"DCIM Malware" Program

[ZLevine]

Description: We place “image malware” on the drone. It can infect the pilot’s device if he either pulls images mid-flight or if the droneis returned to/retrieved by the pilot for one of a number of reasons:

• The pilot aborts the mission for an unknown reason.
• We’ve called Return to Home through one of our programs.
• The pilot notices our attempts to take control (unlikely) and calls the mission off using manual flight mode.
• The drone has crashed (by reason of pilot or us).

The pilot eventually retrieves contents from the DCIM, or transfers images to his wireless device mid-flight, and our image malware infects his machine and broadcasts data to lead to his location.

Possible Execution Methods:

• Masked file extension (cat.jpg.exe)
• EXIF/metadata exploits affecting specific programs (Windows Photo Viewer, etc.)
• base_64 encoded malware inside EXIF data, decoded by metadata method to infect websites where the image might be uploaded by the pilot (see: https://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.html)