Drones are becoming increasingly used by hobbyist photographers, companies, the government, and agriculture just to name a few. For the regular user, it is unlikely that anyone would actually want to hack your drone to gather information. I simply use my drone to capture footage of my holidays and weekend excursions which I’m sure no hackers would be particularly interested in. However, if you are a government organisation that is using drones it may become valuable for hackers to break into your drone software and steal the data.
Drones can be hacked easily because they rely on wireless communication between the remote control and aircraft. There are three main ways to hack a drone: hardware attacks, wireless attacks, and sensor spoofing. These can cause issues for the drone during flight and the data it’s collecting.
There are a huge number of ways that drones can be hacked:
- Wi-Fi attack – where the Wi-Fi communication between the drone and the remote controller is disrupted.
- Firmware reverse engineering – where the software controlling the drone can be reverse engineered in order to take control of the drone.
- GPS spoofing – this is where
- GPS jammer – the GPS signal can be jammed which can cause confusion in the drones internal navigation systems.
- Video link jammer – this is where the first person view live stream of the drone flight is interrupted causing confusion for the drone pilot.
- Manufacturer infrastructure compromise – when you purchase a drone it is likely that you need to provide some personal information to the drone manufacturer. This is typically stored on their servers. If their servers are hacked you can end up having your information stolen.
- Sensor spoofing – this is where the sensors are hijacked in order to exercise control over the drones action.
- Man in the middle attack – the malicious user will sit between the drone pilot and their drone and be able to take control of it by imitating the SSID of the drone.
- Denial of service – this can lead to de-authentication between the controller and the drone. A denial of service attack can be defined as an attempt to prevent legitimate users from accessing the system.
- De-authentication attack – this is where Aircrack-ng can be used to de-authenticate the pilot from their drone connection. The attacker is ready with another controller running the drone application and they can immediately connect to this drone and gain full access.
- Packet spoofing – this is where IP packets are generated with the purpose of impersonating another system. You can use a tool such as Wireshark to intercept the data being sent over the network and allow you to inspect the protocol.
Besides these basic forms of drone hacking there are many other physical hacks which rely on someone being in the physical space the drone is flying and simply taking control of your drone or gathering information through a man in the middle attack.
As drones get increasingly used for sensitive data collection by government agencies and private companies it is a continuous arms race between hackers and drone companies.
High-end professional drones are based on a number of known computing architectures that are not designed to be secure. This means that there have been a number of incidents where people have been able to force a drone to land by simply interfering with the control signals.
Often, data stored on drones is not encrypted and its transmission can be easily overheard by third parties. As a consequence, there is an urgent need for improving drone security and a few steps of ready been taken by a number of aviation authorities.
Why someone would want to hijack a drone
Hacking a drone has two potential outcomes for the hacker. They either want to take control of the device by controlling it themselves or causing the drone to land or they want access to the data.
How hard is it to hack a drone?
![Can drones be hacked? [studies and examples]](https://droneflyingpro.com/wp-content/uploads/2021/08/arget-zvHhKiVuR9M-unsplash-1024x576.jpg)
It is surprisingly easy to hack a drone with a small amount of free and a little bit of programming know-how. Drone manufacturers rely on the secrecy of the design or implementation as the main method of providing security for drones. This means that attackers can use standard hacking tools to take control of a drone in order to completely stop it from communicating with the remote control or spy on the data being transferred between the controller and the drone.
Internet of things
Drones are increasingly connected to the Internet via their first person view app programs. For example, DJI drones can live stream to a number of social media sites including YouTube and Facebook.
Drones are also connected to laptops and computers which are, in turn, connected to the Internet which provides a pathway for the injection of malicious code or hijacking of some of the drones firmware.
Because consumers want more connectivity between their small electronic devices it is likely we will see more drone manufacturers connecting their drone to the Internet for live streaming and other social purposes.
According to Statista, an estimated 75.44 billion devices worldwide will be connected to the Internet by 2025. Given that drones are now part of this Internet of things revolution there are a variety of different studies that have hijacked a drone via different methods.
Studies that have hacked a drone
I have scoured the research literature and here are some of the best methods and studies on how people have been able to hijack drones.
In 2014 a study described the security problems of a consumer-level drone the Parrot AR.Drone 2.0. This drone was very popular among hobbyists which makes it very attractive to understand the internal software and vulnerabilities. The scientists performed a security threat analysis of the drone.
