CubePilot, Maker of Drone Autopilots, Hit by DNS Hijacking

CubePilot, an Australian company that develops flight controllers and navigation hardware for drones, has reported a serious incident — the hijacking of its domain's DNS records. Tampering with domain name system settings lets attackers redirect users to their own infrastructure, intercepting traffic intended for the legitimate service. Such a scenario opens the door to data theft, malware distribution and phishing.

According to a report published on the company's website, on July 24 an attacker gained control over the DNS settings of the cubepilot.org domain and was able to intercept traffic directed to internal systems. What's more, the attacker issued TLS certificates covering every subdomain of cubepilot.org. This meant that visitors saw a correct HTTPS connection with a valid certificate while actually being on infrastructure controlled by the attacker.

Credentials at risk

Because the certificates covered every subdomain, any credentials entered on July 24 on the company's services — including the portal and the forum — could have been compromised. CubePilot strongly urged users who had reused the same password anywhere else to change it immediately.

The company said that on the same day, July 24, it regained control of its domains, revoked the fraudulently issued certificates, preserved evidence, notified the relevant providers, and reported the incident to the Australian Cyber Security Centre and law enforcement. Affected parties are promised direct notification once the impact is confirmed by the investigation.

Drones for civilian and defense applications

CubePilot produces autopilots and navigation equipment for drones used in surveying, search-and-rescue operations, agriculture, as well as in defense and government fields. The company has previously stated publicly that it supports Ukraine, and its products have been supplied to the country, including as part of an Australian government aid package.

For now, all OEM services, the community forum and the documentation portal have been taken offline. CEO Philip Rowse said on LinkedIn that, as a precaution during the investigation, the platform's ERP portal has been shut down as well.

A separate warning concerns firmware: the company is verifying the integrity of the published images and advises against installing firmware downloaded on July 24–25 until its safety has been confirmed. Images obtained before July 24 are considered safe.

Finally, customers who have received payment requests supposedly from CubePilot are advised to take no action and to verify such demands by phone through their usual contacts.

Source: Bleeping Computer