Iranian Hackers Post Images Over JFK Airport From UAV That Was Hijacked In March

http://rce.ir/viewtopic.php?f=16&t=173&start=20#p1716

by ToothlessJake • 13 years ago

124 117 13 years ago

The incident reported back in March via LATimes: http://articles.latimes.com/2013/mar/05/nation/la-na-nn-faa-...

Back-story on the series of on-going hacks by Iranians against US entities/corporations: http://cryptome.org/2013/07/ir-hack-forum.htm

stefap22• 13 years ago

This is the recording (needs a login) http://www.liveatc.net/forums/index.php?action=dlattach;topi...

Drone sighting at JFK

celwell3• 13 years ago

can someone post their login info here please?

johnhess• 13 years ago

What kind of list did I just get myself on for that little visit?

philmcc• 13 years ago

Depends. At the bottom of the page did it have a "Like" icon, and the words "432 of your friends like this page, you should too?"

If it did, you're already on that list.

stefap22• 13 years ago

It's a No-fly list!

kevin818• 13 years ago

Excuse the ignorance but can someone explain to me what it is I'm looking at?

wtvanhest2• 13 years ago

My take on this is that someone is claiming that the UAV that crashed in Iran (supposedly hacked) had images on its hard drive of the JFK airport.

That person is basically claiming that the UAV was at one point flown over JFK airport at some previous time before the US moved the UAV to the middle east.

ToothlessJake4• 13 years ago

The person does not claim that. Where did you draw this from?

wtvanhest2• 13 years ago

I said "my take" because i, like other hn readers have no idea what I am looking at so I made a guess. You are the poster, you can explain what is going on here.

JeremyMorgan3• 13 years ago

I'm not sure what we're looking at there, but it's something I probably shouldn't have clicked on.

potatolicious• 13 years ago

Yeah, I really would have appreciated some warning for that.

TaylorAlexander2• 13 years ago

...why? Because it's arabic? Ooohhh, scary arabic. Or they're talking about spies and bombs? Don't we talk about those things on hacker news too?

I can't read it, I'm working my way through the google translation and just starting, so maybe it's all "bad" stuff, but to be honest, I hope iranians can shed some light on what our government is doing - the US government itself certainly isn't going to help with that.

bredren• 13 years ago

I also, don't want my traffic to be tied to forums like this.

kybernetyk• 13 years ago

Last time I checked reverse engineering forums weren't forbidden by the thought police.

lawnchair_larry2• 13 years ago

He actually has a point, sadly. Visiting a "Jihadist" website, based on some arbitrary definition and interpretation from some cyber freedom fighter in DC, VA, or MD, is enough to get your "metadata" added to their graphs. You think Iranian sites with posts about hacking the US aren't on that list? I don't.

It's not enough to get you a visit from the feds or anything, but it's almost certain that any competent intelligence agency is storing anything that touches that website. Whoever posted it likely has links in their social graph to very high value targets.

lukejduncan• 13 years ago

you were checking the non-secret laws

JeremyMorgan3• 13 years ago

not yet.

LordHumungous• 13 years ago

But that site is written in scary terrorist letters.

jluxenberg• 13 years ago

http://www.law.cornell.edu/constitution/first_amendment

marshray7• 13 years ago

In case anyone doubted the self-censoring chilling effects of pervasive surveillance were real.

What are the consequences for our society of us fearing to click on links that they may turn out to be foreign propaganda?

kunai• 13 years ago

Yeah, I really regret going there now...

Which is really, really sad. It's come to this, where we have to be afraid of drivebys on websites just because they may be honeypots for the US government, or because they might get all of us on some surveillance list.

When is it going to stop?

antocv• 13 years ago

Its going to stop when you get a spine.

People like Snowden didnt ruin their lifes so you can avoid clicking links. For fucks sake, the least you can do is grow a pair of balls and exercise your god damn given freedom to do as you wish, stand up.

TaylorAlexander2• 13 years ago

So... this is really interesting and I have no idea what any of it says. I haven't tried google translate yet but there's also text on the images...

