Hackers have proved that it is possible to steal information, including Amazon passwords, bank details and even home addresses from smartphones that have Wi-Fi turned on, using specially adapted drones (a stock image of a quadcopter is pictured)
The test was conducted in London and the group will share their findings at the Black Hat Asia cybersecurity conference in Singapore next week, CNN reported. The drone, known as Snoopy, seeks out smartphones that have Wi-Fi turned on. It then makes use of built-in technology which can see what networks the phones have accessed in the past. In theory, almost any drone could be adapted to do this. HOW CAN A DRONE STEAL SOMEONE'S IDENTITY? The drone, known as Snoopy, seeks out smartphones that have Wi-Fi turned on. It then makes use of built-in technology which can see what networks the phones have accessed in the past. In theory, almost any drone could be adapted to do this. Phones 'noisily' reach out to networks, according to the experts. Snoopy looks for this activity and when hovering nearby it emits a signal masquerading as another network. The phone ‘trusts’ that it is accessing a trusted Wi-Fi network but instead connects to the quadcopter's network. Snoopy can then intercept everything a smartphone sends and receives and allows skilled hackers to see passwords, bank details and the phone's location. . London-based Sensepost security researcher Glenn Wilkinson, said: ‘Their phone will very noisily be shouting out the name of every network its ever connected to. 'They'll be shouting out, “Starbucks, are you there?...McDonald's Free Wi-Fi, are you there?”’ When this happens, Snoopy hovers nearby and emits a signal masquerading as another network and the phone ‘thinks’ it is accessing a trusted Wi-Fi network. However, when it connects to the quadcopter’s network, Snoopy will intercept everything a smartphone sends and receives using a complicated method described by the company. Wilkinson said: ‘Your phone connects to me and then I can see all of your traffic.’ He is able to see the websites a person visits, any credit card information entered or saved, their location, usernames and passwords. In the wrong hands, this could potentially leave a mystified smartphone user out of pocket. The hackers managed to gain access by looking at a unique identification number known as a Media Access Control (MAC) address. This number matches web traffic to a specific device. To demonstrate the effectiveness of the technology, Wilkinson spent an hour with CNN showing them how he could obtain network names and GPS coordinates for 150 smartphones used by Londoners. While collecting metadata and network names is not strictly illegal, intercepting passwords and credit card details with the intent of using them is. The ethical hackers said they're demonstrating the technology to highlight how vulnerable smartphone users can be. The drones might seem even more threatening to people than remote hackers because the aircraft can hover close to potential ‘victims’ are incredibly mobile. There is a prospect that the technology could be put to good use for law enforcement purposes, however, such as identifying looters in a riot. While it is not thought that anyone is currently using this snooping technique in the real world, smartphone users can protect themselves by shutting off their Wi-Fi when they are not using it, or only access secure networks.
