Drone Hacking Made Easy

Hacking is in the news a lot these days, but it seemingly hasn’t occurred to most drone owners just how susceptible their flying machines are. I saw this firsthand at a military base in California, where a Marine Corps infantry officer (who requested anonymity) described plans for his unit’s next exercise. Their higher command, he’d learned, was thinking of purchasing off-the-shelf quadcopter drones to watch the Marines in real-time and direct simulated bad guys to ambush them. But the officer wasn’t worried—he explained that he could easily hack the drones if he wanted and cause them to crash, or land, or just take them over completely. It was simple.

He planned to follow recently published procedures to get in through the drones’ standard Wi-Fi protocol link and inject code into their control systems. To do that, hackers need to create a “cantenna” that focuses their signal onto the drone and drowns out the owner’s signal. Once connected, the hacker can use a Raspberry Pi (or similar homebrewed computer) with a smartphone or tablet to complete the hack. And that's all. One Wi-Fi drone hacker even devised a system where a drone could hack a number of other drones on its own. 

The WiFi method is just one way to hack a consumer drone. The Hacker News reported on a newly created device, the Icarus. The device, which its creator is not making available to the public for obvious reasons, hijacks a drone through its direct remote control link from a dedicated transmitter using digital frequency-hopping spread spectrum protocols (some consumer drones use Wi-Fi to allow control from smartphones and tablets, some use a combination of a dedicated transmitter and Wi-Fi, and some use solely a dedicated transmitter). The Icarus allows a hacker to gain control of the drone’s flight control systems and fly it using his or her own transmitter. Johns Hopkins researchers have published a report on exploiting weaknesses in data links in consumer drones to bring them down, identifying three principle methods of attack. GPS “spoofing” is another method, which doesn't so much hack drones as geospatially fool them, telling them they’re somewhere they’re not. Spoofing may well have been the culprit that brought down the RQ-170 Sentinel over Iran.

Will consumer drone hacking become a serious threat, especially with regard to the exploding popularity of the aircraft? And will industry and governments offer proactive mitigating solutions? Nobody really knows yet, but the tools and methods are out there in the wild for anyone inclined to use them. It’s time to start getting used to the idea.

Ed Darack | | READ MORE

Air & Space/Smithsonian contributing editor Ed Darack is the author of The Warriors of Anbar; War Moments; The Final Mission of Extortion 17; Victory Point; and three other books. He is the founder of Darack Research, a company that innovates unmanned systems, which grew out of his July 2014 Air & Space article Build Your Own Drone.