Anyway, can someone (perhaps the original poster) explain what specifically is happening? :)

ToothlessJake4• 13 years ago

A user/group named "Parastoo" has been hacking targets like IHS Janes: http://cryptome.org/2013/02/parastoo-janes-cbrn.htm

Recently has started making statements about hijacking drones: http://cryptome.org/2013/07/parastoo-uav-launch2.htm

TLDR: Iranian chap(s) have been on a hacking spree and seem to be honing in on what they like to target. In this case US drones over US skies/assets.

weinzierl3• 13 years ago

    US drones over US skies

Are you saying the US uses drones on their own territory? If yes, what for? Spying their own people comes to my mind, but maybe I read to much spy stories lately and there are legitimate reasons.

lostlogin2• 13 years ago

That page is so incredibly foreign to me - right justified, stuff from right appears on left, things from top on bottom etc. I'm surprised how striking I found it.

bdcs• 13 years ago

I felt the same way the first time I saw an Arabic-English restaurant menu. The symmetry of the juxtaposition of the two typesetting schemes is quite elegant and striking.

E.G., see here http://www.flickr.com/photos/denon/3563523851/

pizza• 13 years ago

It's (obvious but still) cool to see how the more information-dense items are long in both sides!

msoad5• 13 years ago

What if I tell you all your favorite website has right-to-left layout for right-to-left languages like Arabic, Hebrew and Farsi?

lostlogin2• 13 years ago

Which site are you meaning? Thinks like Google? Its made me realise how much I depend on so-called normal layouts for things like next page buttons etc. something I had never thought about really. Obviously I don't frequent many sites that are primarily in another language, Der Speigel is the only one I think. That site is left to right reading so it can follow the same formatting styles as English. I haven't noticed any German language related layout quirks there.

msoad5• 13 years ago

Just yo let you know those text on photos are basically mystic poems. One of the tools Iranian propaganda uses

omegant• 13 years ago

What kind of mystic poems? autors? not precisely these ones but generally. I find it interesting.

msoad5• 13 years ago

I'm not sure about authors, but I can try to translate.

To give you a context, these poems are written by gnostic who believed they saw the real truth and they had no fear of dying because you can not never kill their souls. I assume any culture has this sort of things"

First poem:

We are stuck in a deep well of the bad thinking one Our message would not reach to you (God?) easily

Second (red) I have experienced a lot of pain during my life No pain is comparable to pain of Hijran( being far from God, "the one", etc)

Third (red) This is Arabic. I don't know Arabic. I can say it's part of Quran and it's referring to " thos who belive will be able to discove" or something like that.

msoad5• 13 years ago

Translating this forum is hard. They uses a specific language that has tons of reference to the way Iranian government sees the world. For example they never say "Israel", they would say instead "Usurper Regime". Because they never recognize Israel as a country.

What we have here is a forum by Iranian semi-military force "Basij". They bluff all the time and you never know what is truth. They have no shame in photoshoping and manipulating the truth.

pooriaazimi• 13 years ago

Translating this forum is hard. They uses a specific language...

I'm always fascinated by the way these people's minds seem to work! Reading his posts, this "DarkPassenger" fellow seems even crazier than our good HN friend losethos: https://news.ycombinator.com/threads?id=losethos

jnbiche2• 13 years ago

If you recall the Iranian uprising a few years ago, the Basij were the jack-booted thugs who were beating the shit out of innocent civilians. It was a member of the Basij who killed Neda: https://en.wikipedia.org/wiki/Death_of_Neda_Agha-Soltan

ToothlessJake4• 13 years ago

I made a brief timeline of Parastoo hacks when submitting the Cryptome.org article on this topic. The hacker(s) referenced VSATs and drone hijacking after hacking IHS Janes, pre-JFK drone incident. They then started to reference the JFK incident in further releases about hijacking US drones over US skies/assets: https://news.ycombinator.com/item?id=6038657

marshray7• 13 years ago

All I see are two images of nondescript buildings and cars labeled "FLIR Systems". Would an actual drone image used for reconnaissance over hostile territory waste a bunch of screen area on the manufacturer name of the camera?

Also, there's some censored text in the upper left. I suspect that's the date and time.

