Iran: Yes, We Hacked the U.S.'s Drone, and Here's How We Did It

Daily Tech ^ | December 15, 2011 7:00 PM | Jason Mick (Blog)

[Ernest_at_the_Beach]

Iran rebuffs skepticism with a detailed description of attack, which experts call "certainly possible"

"You are going to tell me what I want to know, it's just a matter of how much you want it to hurt."
— Jack Bauer, 24

It sounds like a scene out of a spy movie -- highly trained national paramilitary operatives harshly testing a foreign agent until they break and do their bidding. But that's exactly what Iran is claiming it did to a U.S. Central Intelligence Agency spy drone.

In an unconfirmed, yet fascinating report in The Christian Science Monitor, an unnamed "Iranian engineer" claims that Iran used its torture testing from past crashed drones to break the captured drone and bend it to the command of the Iranian authorities, forcing it into a soft landing so they could probe the secrets of its fully intact body.

I. Iran warned the U.S. of its Capabilities

The report points to claims Iran made in September that it was able to "take control" of U.S. guided weapons or surveillance devices.  

Iranian Gen. Moharam Gholizadeh, the deputy for electronic warfare at the air defense headquarters of the Islamic Revolutionary Guard Corps (IRGC), told the Far News, "We have a project on hand that is one step ahead of jamming, meaning 'deception' of the aggressive systems... we can define our own desired information for it so the path of the missile would change to our desired destination...all the movements of these [enemy drones are being watched]" and "obstructing" their work was "always on our agenda."

At the time the claims by Iran -- under pressure for its suspected nuclear weapons development program -- were largely dismissed as factless national rhetoric.  

Similarly, when Iranian state-run media revealed last week that it had captured a U.S. intelligence drone, many experts sneered at Iran's claims that it "hacked" the drone.  Remarked an analyst to the Defense News, "[it'd be] like dropping a Ferrari into an ox-cart technology culture."

But while the detailed description of the "electronic ambush" from the interview with the Iranian engineer has not been verified by U.S. military officials, the U.S. gov't and public are now forced to set aside their prejudices and look at those claims far more seriously.

_{[Image Source: Sepahnews/AP]}
According to the source, the first thing the Middle Eastern nation's "cyberwarfare experts" did was to jam the drone's signal.  While the report does not specifically mention this, the engineer's claims of using past crashed drones to derive the attack indicate that Iranian experts may have used drones to determine the encrypted control frequencies that the drone was communicating on.

Further evidence that adversaries in the region are on to U.S. UAV feed frequencies comes from the fact that in 2009 Iraqi Shiite militants intercepted live, unencrypted video feeds off a U.S. predator drone, using only off-the-shelf hardware.  At the time, Iranian involvement was suspected.

In July and in 2010 Iran claimed to have shot down drones hovering near its nuclear facitilities.

II. "Downing Drones 101"

Using its knowledge of the frequency, the engineer claims, Iran intiated its "electronic ambush" by jamming the bird's communications frequencies, forcing it into auto-pilot.  States the source, "By putting noise [jamming] on the communications, you force the bird into autopilot. This is where the bird loses its brain."

The team then use a technique known as "spoofing" -- sending a false signal for the purposes of obfuscation or other gain.  In this case the signal in questions was the GPS feed, which the drone commonly acquires from several satellites.  By spoofing the GPS feed, Iranian officials were able to convince it that it was in Afghanistan, close to its home base.  At that point the drone's autopilot functionality kicked in and triggered the landing.  But rather than landing at a U.S. military base, the drone victim instead found itself captured at an Iranian military landing zone.

Spoofing the GPS is a clever method, as it allows hackers to "land on its own where we wanted it to, without having to crack the [encrypted] remote-control signals and communications."

_{[Image Source: Reuters]}
While the technique did not require sophistication from a cryptography perspective, it was not entirely trivial, either, as it required precise calculations to be made to give the drone the proper forged distance and find and fine an appropriate altitude landing strip to make sure the drone landed as it did in Afghanistan.  The Iranian engineers knew the details of the landing site, because the drone had been confirmed in grainy photos to be landing at a base in Khandar, Afghanistan.

