A hacker tried selling stolen military drone documents for $200

Researchers at the cybersecurity firm Recorded Future recently released a report about one of its more interesting findings.

While scouring the hacker forums on the dark web, the firm’s analysts discovered someone selling MQ-9 Reaper drone documents — maintenance books, training guides, and a list of airmen assigned to the military drone. The hacker was looking for $150-200 for the documentation.

That may seem a strangely low asking price, and according to Andrei Barysevich, a Recorded Future analyst, it is. The hacker was advertising the documents as classified information, but while they are only made available to military and its contractors, they aren’t classified. Still, according to Barysevich in a statement to Buzzfeed News, “We felt like he has no true understanding of the value of this information, he had no idea how to sell it, he was just trying to get rid of it.”

The way in which the hacker gained access to these drone documents is just as ridiculous as the hacker’s lowball sales price.

In 2016, Netgear issued a warning about a security flaw in its routers. The U.S. military had failed to update the accessed router with the fix for this well-known bug — which is exactly how the hacker got in.

Even more interesting, in Recorded Future’s communications with the hacker, the firm discovered just how deep the hacker’s access into the U.S. military networks were. The hacker said he was able to watch live footage shot by the drones. He was even able to identify to the cyber security firm which military official he was able to hack to gain access to the now-for-sale drone documentation.

Recorded Future has been in touch with authorities and is helping them on the case.

Let this be an important lesson for all: Secure the networks where you host your military drone files.