On the other hand, a microdrone in the hands of a non-state actor like Osama bin Laden or a powerful and unpredictable rogue state like North Korea could wage acts of terror and destabilization on society.

Of course, microdrones carry enormous power for good, too. They could provide significant first-response aid to people experiencing natural catastrophes, potentially saving lives and property due to their ability to mobilize, move fast, and go into tiny spaces where human personnel cannot. On the other hand, credible scientists, academics, and public policy makers also express concern about what microdrones can do and the magnitude at which they can do it.

Both Elon Musk and the late Stephen Hawking called for a ban on developing autonomous weapons, and they specifically mentioned "armed quadcopters." The Future of Life Institute, a Musk-backed think tank, published UC-Berkley professor Stuart Russel's movie Slaughterbots, which showed the power of an army of micro-sized robots could have against humans. The movie was shown at the United Nations Convention on Conventional Weapons in Geneva in 2017, too.

According to a March 2018 article from the National Academies of Sciences, Engineering, and Medicine, "The emergence of inexpensive small unmanned aircraft systems (sUASs) that operate without a human pilot, commonly known as drones, has led to adversarial groups threatening deployed U.S. forces, especially infantry units. Although the U.S. Army and the U.S. Department of Defense (DOD) are developing tactics and systems to counter single sUASs, a new report by the National Academies of Sciences, Engineering, and Medicine emphasizes the need for developing countermeasures against multiple sUASs -- organized in coordinated groups, swarms, and collaborative groups -- which could be used much sooner than the Army anticipates."

Clearly, serious people take the microdone threat as a genuine concern.

What is the magnitude of a lethal microdrone's potential damage?

In 2015, Israel was already selling a seven-pound drone that could carry a one-pound warhead. Tinier microdrones of the future could feasibly carry equally powerful explosives.

Much more threatening, perhaps, than bombs -- which amount to little more than ultra-sophisticated TNT, after all -- are diseases. Could a swarm of microdrones infect a city with dengue fever, which might not prove fatal but could certainly cause chaos and damage, or even something worse such as plague? Entire cities could potentially be at risk.

By combining the delivery power of a drone with the specificity of a virus, bad actors could expose select targets to a disease specifically designed to attack their genetic makeup. For instance, if a terrorist wanted to kill the U.S. president, he would need only the president's DNA map, a trained virologist, a microdrone, and a copy of the president's schedule to do it.

The stuff of futuristic political thriller shows on Netflix? Maybe. Or quite possibly a reality that nation-states will increasingly need to guard against. 

How much does a microdrone cost to buy or make?

Small size drones are typically cheaper than their older and larger counterparts. NewEgg says you can buy a Micro Drone 3.0 kit, the quadcopter, gimbal, transmitter, and Google Cardboard VR headset for $215. The replacement batteries cost $16, and the device is tough enough for a child to use. Many small drones go for between $20 and $150 on Amazon. Typically, these drones sell to kids and to beginning enthusiasts who want to fly them for fun around the neighborhood, not generally to notorious terrorists who want to assassinate Western politicians. Still, it was a very ordinary drone that Soldiers in T-Shirts used in its assassination attempt on Venezuelan President Maduro. 

And if you're a real DIY-er, you can even build your own microdrone if you want. YouTube and Google offer step-by-step tutorials for crafting a low-cost, fun-to-fly microdrone. For many hobbyists, building your own drone at home is a great way to save money. For terrorists, it's not yet a viable way to construct high-tech weaponry, but it soon could be. Remember that the 9/11 terrorists hijacked entire airliners with nothing more than boxcutters. Super technological skills are not required to build weapons of mass destruction.

In short, you can't buy a wasp-sized robot killer at Target or Best Buy. But could you buy what you need to make it happen? 

 Can you weaponize a microdrone yourself? 

Since microdrones are easy to come by, are they equally easy to weaponize? Is there a DIY way to make a killer robot at your kitchen table? How vulnerable are these devices to hacking? Can a teenage computer enthusiast take over one with his controller and direct it where he wants, hijacking it for his own use?

People have used drones for all kinds of nefarious purposes, from prison breaks to drug smuggling. Basically, you can weaponize anything. In 2013, Adam Piore described his drone weaponization journey in a humorous article for Popular Mechanics. "In this Wild West age of unregulated personal flight, even a rank amateur like myself can transform a toy into a hazard, an action that should be—and probably soon will be—illegal."

It is neither expensive nor complicated to build, weaponize, or hijack a microdrone. That isn't to say you can sit in your garage and craft a military-grade weapon with supplies from Target and a YouTube tutorial. You could, however, build a device that would do a lot of damage. And after all, does a terrorist need a military-grade weapon to assassinate a single target? Or to deliver a deadly, contagious virus to a few folks in a massive city?

While no one wants to sound alarmist at the threat microdrones may pose, the fact is that drone technology opens up the possibility of new kinds of warfare, terror, crime, and security. By blending cyber technology with physical activity, drones are a logical next step both for those who want to threaten others and those who want to protect them.

As part of our commitment to cybersecurity, Alpine Security offers extensive penetration testing services for companies and government agencies based on our deep experience testing medical devices, blockchain, aircraft, embedded systems, and complex systems. Our highly trained, certified, vetted, and experienced team uses a proven process and effective penetration testing methodology to provide clients with actionable, easy-to-understand reports. Contact us to learn more about how Alpine Security can help you protect the data, systems, and people you care about -- from data leaks to armed killer robots.