Despite the careful calculations, the drone still sustained a dent in its wing and underbody (though it did not have the usual signs of a high-speed collision).  During its press conferences, the Iranian military covered this damage with anti-American banners.

_{[Image Source: Iranian state television]}

The engineer explained this damage commenting, "If you look at the location where we made it land and the bird's home base, they both have [almost] the same altitude.  There was a problem [of a few meters] with the exact altitude so the bird's underbelly was damaged in landing; that's why it was covered in the broadcast footage."

The approach echoes an October security conference presentation [PDF] in Chicago, in which ETH Zurich researchers laid out how to use interference and GPS spoofing to more gently down a drone.

III. Is the West "Underestimating" Iran?

Iran warns that the west is underestimating its growing technlogical prowess.  A former senior official is quoted as saying, "There are a lot of human resources in Iran.... Iran is not like Pakistan."

Deputy IRGC commander Gen. Hossein Salami, stated this week, "Technologically, our distance from the Americans, the Zionists, and other advanced countries is not so far [as] to make the downing of this plane seem like a dream for us … but it could be amazing for others."

The Christian Science Monitor report cites an unnamed European intelligence source as claiming that Iran in an unreported incident managed to "blind" a CIA spy satellite by "aiming a laser burst quite accurately" at its optics.  And in September Google Inc.'s (GOOG) security certificates were hacked to give access to 300,000 Iranian citizens Gmail accounts, in what circumstantial evidence indicated was a "state-driven attack," potentially designed to ferret out spys or dissidents.

For now Iran military and government workers -- including the engineer -- are giddy with joy at their success, according to the report.  The source is stated as remarking, "We all feel drunk [with happiness] now.  Have you ever had a new laptop? Imagine that excitement multiplied many-fold."

What they captured was no mere Reaper or Predator -- it was an advanced RQ-170 Sentinel design, made by Lockheed Martin Corp. (LMT) for the CIA.  

He said that members of the National Guard initially feared that the drone was rigged to auto destruct, but eagerly moved to inspect it anyways because they "were so excited they could not stay away."

III. U.S.: Drone Missions to Iran Will Continue

It's important to remember that while the attack described in the report sounds very feasible, it has not been confirmed by the U.S. government, and may never be.  It now appears that the government is at least acknowledging that the drone is a real U.S. drone, as opposed to early reports in which some officials indicated it might be fake Iranian propaganda/publicity stunt.

Former U.S. Navy electronic warfare specialist Robert Densmore told The CS Monitor that Iran's claims were "certainly possible", adding, "I wouldn't say it's easy, but the technology is there... Even modern combat-grade GPS [is] very susceptible [to manipulation]."

The U.S. has claimed that the drone was not spying, but was flying a standard mission over Afghanistan, when it suffered a "unspecified technical malfunction" and went of course, landing in Iranian hands.  They declined to explain how the drone -- flying at high altitude -- could have avoided sustaining serious damage.

U.S. President Barrack Obama has requested that Iran return the drone to U.S. officials.  Iran has refused.  IRGC Brig. Gen. Mohammad Hejazi, comments, "That is a shameless demand raised by the U.S. President.  They raise such claims instead of apologizing to our Islamic establishment and people."

_{Iran has refused President Obama's demands that it return the drone.
[Image Source: Matt Ortega/Flickr]}
Instead, Iran is filing a complaint with the United Nations Security Council, stating, "My government emphasizes that this blatant and unprovoked air violation by the United States government is tantamount to an act of hostility against the Islamic Republic of Iran in clear contravention of international law, in particular, the basic tenets of the United Nations Charter."

Despite that, Defense Secretary Leon Panetta told Fox News that the U.S. would "absolutely" continue to fly drones in the region.  The implied message -- but one that the U.S. military does not officially acknowledge -- is that the hunt for Iranian nuclear weapons activity will continue.

If confirmed, Iran's new drone downing capabilities are a concern.  Currently there's no real secure replacement for GPS satellites -- though China has done pioneering work in creating a state-run GPS network with an encrypted channel..  However, U.S. military suppliers could solve this issue by resorting to more advanced software.  For example a drone could be programmed to:

1. Store GPS coordinates, starting from launch from a "friendly" location and recognize internally large changes to the GPS.
2. Store a "friendly" air-space return path using the GPS history and known routes.  This could allow a drone to escape in a case of jamming like this one, and would prevent the enemy from trying a more slow and subtle modification of GPS coordinates on a jammed drone.

