May 5, 2019,   4:24 PM

This 13-Year-Old Hacker’s Live Stunt Exposes The ‘Other Side’ Of IoT Devices

Waleed Hmidan

Waleed is a filmmaker with a dozen short films in his filmography, some of which have been featured... FULL BIO

In front of a room full of packed audience, a wiry and bespecatacled teenager sat on the stage. His attention was concentrated on a laptop that whizzed codes.

Reuben Paul, 13, was not particiating in a science contest but was trying to hack into a live drone that was buzzing on the stage during Kaspersky Lab’s annual Cyber Security Weekend 2019 in Cape Town, South Africa. All of a sudden, the grounded drone's camera feed was hijacked and it took flight as the room broke into thundering applause.

The 7th grader, who goes by the name of Cyber Ninja, was able to hack into the drone and cease its operations. He demonstrated that he could disconnect a user from his drone and then take complete control of it by exploiting its insecure protocols. 

The drone hack performed by the 13 year old was a controlled stunt organized by Kaspersky Lab o highlight the urgent need for stricter measures from companies developing Internet of Things related-devices such as drones, baby monitors, smart appliances, smart home devices, and connected toys. 

The incident also shows a gaping hole in the security measures of millions of every day gadgets and technology devices, that are part of the Internet of Things (IoT). While active users lap up the latest hyper-connected gadgets, they often overlook the security measures of the device. While governments already have tight controls in place around devices such as drones, companies, on the other hand, still need to take the security aspect more seriously.

“Many companies compete to get their connected products out to the market and the consumers at the fastest speed to start generating profit," said Maher Yamout, Senior Security Researcher at the Global Research and Analysis Team at Kaspersky Lab. "But doing so often means they overlook the security features or even completely ignore the security issues. Such devices can become lion’s meat for hackers and if they fall prey, this could lead to invasion of privacy, loss of data, valuables and even life."

For Paul, the hack took just 10 minutes - an absolute horror if it was a real life situation. 

“The insecurities in the drone are shared by other IoT devices.  Now imagine if this had been done by cyber-criminals," he explains. "If I can do it, who’s not to say that more motivated cyber-criminals would not be able to do something very similar. The consequences could be disastrous.” said Reuben Paul. “We need to reinvent cyber security because what we are doing so far is clearly not enough. It is important for manufacturers to implement security controls into their devices and not put consumers at risk!” he added. Reuben ended by cautioning “Let us be careful that the Internet of Things does not become the Internet of Threats.”

IoT analytics predicts that there are around seven billion internet connected devices in the world. Without ample secutrity measures, these connected devices could be exploitated as they expose an entire ecosystem to risk.