My guess is these pictures were lifted from promotional material like the "MicroSTAR" sheet just below it.

qq66• 13 years ago

FLIR uses that text for price discrimination - the camera is much more expensive without the text.

marshray7• 13 years ago

Now there's an industry ripe for disruption. Must be patents.

magicalist• 13 years ago

I'm surprised no one else in this thread has said anything. Maybe there's some more context?

The only context provided so far is that LA Times article talking about a sighting of an "unmanned aircraft or drone" near JFK in March, with (AFAICT) no connection with this forum post at all, except one or more of the posts in that thread also seem to mention JFK.

Is anyone actually taking this seriously? Do people not know that forums are full of bullshit the world over?

Edit: in fact, this person seems to be pushing these "Parastoo" self-published press releases rather hard, which themselves seem to be bullshit aimed at pressing members of the IAEA to publicly denounce Israel (while trumpeting their own hacker cred, of course). The only way anyone is ever going to see the threats in those releases is if they get eyes on them. There may be a story in chaining together these seemingly grandiose claims, but it's not in this random forum post of non-descript screenshots, and until I see evidence otherwise, I'm going to go ahead and assume this person is here to try and get "grassroots" attention on their self promotion.

D9u• 13 years ago

I thought "FLIR" meant "Forward Looking InfraRed?"

marshray7• 13 years ago

Yes, it's also a brand name of a prominent manufacturer.

soheil3• 13 years ago

Just because you can use MSPaint to draw some text on some images doesn't mean you're a hacker. Get it right HN!

scottmcleod• 13 years ago

Look at OP's submissions..

zxcdw• 13 years ago

What about them, exactly?

blhack2• 13 years ago

This thread seems to be pretty chock full of some tinfoil hats.

1) You're not going to be added to "a list" because you clicked a link on hacker news. Remember that the NSA employs some of the smartest people in the world. Would it be meaningful to add a bunch of curious silicon valleyists to a list of "possible terrorists"? Probably not.

2) If you think that an aircraft that is anything bigger than a small pigeon could get anywhere near a major airport without getting itself a nice escort, then you're nuts.

Here is a map of the airspace near JFK: http://www.aeroplanner.com/notams/airspace.cfm?apt=jfk

This is all "Class b" or "bravo" airspace. It's all heavily controlled, heavily monitored with radar, and you have to ask permission to enter it.

It's incredibly unlikely that there was a "drone" in bravo airspace. Possibly a UAV, definitely not the boogey man Iranians.

3) This website doesn't even say anything. It's some pictures that could have easily been photoshopped together. Google translate isn't giving me anything interesting, and unless HN is a LOT more diverse than I realized, you're all going nuts over a couple of grainy photos.

Finally, here is what the drone that Iran supposedly "captured" last year looks like: http://i.imgur.com/ALveZWi.jpg

It isn't a toy. It's huge. There is no way that is getting anywhere near a RADAR without everybody knowing about it. Yes, it is [possibly...meant to be, rumored to be] stealth. That doesn't mean it's going to go undetected into a major airport like that.

Relax. Go have a beer.

jnbiche2• 13 years ago

1. You have a lot more confidence in our government's ability to accurately compile lists than I do, particularly in light of the failures of the no-fly list: https://en.wikipedia.org/wiki/No_Fly_List#False_positives

2. Based on commentary from native Persian speakers on this thread, it would appear that no one is claiming that the drone was remotely piloted by Iranians into US Airspace, but rather the one that was shot down in Iran several months ago (confirmed by the US Government) had these photos on it.

3. See above, there are at least 2 Persian speakers on this thread. HN is a LOT more diverse than you realize.

https://en.wikipedia.org/wiki/Iran–U.S._RQ-170_incident‎

s_q_b7• 13 years ago

"2. Based on commentary from native Persian speakers on this thread, it would appear that no one is claiming that the drone was remotely piloted by Iranians into US Airspace, but rather the one that was shot down in Iran several months ago (confirmed by the US Government) had these photos on it."