The new "Avenger" drone from General Atomics will soon be deployed to the region.  It's capable of holding a 2,000 lb. missile on attack missions.

Iran recently developed bomber UAVs of its own, though they are believed to be human-controlled designs, which trail the U.S.'s sophisticated UAVs, which are capable of autonomous flight, thanks to their advanced artificial intelligence.

V. Iran Threatens Afghanistan, Afghanistan Tells it to Leave it Out of U.S. Mess

Tensions rose on Thursday when Iran warned its neighbor Afghanistan that it would consider any further drones detected launching from U.S. bases in Afghanistan a "hostile act" by the Afghanis.  Iran's foreign minister Ali Akbar Salehi comments, "We have called on the Afghan government to seriously pursue the case, and under no circumstances let such events happen again, as such events will be regarded as unfriendly."  

It's hard to know exactly what Iran could do in response, given the U.S.'s support for the Afghani government.

The suggestion was enough, though, to rattle Afghani President Hamid Kharzai, who claimed not to know about the drone, stating, "Afghanistan was not aware that the drone had gone or malfunctioned in Iran."

_{Hamid Kharzai told Iran that he wants their nations to be friends and to leave them out of its issues with the U.S. [Image Source: CNN]}

He added, "Afghanistan would not want to be involved in any - how should I put it, not antagonism, adversarial relations between Iran and the United States. Afghanistan wishes that they be friends and Afghanistan's sovereignty and territorial integrity and soil is not used one against the other."

Afghanistan currently gets much of its domestic goods from Iran, a Middle Eastern manufacturing powerhouse.  A trade blockade would, of course, hurt debt-plagued Iran, but it's not entirely impossible that the nation's leadership could resort to such a mutually destructive move out of spite.

VI. Hostilities Between Iran and U.S. Continue

Iran, Israel, and the U.S. continue to be locked in a feud over Iran's reportedly nuclear weapons development.  The U.S. claims their evidence indicates Iran is secretly building bombs.  Iran claims its nuclear weapons activities are peaceful and solely for power purposes.

In addition to allegations of spying, Iran has publicly accused the U.S. and Israel of direct sabotage to its nuclear effort.  They point to the sophisticated "Stuxnet" worm, which specifically targetted Iran's nuclear power facilities, with the goal of sabotaging refining centrifuges.  Their have also been reported assasinations of Iranian nuclear scientists and unexplained explosions at Iranian factories/nuclear facilities.  Again, the Iranians point to U.S. and Israeli intelligence as the perpetrators of these incidents.

While Iran has never officially gone to war with the U.S. or its allies, although it did wage a war with Saddam Hussein's Iraq in the 1980s, a war in which the U.S. government was exposed to be funneling weapons and expertise to Iraq, weapons that would be turned against the U.S. in later conflicts.  The U.S. support of Iraq generated much bitterness and resentment among the Iranian revolutionary movement.

That bitterness has even deeper roots in the U.S. support for The Shah (Persian for "king") who, together with his father had ruled Iran for 54 years with U.S. support.  While the U.S. support helped modernize Iran, his policy of crushing dissidents and his imprisonment of Shiite religious leader Ayatollah Ruhollah Khomeini create pent-up hatred towards the monarch, animosity that exploded in the Iranian revolution of 1978.  

That revolution installed a theocratic government much of the kind that some Christian fundamentalists have called for here in the U.S. -- in which the state had a religion of choice, but (supposedly) offers freedom of religion via legislative protections for religious minorities. 

Some prominent America politicians such as Sen. John McCain (R-Ariz.) have called for the U.S. legal system to recognize the U.S. as a Christian theocracy [source].  Sen. McCain emphasizes "tolerance", but suggests that he would be uncomfortable with allowing a Muslim to be President of the United States.    Likewise Iran, in the 1980s went through a period of increasing its own "tolerance" efforts in the 1980s, allowing its Christian and Jewish minorities to hold token political positions, albeit barring them from top positions of federal power.

