Drones: invisible to radar but vulnerable to primitive viruses?

Undated handout image courtesy of the U.S. Air Force shows a MQ-1 Predator unmanned aircraft (Reuters / U.S. Air Force / Lt Col Leslie Pratt / Handout)

The billion-dollar defense complex that keeps America safe and sound is yet again under attack, with an antiquated computer virus now apparently attacking the Pentagon’s drone aircraft fleet.

Sykipot, a malicious piece of malware that has been around since at least 2006, was recently waged at the computer systems of US governmental department and defense contractors. Although Symantec, a world-wide leader in anti-virus protection calls the Trojan neither “sophisticated” nor “well-coded,” new reports confirm that the malware was emailed to DoD-affiliated authorities in an attempt to do even more damage to the top-secret drone program.

Drones, unmanned robotic aircraft used by the Pentagon and CIA in surveillance and missile-firing missions, are controlled from remote bases across the world. Despite the advanced technology of the impressive crafts, however, the US recently lost two planes in just as many weeks. First came the interception of a Sentinel RQ-170 craft in Iran on December 4, with a similar craft succumbing to a fiery crash in the Indian Ocean days later.

In the wake of the downing of the Sentinel, Iran engineers made claims that they hacked into the GPS network used by the drone commanders by way of a loophole they say the US government well aware of. In the days since, other reports have suggested the CIA headquarters have also been infiltrated by anti-American forces, with military officials telling Israel-based news outlet Debka that the downing of the drone over Iran could only have been conducted with a high-tech attack on the command center itself.

Now the website Information Week has tried making light of the latest virus, Sykipot, and in identifying it has realized that it has been waged against the Pentagon in hopes of damaging more drones.

According to Information Week’s Mathew J Schwartz, Sykipot was sent in the form of an email attachment to DoD contractors. Often the email will include a malicious Adobe Acrobat .PDF file or a hyperlink that will trigger the virus.

“In targeted attacks,” writes Schwartz, “attackers often include information--in the form of attachments--that they think recipients will find interesting. Conversely, this highlights the type of information that attackers are seeking.” In the case of a slew of emails sent to Pentagon pals, the messages related to drone crafts, specifically the Boeing joint unmanned combat air system X-45 and the Boeing X-37 orbital vehicle.

The Alien Labs Vault blog dives deeper into explaining Sykipot, noting that the Trojan infects Microsoft’s Internet Explorer and Outlook programs, as well as Mozilla’s Firefox browser. From there, the virus connects into internal servers and retrieves encrypted configuration files which can then be executed externally, the results of which are then relayed to a server where the maker of the malware can investigate the results.

The site also notes that most of the servers that manipulate the malicious program are running off a particular webserver named Netbox, which while used across the world, is almost exclusively operated from China.

Symantec adds on their website, “Given the long list of command and control servers being used for controlling the botnet, the attackers are unlikely to be a single person, but rather a group of people. Thus, the Sykipot attackers are likely to be an organized and skilled group of individuals. Given their persistence and their long-running campaigns, the attackers are likely to have consistent funding for their efforts.”