Exclusive: Iran hijacked US drone, says Iranian engineer

EVERY time I pick something from the built-in list of restaurants, it doesn't matter whether I pick Chinese, Mexican, Italian or whatever...

I get halfway there, and the thing starts "recalculating... recalculating" and then guides me to the exact same Persian restaurant.

Bastards.

It's no secret that the Iranians purchased broad spectrum radio jammers from the Russians recently that are capable of jamming all radio communications, including spread spectrum encrypted communications. It's also public knowledge that GPS signals are unencrypted (which is why your cell phone and car navigator can use it).

So, if they fired up that jammer and blocked all general communications to that drone, while simultaneously feeding it a second radio signal on the GPS bands (presumably with a powerful transmitter on a second aircraft, capable of walking over the jamming signal), you can essentially tell that aircraft that it's anywhere you want it to be. If you start feeding it bad GPS data, you can "steer" the aircraft wherever you want it to go, as its onboard computers try to "correct" its heading to stay on course. The onboard computer would merely think that it's correcting for wind.

The idea is brilliant, and fairly simple. Aside from a bit of readily available hardware (and one high tech jammer conveniently provided by Russia), the only thing you'd need is a software app that could calculate the fake GPS headings in realtime to steer the aircraft. Most second year CS majors could write that (it's just a bit of math).

There's no way the Iranians could have done that on their own, if that's what actually happened.

Just like there is no way they could ever build nukes.

1. Directional GPS antennae on the drone that only look up - designed specifically to ignore ground based GPS signals.

2. Military systems use a military only GPS message (M-code) that is designed specifically to be jam proof. It uses high power spot beams that are much more powerful than standard GPS signals.

3. The M-code is encrypted.

4. GPS jamming works best when the jammer is between the transmitter and the receiver. See number 1


Military GPS is specifically designed to combat the scenario you suggest.

This is absurd propaganda of one flavor or another. Either U.S. to inflame the cause against Iran, or Iranian to pretend that they somehow have vast technical expertise that led to the capture of the drone rather than just having it fall in their lap.

1. The Iranians DO have aircraft, including plenty of jet aircraft capable of flying circles around a drone. Drones aren't particularly fast. I'd imagine that the person controlling it, and the equipment used to do so, were probably located in another aircraft within visual range. It's not hard to imagine that it was simply sitting above them. It's no real secret that drone pilots have fairly limited awareness of the airspace around them.

2. There is no such thing as "jam proof" radio anything. The military has some very advanced radio gear that can evade most jamming, but the Russians have long had technology capable of identifying US Tx bands and stepping on them. You can always try to overpower the jamming signal, but a powerful jammer sitting relatively close to the receiver can overpower any signal broadcast thousands of miles away from an orbital transmitter running off solar powered batteries. Power availability alone gave the Iranians the advantage. A 500 watt jammer running in the back of a cargo plane sitting a few hundred feet over a drone is going to bathe that thing in an impenetrable sea of radio white noise.

4. See #1

You do have a good point with #3, and that's something we should be concerned about. If the Iranians really did what they say they did, they must have had access to the encryption keys used in our gps sats. Obviously the Iranians don't have the computing capability to crack that kind of encryption, but the Chinese and Russians do, and both are trading partners with Iran. Both would also be very interested in getting a look at an American drone. I wouldn't be suprised if, years from now, we find out that the Iranians had Russian or Chinese help to bring this thing down. Both of those countries certainly have the tech to pull this off.

your scenario, while somewhat implausible, is an easy one to prevent.

Point to point data links are nearly impossible to hijack. The geometry has to be exact and can be foiled with simple maneuvers. And you still have problem of breaking the encryption.



The most likely explanation is the drone malfunctioned. Drones have a very high accident rate.

so the idea that an Iranian pilot could see and keep formation on a small blacked out maneuvering drone seems pretty far fetched.

FLIR? You can now buy FLIR systems for Cessna's. It's unrealistic to believe that Iran doesn't already have it on at least a few of their aircraft.

Iran may not be at our level militarily, but they aren't exactly stone age either. While their spending may pale to ours, we're still talking about a country that spends $9 billion a year on its military, including its air forces. I don't see why it's so implausible to imagine that an Iranian pilot could fly formation alongside a relatively slow moving American drone.

Rumsfeld back from the 70's

Is there any reason to not believe that the soviets don't have undetectable submarines using non-accoustical detection systems? That the CIA and the ONI never found it only proves that it DOES exist and that it is even more secret than we previously imagined.

Seriously, this hacker story is crap. It is another neo-con job with a paid source. It is done to increase tension with Iran in hopes of another stupid friggin war and to justify the bloated defense budget that occurred right around the same time period where the defense authorization act was being voted on. Hello fund raiser.

The damned thing crashed. It suffered mechanical or computer error and it crashed.

The idea that the Iranians were hoping to reverse-engineer a glorified plane didn't create adequate "concern" or outrage so now we have this.