They focused mainly on obvious security vulnerabilities like the unencrypted Wi-Fi connection and the user management of the Lenox operating system which runs on the drone. They showed how the drone can be hacked in order to hijack it and also provide instructions to secure the drone’s Wi-Fi connection and its operation with the official smartphone app or a third-party PC software.
Primarily, the hackers/scientists did a port scan in order to find all of the available vulnerabilities such as unencrypted FTP connections – which may give you access to the data and video of the drone after connecting a USB thumb drive to it, and also eavesdropping on the live video stream and submit new configurations through the control ports. They found that gaining full access to the root shell over the unencrypted Wi-Fi network was not hard to do.
A scientific study published in 2018 looked at the security analysis of drone communication protocols. In their paper, they describe and demonstrate the approach of attacking a drone to take over control. They were able to do it to a system that is commonly used for hobbyist and semiprofessional drones.
They recommend that all drone communication protocols use a secret key for transferring information and use the longest possible secret. This will make a brute force attack considerably more difficult and it would ensure stronger authentication of the legitimate owner. They highly recommend using cryptographic methods for drone communications.
Another study, published in 2019 was able to hack the same drone with raspberry pie and Wi-Fi pineapple. They were able to launch a number of very advanced attacks such as denial of service, man in the middle, unauthorised root access and packet spoofing. They were also able to completely disable the drone by using a Wi-Fi enabled raspberry pi running bash scripts.
Their paper concludes that drone vulnerabilities are a vital security and privacy concern for the general public and it calls for drone manufacturers to do more for their customers.
Can DJI drones be hacked?
DJI drones are able to be hacked like any other drone. They can be hacked via Wi-Fi attack, man in the middle attack, sensor spoofing and many other software hacks. They are also able to be hacked to remove limitations set by DJI such as unlocking no-fly zones or boosting acceleration.
DJI takes security very seriously and you can read more about their security response centre by reading more on their website.
They are constantly looking at ways to protect the data being collected by their drones and, recently, have enabled a local data mode which is an effective data privity feature which eliminates Internet connectivity and prevents the transmission of drone data over the Internet.
Hacking your own DJI drone
DJI drones are not just able to be hacked by bad actors. There is a community of drone hackers which want to remove all of the limitations put on them by DJI.
You are able to read more about this community at https://drone-hacks.com.
This company provides software that allows you to modify your DJI drone. You can change the parameters of your drone (such as vertical climb speed, maximum altitude tilt in normal and sport mode) and also remove any geo-fencing restrictions. They have a variety of options including:
- DJI custom flight controller – this disables the enforcement of no-fly zones and disables the altitude limits.
- DJI no-fly zones – this will remove all of the no-fly zone databases from a supported drone model
- FCC boost – this will change your drone from CE mode to FCC mode.
- ADB root shell – if you are friends a company or a government institution and need to route the access to the drone this allows you to extract all of the data needed directly from the drone’s file system.
- DJI flashing firmware – this allows you to upgrade and downgrade your DJI drone firmware easily
- DJI parameters – this allows you to change hundreds of settings which have previously been hidden from you. You don’t need to use the debug mode in the DJI assistance you can simply change the parameters directly.
The legalities around this are a little bit uncertain but if you still fly within the regulations and rules that are imposed in your country you will not face any legal risks. However, the moment that you step outside of the rules and regulations you immediately open yourself up to a variety of risks.
If you want to know more about how to remove due fencing using this software check out my other article – the best drones without geo-fencing – click here to be taken to the article.
How to protect your drone from hackers
There are a variety of ways to protect your drones from hackers. Not only should you keep your software up-to-date but, if you’re concerned about hacking, many of the attacks rely on being in the same places the drone. You can get around this form of hacking by making your movements and drone flights unpredictable.
Software
All of the drones that I have looked at for this article do not use any form of encryption to protect the information that is being exchanged between the drone and the drone controller.
Keep your firmware up to date
Keeping your firmware up to date will be one of the best things you can do to protect your data and stop your drones from becoming hacked. Drone manufacturers are issuing updates to the firmware and different security patches when they identify a vulnerability.
Updating your drone as soon as it is recommended by the manufacturer will make sure that your drone is not vulnerable to data leaks or hackers. Keeping your drone one step ahead of the hackers is as easy as following the on-screen instructions.
Use Antivirus software
I make sure that I use antivirus software on every computer that I am likely to connect my drone to.