Despite the similar fundamental governing philosophies between "conservative" evangelicals in the U.S. and Iranian fundamentalists, the U.S. evangelical movement have led some of the harshest criticism of Iran, though curiously going light on U.S. ally Saudi Arabia, a nation which practices and preaches an even more theocratic religious rule.

Iran has exactly done its best to win friends among moderates in the U.S., though.  It's been accused of funneling weapons to guerillas in the 1982 and 2006 conflicts between Lebanon and the U.S.-backed Israel.  

The U.S. fears -- and perhaps rightly so -- that a nuclear armed Iran could lead to catastrophic destruction of its ally Israel and U.S. military bases in the Middle East.  They also fear the nation could threaten the stability of secular democracies in Iraq, Afghanistan, and Pakistan, funneling support to religious insurgents.  

Israel remains more non-chalant, claiming it can shoot down any Iranian nukes that come its way.  Israel and Iran are currently engage in a cyberwar.

The Islamic republic is a puzzle for the Western world, and its neighbors to deal with in coming years.  Iran, despite economic problems and foreign economic sanctions continues to grow.  It recently passed the 1 million market in yearly automobile production, making it the top domestic producer of cars in the Middle East.  Iran has the benefit of holding the world's second richest natural gas reserves and third richest oil reserves.

In 2009 Iran launched its first satellite into space.

_{Iran is a growing power in terms of education and technology, making its political and military clashes with the U.S., all the more problematic.}

[Image Source: Google Images, original author unknown; 
Fair Use clause TITLE 17 > CHAPTER 1 > § 107]
It also claimed to have 3.5 million college students enrolled in 2008 [source] -- a 4.4 percent enrollment rate which compares approaches U.S. enrollment rates. The U.S. reported in 2009 20.4 million college students enrolled [source], roughly a 6.7 % per capita enrollment rate.  While Iranian propoganda makes it hard to tell whether these numbers are entirely accurate, Iran does appear to have higher college education rates that many of its Middle Eastern peers.

Sources: Christian Science Monitor, ETH Zurich, MSNBC, Fox News

[Ernest_at_the_Beach]

Santoran had some choice words for Paul and why the techniques used against Russia of Mutual Assured Destruction won't work against Iran....as their theme is Matrydom....

Gingrich had a lot to say on other topics ,....some good stuff on reforming the Judicial branch and getting after some off the crazy Activist judges.

[MediaMole]

That “drone” doesn’t look right. It doesn’t look like the photos of the Sentinel that have been published and it looks pretty lightly built for a military device.

IMHO, it looks like some sort of big counterintelligence scam. The Iranians down a big RC aircraft that looks like a real drone. Maybe it’s loaded with computer viruses or just a bunch of stuff designed to make them think they have something while they have nothing.

[DB]

I’d guess the most likely case is the Iranians were able to jam the control signals to the plane for an extended period of time and in the absence of control it automatically landed. It isn’t good to have something that big flying around with no control.

[Bobalu]

None of this rings true at all.

Even a novice design team would build in at least triple layer watchdog systems.
There is no way a simple loss of GPS would cause all the systems to fail. Furthermore,
corruption of one system by trojan or virus would not take out the other watchdog
systems. These systems are kept isolated from each other by code base and power supply
and in some instances they have different design teams to ensure against sabotage.

Any one of the redundant systems would either result in the drone returning to friendly
airspace or the destruction of the craft.

GPS is not the sole method of determining the crafts location. They can follow terrain
just as a cruise missile can by referencing mapping data. GPS can give a drone pinpoint
navigation but that is overkill, within a few hundred yards is sufficient and even the
old system of inertial guidance can handle that.

The notion that the craft sustained damage because the landing strip is not at the same
altitude as the real one somewhere in Afghanistan is absurd! A sophisticated drone does
not rely on GPS to determine height above a runway, such a task is child’s play for even
a low dollar radar altimeter system. A remote controled plane enthusiast could build such
a system for his toy planes.