Once in control of the Sentinel, Iran reprogrammed the craft's GPS coordinates to make the drone think it was landing at its home base, when actually it was setting down deep in Iran.

"The GPS navigation is the weakest point," the Iranian engineer told the Monitor, giving the most detailed description yet published of Iran's "electronic ambush" of the highly classified US drone. "By putting noise on the communications, you force the bird into autopilot. This is where the bird loses its brain."

The “spoofing” technique that the Iranians used – which took into account precise landing altitudes, as well as latitudinal and longitudinal data – made the drone “land on its own where we wanted it to, without having to crack the remote-control signals and communications” from the US control center, says the engineer.

Read more: http://www.businessinsider.com/the-us-knew-of-downed-drones-vulnerabilities-and-iran-says-it-did-too-2011-12

---

This indicates that they reprogrammed the drone's home base coordinates to a location inside Iran. Then, once it lost communications, it landed there by default.

"Given that the character of a jammer used by an adversary in IW will probably have limited effective
range, global position satellite (GPS) jamming can be mitigated by including a simple
flight management auto-pilot that can just adopt/maintain a heading to clear the jammer
(effecting a simple threat avoidance maneuver).

As for communications jamming, a number of modest-cost electronic counter countermeasure (ECCM) radios exist and are
in use for Group 4-5 (and perhaps Group 3) which, along with a communications architecture that includes alternate control communications paths, can similarly escape the jammed region."

http://info.publicintelligence.net/USAF-RemoteIrregularWarfare.pdf

The Sentinel is a Tier 5 drone - looks like those vulnerabilities don't apply to it.

They also don't explain how they spoofed an encrypted signal and an encrypted M-code GPS message.

Read the report - the US has five tiers of UAvs with different levels of sophistication. Sentinel is the highest level - it is also the most modern system. It will have all the obvious countermeasures.

Once the jammer goes on, the camera operator would lose connection to the aircraft.

I strongly suggest that you do a bit of reading on the Avtobaza. The Russians designed this thing specifically to detect, pinpoint, and jam US military transmissions...ESPECIALLY point to point command and control transmissions. It may be nearly impossible for you or me, or for most third world nations for that matter, but we're talking about tech developed by Russia, a country that has multi-billion dollar annual military research line items dedicated specifically to developing countermeasures to U.S. technology, and one of the few nations in the world with military researchers as educated and experienced as our own.

The Avtobaza was developed with one primary purpose...to intercept and shut down guidance and communication data links between controllers and enemy missile and aircraft control systems. While it was primarily designed to shut down cruise missiles and over-the-horizon missile systems by severing their ability to call home for instructions, it is also fully capable of doing the same thing to a lowly drone. We're talking about a technology that was designed by the Russians specifically to shut down American remote control capabilies.

Both the Iranians and the Russians have confirmed that at least one of them was delivered to the Iranians only a month and a half ago , and they may be in possession of even more. There is nothing implausible about the possibility that the Iranians may have used it to override the drones communications capabilities.

"The Avtobaza ELINT system is designed to detect airborne side-looking radars, air-to ground fire-control radars and low-altitude flight control radars, as well as to provide intelligence data for the 1L125M APUR."

http://www.ausairpower.net/APA-Warpac-Rus-PLA-ESM.html#mozTocId651861

It is not designed to "shut down cruise missiles and over-the-horizon missile systems by severing their ability to call home for instructions". There is no system in the world with that capability.

There are plenty of documents out there detailing everything it can do, though it's obviously difficult to find detailed information because of the language differences and the fact that it's classified hardware. It's detection and intelligence gathering features are only part of its capabilities, and Avtobaza is better described as a full electronic warfare system. In a nutshell, it's designed to detect emissions at any part of the radio spectrum, eavesdrop on those emissions, and interfere with or jam those emissions.

http://www.flightglobal.com/blogs/the-dewline/2011/12/avtobaza-irans-weapon-in-rq-17.html
"The Avtobaza, moreover, is designed to jam side-looking and fire control radars on aircraft and manipulate the guidance and control systems of incoming enemy missiles. It would be the perfect tool to target and perhaps infiltrate the communications link that allows a UAV to be controlled from a remote location."

plus encrypted data link authentication protocols? Why are you so certain that the drone was not specifically designed to prevent such an obviously easy attack? Don't you think the drone had an autopilot function to fly to a safe place if something went wrong? How did those Iranian planes flying in tight formation with a drone escape detection from US radars and sensors?

Isn't the obvious answer simply that something went wrong with the drone? After all, they have a horrendous accident rate.

...I'm just a cynic.

I did a a bit of contract work for a United Defense (before they were bought out by BAE) subcontractor back in the late 90's, writing software for a proposed technology rev for the Bradley. Given my experiences at UD, and the entire "bare minimum to meet the spec and maximize revenue" mindset that pervades defense contractors, I simply don't share the "ooorah our tech is awesome" mindset that a lot of others hold. Some of our defense products have software holes so big you could fly a drone through them.