Some of the best antivirus protection is you can get for PCs are:
- Bit defender
- Kaspersky
- Norton Life Lock
- Avast
- AVG Antivirus
Even though we call this type of software antivirus it is very unlikely that you’ll get hit with an actual computer virus these days. Instead, ransomware and data-stealing Trojans are much more common as the bots that can let people access your computer for illegal purposes.
There are many awesome free options which also mean that there is no excuse for keeping your computer Trojan free.
Use strong passwords
You may need to protect your base station or app with a password. Make sure that you choose a strong password which are not able to be cracked in the time that you are communicating with the drone. Using a mix of letters, numbers, and special characters to create a strong password will help protect your drone while you are flying.
A strong password typically has these features:
- at least 12 characters long
- a combination of uppercase, lowercase letters, numbers and symbols.
- Not a word that can be found in a dictionary or the name of a person, character, organisation or important dates for your personal life.
- It should be significantly different from the other passwords that you use to access online accounts.
Once you have a strong password, I recommend using a password manager such as Lastpass or Keypass (my favourite) and don’t share it with anyone – even a friend or family member. Never send a password by email, instant message or any other means of communication that is not secure.
Ensure your drone has a return to home location
Once you have set the home point this will enable the drone to return to home if it loses signal, if your signal is jammed, or if the battery is getting low. Importantly, it will also enable you to recover your drone from a hijack attempt apart from those that use GPS spoofing.
Physical hacking
Not only is your drone vulnerable to hackers through the use of software to hijack the drone but it is also important to protect your drone from physical attack as well. Also, some of the software attacks rely on people being able to intercept the communication between your drone and the remote controller – this means they need to be in the same location as you.
If you are interested in protecting your drone and security here are the steps that you should take.
Fly at different locations
I have my favourite flying locations but, if I was concerned about my security and the security of my drone I may want to switch up when and where I fly my drone.
Flying my drone at different locations means that I am able to avoid creating a pattern of behaviours and movements which enable a hacker to physically trace me to an area.
Fly at different times
If your flying takes place at the same time every day, week, or month it is likely that someone observing your movements would be able to predict when you are likely to be flying your drone.
By simply changing the times that you fly your drone and looking after data security you can get around a lot of the man in the middle and Wi-Fi attacks.
Don’t post on social media
Lastly, do not post on social media where you are flying in real-time and do not live stream your flight to YouTube or Facebook. Social media has become a regular tool used by hackers to find out information and also discover where you are and when you are not at home.
Feel free to post your flight and your experience on social media after you have collected the data for photos that you need. However, make sure as well that you do not advertise when you are away from your house on social media. This goes for long holidays as well.
Can drones be tracked?
There are a number of ways that drones can be tracked and one of the most readily available ways is by using an app such as drone watcher.
Apps
The drone watcher app turns your android device into a detector of drones and is able to alert you and track their path. The app detects most commercially available consumer and prosumer drones and records the data including the drone type and ID which can be used to document evidence to be used by local law enforcement.
The developers of this app claim that the drone watcher app is able to detect, track, and records information on approximately 95% of commercially available drones using advanced signal intelligence technology.
The app alerts users when a drone is detected within half a mile recording the drone type and ID which can be used to document any complaints the person wishes to make against the drone pilot.
In addition to personal use for privacy protection, the drone watcher app can also be used for drone control and security at public events.
If you are not sure if there is a drone in the area you can use this app to quickly determine if it is within half a mile of your current location.
Summary
In this article, we have looked in detail at how drones can be hacked and the methods that hackers use to spoof and take control of your drone. We have also looked at the science and the research which has used relatively simple and common techniques to hijack data and control drones.
Interestingly, commercial drones do not use any encryption while communicating with the controller. This opens up a range of issues including security and privacy concerns.
Although we can’t put encryption on our drones there are a number of ways that we can protect our drones using strong passwords, VPNs, antivirus software, and keeping our drones firmware up to date so that it has the latest security patches.
Ultimately, whether or not your drone is likely to be hacked depends on the sort of data that it contains. Or, the locations that it is flying. It is unlikely that you are able to fly your drone over sensitive areas such as nuclear power plants or government buildings and therefore you will not have data that is particularly attractive to hackers.
Drones that are operated and owned by the government and military personnel are likely to be much more interesting and worth the effort to hackers.
As long as you go through some very simple security and personal data protection procedures it is unlikely you will become the “low hanging fruit” that the hacker will want to attack.