You simply cannot jam the communications system of a drone from the ground! They have
a link to low orbit satellites and the antenna for this is atop the craft and shielded from
a signal located on the ground. A break of this link would also result in a countdown to
self destruct that could only be halted by an encrypted code sent back from the drones
control point.

There is much much more I could say, I will say that this whole story strikes me as ridiculous
in the extreme.

[JohnKinAK]

I don’t believe the Iranians did it on their own, but instead it was done by Russian techs in Iran and this is essentially a cover story for the Russians. Russian is neck deep into the Iranian nuclear and other military programs.

[dynoman]

I call BS too. I wonder at what step they painted it that tan/white color? Our RQ-170s are gray.

[JohnKinAK]

The Muzzies talk a lot about Martyrdom..........but only a very small percentage actually engage in it. 99+ percent of them know in their heart it’s all BS and the urge to live supersedes any martyrdom indoctrination. The fact is that 9/11 was primarily an immigration failure, hell the plan was almost aborted because 1 conspirator wasn’t allowed in the country. If even just a few more of the remainder had been deported for overstaying their visas or better yet not granted student visas in the first place; the plot would have collapsed.

I fear my current Government’s turn towards tyranny more than a bunch of Muzzies on the other side of the world.

[Little Pig]

Not related to the main topic, but buried in the text:

“That revolution installed a theocratic government much of the kind that some Christian fundamentalists have called for here in the U.S. — in which the state had a religion of choice, but (supposedly) offers freedom of religion via legislative protections for religious minorities. “

WTF? And it goes on to imply that McCain supports that kind of thing?

Really diminishes the credibility of the rest of this article.

[okie01]

Who said it was in their air space?

Well, we really don't know, do we. I confess to making an assumption that might not necessarily be true.

But what's the point of flying one of those suckers around that part of the world...if you're not sticking your nose into Iran's air space?

Still, they could've taken control -- if they did, in fact, "take control" -- on either side of the border.

[jonrick46]

The Russians may be giving aid on a higher level than we realize. The Iranians may have used a Russian satellite to disrupt communications to the drone. What the Iranians are saying is a cover story for what they actually did. I say they have our encryption code and actually landed the drone with their own control signals relayed by Russian satellite. I believe somebody compromised secrets to our drone control system allowing Iran to change control frequencies which took control away from U.S. operators. The reason the drone suffered bumps and scrapes is because the Iranian remote control operators were not as skilled in flying the drone. With a drone in their hands, they can build one of their own to practice with.

[rawcatslyentist]

Oh., This is much more believable than Muzzie in Chief flat out sold it to the Russian. Yeah, much more believable.

[raygun]

You began with Jack Bauer; therfore the rest must be true.

Many on this board were Jack Baur sychophants, so lets let the fantasy run out to its copmletion...

Jack Bauer dropped the ball.

[vanilla swirl]

“Maybe it’s loaded with computer viruses or just a bunch of stuff designed to make them think they have something while they have nothing.”

“they wanted me to build them a bomb, so I took their plutonium and, in turn, gave them a shoddy bomb casing full of old used pinball machine parts!”

[aces]

Iran already has nukes, they have a large army in Mexico and a force in America already...Russia , china using them..

[Vinnie]

This implies our entire military GPS guidance system has been compromised.

Where would a GPS guided smart bomb hit. Not likely where it was supposed to.
The entire GPS system needs to either be trashed or an upgrade.
With China, and likely Russia, having the ability to destroy GPS satellites, Iran et al able to spoof signals, it’s worthless.

Then there’s EMP.

[Soul of the South]

“That is an act of war.”

A US military drone operating in a foreign nation’s airspace without the permission of that nation could certainly be considered an act of war.

Unfortunately the US is the aggressor in this situation. We invaded Iran’s airspace, with a military aircraft. If it is in their airspace, without their permission, they have the right to shoot it down. I would expect the US to take the same action if an Iranian drone was found in US airspace.

Once again the US is involved in military action without following the requirements of the Constitution. If there is a reason to be at war with Iran the Constitution clearly requires the President to go to Congress and ask for a Declaration of War. If Congress votes yes we go to war, if Congress votes no, the President cannot initiate hostile action against other countries. Flying military aircraft over a sovereign nation’s airspace without permission is hostile action. It is also unconstitutional for the President to take such action without a Declation of War.