I genuinely didn't know about the encrypted GPS thing mentioned upthread though. I've never worked with that, and didn't know it existed. Learn something new every day.

As for the rest: I have no idea how they handled the directional signal isse, and couldn't begin to explain how the Avtobaza actually works internally. While I do have a good idea how datalinks work and have plenty of experience using point to point equipment, my specialty is software, not radio gear. The Iranians aren't claiming to have hacked those datalinks, however. Their claim is simply that they jammed the aircraft and manipulated its satellite GPS signal to trick it into changing course. The RQ-170 is believed to be semi-autonomous, so if they managed to convince the craft that it was off-course, it would self correct. If they did manage to override the GPS signal, their story becomes entirely plausible. No fancy formation flying, or army of uber l33+ hackers, required.

Is it possible that the drone simply malfunctioned, went into a flat spin, and slammed into the ground without any major damage? Yes.
Is it probable that the drone malfunctioned and crashed of its own accord? Sure, as you've mentioned, it happens all the time.
Is it possible that the Iranians used Russian gear to override the GPS and guide it to the ground? Yes.
It is probable? Maybe, though admittedly less so. Still, dismissing the possibility outright is a bit naive (though the MIC would love for you to do so, to perpetuate the myth of American military invincibility).

I wouldn't bet actual money on the Iranians having brought it down, but I don't dismiss the possibility either. Their story is plausible.

to take it out of action? The rest of the story could be simply their bragging rights.

on these drones to self destruct or destruct by remote? Something that would wipe out all data and essential hardware? But they (Iranians) took control of landing and also all of our remote capabilities? None of this makes sense to me (not that it would - I couldn't be more uninformed on a subject).

of our very expensive and state-of-art spy apparati.

If we can't win in two 3rd world countries, how do we think we can win against a well educated, modern country?

any country that hangs its gays from cranes "modern". Try barbaric shithole.

Try technologically modern.

is cut the link.

IMHO it would be designed with the idea in mind that an enemy would employ electronic countermeasures to jam or provide false information to the unit.

That kind of a default would make sense in a testing environment, but in a hostile environment a default of "look for a safe landing on loss of command and control" would strike me as an obvious bad choice.

office.

with directional antennae on both receiver and transmitter, you can't cut the link unless you get directly between the two.

Hacking our grid and infrastructure is a reality.

First it circles a few times, in case the link is reestablished, then if not, it goes home.

Don't remember where, it was a few months ago.

I've known loads of brainless birds in my time.

It sounds like the premise to a bad spy movie.

If you did have this capacity why would you boast about it?

Since drone missiles and weaponized drones use very similar technology why the hell would you publicize this at all? If I were a country investigating countermeasures to the U.S. I would be tempted to keep this technique under wraps and use it later.

The reason it sounds like a bad spy movie is because that is the mentality that is being targeted with this ridiculous propeganda.

There is nothing about this story that makes sense to me.

of cat and mouse.

One of my first thoughts was espionage.

Espionage by us and against us. Maybe. Otherwise it is a spin story by the neocons to prep for operation "Iranian freedom."

The smoke and mirrors can be tricky.

I don't know what to make of your post. A stickman with a tinfoil helmet. If you agree or disagree, please speak clearly about it.

Really. Nobody knows what goes on behind closed doors, between countries.

Maybe the tin foil hat emoticon was the wrong one to use. But that one represents Conspiracy Theorists to me (which is something I consider myself to be sometimes). No offense intended.

This is the political high class way that engineers talk shit. You guys at the Pentagon get that, right?

This actually makes me mad and I have 0 direct ties to Washington. Before I could implement Ron Paul's leave everybody alone policy, I would bomb the crap out of Iran.

And why would you bomb the crap out of Iran?

Welcome to DU.

Why would you bomb the shit out of Iran, because they've gotten hold of a drone? What about the people, all those innocents, are they worth the cost of a single spy drone?

You reminded me of someone when you said that.

'Bomb, bomb, bomb, bomb bomb Iran!

Yeah, let's bomb another country and kill some more innocent men, women and children. We haven't been beaten enough yet.

Maybe you were kidding and I'm just way too fed up with insane, brutal wars that wipe out human beings to get the joke.

I knew in an instant that they have literally snatched the bird right out of the air.

I was only a matter of time.

Kinda scary actually.

Depending on how Stealth it actually is, they could use it on us now.

Hell, they sold used shower water back to the US for the troops to drink.

They wouldn't cut corners on fantastically expensive weapons systems, which by the way, are used to invade sovereign countries and their airspace.

The entire "defense" program is a waste and will eventually finish off this country.

ROFLMAO Someone got paid to think this up? ROFLMAO

locked up somewhere where they can get help, but keep them away from society, because anyone pushing to start a war in Iran is a dangerous threat to the world.

They didn't "lose their brains." They exploded, either an ambient or command fuze. Missiles, too. It's a safety feature.

Plus, every modern guidance system incorporates inertial guidance in tandem with GPS. RQ-3 did this. It's not a secret, either.

This story makes no sense.