At the Virus Bulletin 2015 conference, HP Security Research security researcher Oleg Petrovsky detailed methods that can be used to hack drones that are performing scheduled routes.
The drone industry is growing rapidly, with research showing that sales will exceed $89 billion in the coming years. However, their rapid development also raises concerns about their safety and, of course, the threat they could pose to our privacy.
At the Virus Bulletin 2015 conference, HP Security Research security researcher Oleg Petrovsky detailed methods that could be used to hack unmanned aerial vehicles (UAVs).
Oleg Petrovsky demonstrated how someone could hack a drone by targeting its flight controller – the expert analyzed the controllers of various multi-rotor drones and discovered several weaknesses that could be exploited in cyber attacks.
Although there are many different models of drones available on the market, they are largely made up of the same basic parts, including the following: motors, batteries, sensors, a GPS unit, a remote control radio receiver, electronic speed controllers (ESC), and the flight controller.
Petrovsky focused his research on attacks targeting the flight controller, which is a system consisting of various sensors and a processing unit. The majority of drones use the same flight controllers, such as the ArduPilotMega (APM) and Pixhawk from 3D Robotics, MultiWii, OpenPilot, and DJI Naza.
A potential attacker could focus their efforts on hacking these controllers, allowing them to target a wide range of models. Petrovsky used an ArduPilotMega (APM) flight controller on a drone he built and a Mission Planner, which is a ground station application, for his test.
The researcher documented in detail several attack scenarios against drones with planned routes using ground station software. The ground station application is a key component of the flight of an unmanned aircraft, as it allows communication with the vehicle's antenna and allows the user to control it wirelessly.
The researcher highlighted the lack of authentication in the protocols used to remotely control drones, which could be exploited by attackers to gain control of the vehicles.
Despite the large amount of research that has been conducted on drone hacking, Petrovsky explains that there have been no significant improvements in terms of their security, and this is because there have not yet been any real-world attacks on commercial unmanned aerial vehicles.