Over the past 60 years the US has killed and wounded hundreds of thousands of people and consumed trillions of dollars of taxpayer money in unconstitutional wars initiated by Presidents acting on their own without the formal Declaration of War required by the Constitution. The over reach by the unchecked imperial executive branch has reached the point where it now claims the unconstitutional power to declare US citizens “terrorists” in the homeland and deny them their constitutionally protected, God given, liberties without due process of law.

Korea, Vietnam, Bosnia Kosovo, Afghanistan, Iraq, Somolia, Libya are just some of the unconstitutional uses of American armed forces over the past 60 years. All of these hostile actions, involving the US military invading sovereign territory, may have been noble causes essential to the defense of the homeland. If these costly applications of military force were justifiable, they could have withstood the scrutiny of sober debate and vote in Congress prior to being initiated.

War is a serious matter and the founders were wise to require the chief executive to go to secure the affirmative vote of the representatives of the people before committing the blood and property of the people to foreign adventures, the founders also understood the seriousness of invading a sovereign nation. It pains me to see our modern nation so eager to ignore the Constitution and commit our military around the globe in aggressive actions at the whim of the executive branch. Our reputation around the world as an imperialist aggressor nation is well deserved.

George Bush going to war in Iraq to overthrow Saddam and create a “democratic” state is the equivalent of Iran invading the US to create an Islamic republic or China invading the US to create a communist dictatorship.

I have no doubt Iran is an enemy of the US and it may have the intent to do this nation harm. If there is imminent threat, the President can go to Congress, show the evidence, and ask for a formal war declaration. If he isn’t following the Constitution, the threat must not be serious.

Don’t forget, the US military has shot down an unarmed Iranian civilian airliner without provocation, killing over 100 of its citizens. if we are justified in shooting down a civilian airliner in international airspace, perhaps the Iranians should be excused for downing a military aircraft invading their airspace. Going back further in history the US government in the 1950’s facilitated the overthrow of the lawful government in Iran to put the Shah on the throne. Iran has historical reason to view the US as an threat.

Returning to the Constitution, imagine if Jimmy Carter had responded to the takeover of the US embassy in Terhan by telling the Iranians quietly through diplomatic channels if the didn’t release the hostages immediately he would go to Congress and request a Declaration of War. Had he done so I suspect the Iranians would have backed down. If not, the invasion of the embassy was an act of war in that embassy grounds are considered to be an extension of the guest nation’s territory under international law. If Congress then voted a formal war declaration the Iranians would have faced justified military action to repatriate the hostages or extract revenge in the event the Iranians harmed them. This lawful exercise of US power would have sent a very powerful message to Iran and the rest of the world. It might actually have prevented the first Gulf War as Saddam would not hav underestimated the will of the US to fight in the region.

For those who argue Iran is a threat and we are justified on that basis to use our military capability against them at the whim of the President, I ask why not Venezuela, or Cuba? They are much closer to the homeland. Why not China? China is a future threat, they’ve made no secret of their intent to defeat us. Plus China has been engaging in a damaging trade war with us for 20+ years, is engage in espionage and cyber warfare everyday.

It is unfortunate the US lost an intact drone. However the downing of that drone was not an act of war against the US. The US invaded sovereign airspace with a military aircraft. That nation was justified in in removing the invader through whatever means it chose.

[org.whodat]

And how did they know it was up there, it has the radar signature of a very, very small bird. Anyway it crash landed the tap on the wings is a bad attempt at hiding where they broke off.

[Little Ray]

Screw that. Why hasn’t a 3000lb JDAM dropped through the roof of the hangar or warehouse where they’re keeping the drone?

[bert]

-——why is NASA collaborating with Mooses-—

You lack the sophistication to discriminate between our friends and our enemies. We have both. For that reason we permit our friends to participate in our space efforts

[BuffaloJack]

If we had a president instead of a community organizer, this would not have happened. Iran committed an OVERT ACT OF WAR by deliberately spoofing the operational signals and frequencies that this AMERICAN drone uses.

Iran has declared war on the USA, but our Sissy In Chief, Obama, fails to recognize it or act on it.