If this is true it means the Iranians compromised the encryption on the UAV's drive, which would be seriously not good.

s_q_b7• 13 years ago

If this is anything, it's probably a redux of the Taliban accessing the unencrypted video feed of Predator drones. For a long time, most video (not control) feeds were sent in the open. The Taliban realized this and were able to grab those feeds using a $30 antenna and a laptop. A compromise in operational security? Sure. A method of "hijacking" UAVs? No way.

I'm not convinced this shows anything at all. But even if it did, remember, the Iranian government has a history of photoshopping images for propaganda purposes. See e.g. http://thelede.blogs.nytimes.com/2008/07/10/in-an-iranian-im...

Agree with OP. Very little here. Keep calm and carry on.

EDIT: Turns out they're claiming these were pulled off the RQ-170 Sentinel that crash landed in Iran. If that's true, it would mean the drive was salvaged and decrypted, which is a potentially big deal.

bigiain• 13 years ago

"If you think that an aircraft that is anything bigger than a small pigeon could get anywhere near a major airport without getting itself a nice escort, then you're nuts."

I'm reasonably sure I've got several "aircraft" in my shed which I could easily use to overfly "a major airport" if I chose to do so.

This one, for example, is at least medium or large pidgeon sized (610mm wingspan): http://www.flickr.com/photos/bigiain/5228554566/ - the flight in that video was around 2.5km from the intersection of the runways at Sydney Airport. That plane (with the camera on board) can fly for ~23 minutes doing 20m/s. That'd give me a comfortable 10mins loiter time over the airport while still being comfortably able to retrieve the camera and it's SD card.

Note - that's barely more that $100 worth of stuff, it's less than 150g all up flying weight, and it's got so little metal in it that I'd be astounded if the regular airport radar could distinguish it under ideal conditions, never mind while it's only a few tens of meters up and buried in the ground clutter.

Note2 - that plane would require retrieval to get the images back, someone actually interested in getting airport pictures without getting caught could use a slightly larger plane carrying a video transmitter sending pictures, never intending to get the plane back (ideally, I guess, ditching the plane at sea to avoid anyone seeing it - a hollow balsa/film construction that'd sink easily might be better than a foam "floating" construction.)

Note3 - that plane as it's configured now isn't flyable at 2.5km range, but there's lots of hobbyists who've worked around the problems there.

thezach• 13 years ago

If you look at OP's submissions you can see that well, this person posts iranian hacking stuff, and thats it. Makes you wonder about OP's motives.

I'm also okay if the NSA targets OP looking at his submission list.

mkr-hn• 13 years ago

People have their domains of interest. Not all hacker-minded people focus on the latest fad programming language or database.

LoganCale3• 13 years ago

It's probably a throwaway account for posting information related to this.

Shame on you.

betawolf33• 13 years ago

I looked at his submission history. I see four items.

The first, dated four days ago (and the only I see one preceeding this), is a title making some sort of claim about Booz Hamilton based on a whois lookup. Not exactly a quality submission, but it has nothing to do with Iran or hacking.

The other three submissions are all about what seems to be some news he's stumbled on about hacking/reverse engineering claims from Iran.

Considering this is 'Hacker' news, you can understand why he might think we'd be interested in this. Of course, it would be better form for him to write up an article explaining the separation or link between these items rather than posting lots of direct evidence.

None of that means he should expect to have his privacy breached by a US intelligence agency, and frankly your support for that on the basis of such a flimsy characterisation is blood-chilling.

A lot of people seem to have become alarmed because they've seen persian text and heard that it's about hacking. That's equally chilling.

Is this all it takes?

rogerthis• 13 years ago

Hey, iranian coming here, how are you doing?

frozenport• 13 years ago

Because I can't read moon runes, what is this this about? Its bad enough when people drop technical posts without context, but seriously what is this saying? Perhaps we should actively encourage posts in English so that anybody from Bangkok, Baghdad, Beijing and Boston and could understand these posts.

davenull• 13 years ago

I call bullshit. There are numerous "funny bits" in this thread, number one, they display the info page for a "UAV Imager system" which in no way offers control of a drone. Second, the very generalized schematic for a nuclear power station, most likely a mid-60's design BWR, means nothing to anyone.

Iranian Hackers Post Images Over JFK Airport From UAV That Was Hijacked In March

Related Stories