Theodore Reed (graduated 2011)
Joseph Geis (graduated 2011)
SkyNET is a stealth network that
connects hosts to a botmaster through a mobile drone. The network
is comprised of machines on home Wi-Fi networks in a proximal
urban area, and one or more autonomous attack drones. The SkyNET
is used by a botmaster to command their botnet(s) without using
the Internet. The drones are programmed to scour an urban area and
compromise wireless networks. Once compromised, the drone attacks
the local hosts. When a host is compromised it joins both the
Internet-facing botnet, and the sun-facing SkyNET. Subsequent
drone flights are used to issue command and control without ever
linking the botmaster to the botnet via the Internet. Reverse
engineering the botnet, or enumerating the bots, does not reveal
the identity of the botmaster. An analyst is forced to observe the
autonomous attack drone to bridge the command and control gap. In
this paper we present a working example, SkyNET complete with a
prototype attack drone, discuss the reality of using such a
command and control method, and provide insight on how to prevent
against such attacks.
- The paper can be found here There is also a video and audio of the presentation.
- Video describing the SkyNET drone, and some flight examples. You can also get a local copy.
- Press coverage (selection):
We would like to acknowledge the generous donation to this project by PC Antivirus Reviews.
Last update: October 17, 2011